joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001b9b0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, ecx
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.14000ad94
cmp eax, 1
jne 0x14001ba13
mov edx, 0xf9eaf997
mov r8d, 0x6c56c536
mov ecx, 0xe350a40f
mov dword [rsp + 0x48], ebx
call fcn.140001378
lea rcx, [rsp + 0x48]
mov r9d, 4
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret

Function at 0x14001ba1c
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.14000ad94
cmp eax, 1
jne 0x14001ba7f
mov edx, 0xba58e928
mov r8d, 0x2fe4d58e
mov ecx, 0xa0e2b4e0
call fcn.140001378
mov rcx, qword [rsp + 0x40]
mov r9d, 0xb
mov rdx, rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret

Function at 0x14001ba84
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x28]
sub rsp, 0x120
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov bl, dl
mov rdi, rcx
test dl, dl
jne 0x14001bad4
mov ecx, 1
call fcn.140025950
test eax, eax
jle 0x14001bba9
mov ecx, eax
call fcn.14001b9b0
movabs r8, 0x2000600050006
lea rdx, [0x140128df8]
lea rcx, [rsp + 0x50]
call fcn.140024a08
nop
test bl, bl
jne 0x14001bb6f
and qword [rsp + 0x40], 0
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.14000ad94
cmp eax, 1
jne 0x14001bb65
mov dword [rsp + 0x34], InitCommonControls
mov dword [rsp + 0x30], 8
mov edx, 0x9a1aae36
mov ecx, 0x80a0f314
mov r8d, 0xfa69290
call fcn.140001378
mov rdx, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rsp + 0x58], rax
mov r8, rdi
lea rdx, str.https:__www.xreveal.com_update_xreveal.txt
lea rcx, [rsp + 0x50]
call fcn.140024ad4
nop
lea rcx, [rsp + 0x50]
call fcn.140024a84
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400e79e0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14001be1c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov qword [rsp + 0x20], rdx
mov edx, ecx
xor esi, esi
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov ebx, esi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14001be72
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
test eax, eax
jle 0x14001be72
lea ecx, [rsi + 0x5c]
cmp word [rdi + rbx*2 - 2], cx
je 0x14001be72
mov word [rdi + rbx*2], cx
inc ebx
movsxd rcx, ebx
mov word [rdi + rcx*2], si
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14001be84
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x30
mov rbx, r8
mov rdx, rcx
lea rax, [rsp + 0x48]
mov rcx, qword [rbx]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret

Function at 0x14001c680
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov r8d, 0xa0251d5c
mov ecx, 0xdf7e4e19
mov edx, 0x6755220c
call fcn.140001720
mov r9d, 0x20219
xor r8d, r8d
mov rdx, rax
lea rax, [rbp - 0x28]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c741
mov byte [rbp - 0x20], al
xor eax, eax
mov edx, 0x401138ca
mov r8d, 0x87610785
mov ecx, 0xf83a54a1
mov dword [rbp - 0x30], 3
mov qword [rbp - 0x1f], rax
mov dword [rbp - 0x17], eax
mov word [rbp - 0x13], ax
mov byte [rbp - 0x11], al
mov dword [rbp - 0x2c], InitCommonControls
call fcn.140001720
mov rcx, qword [rbp - 0x28]
mov rdx, rax
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
lea r9, [rbp - 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c741
movups xmm0, xmmword [rbp - 0x20]
movdqu xmmword [rbx], xmm0
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400e79e0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x14001cc84
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp - 8], rax
xor r9d, r9d
mov rsi, r8
lea r8, [0x14016cfa0]
sub rdx, r8
mov r10d, 3
mov r11d, r9d
lea rax, [r11 + r8]
inc r11
mov cl, byte [rdx + rax]
xor cl, byte [rax]
mov byte [rbp + r11 - 0x21], cl
cmp r11, 0x18
jl 0x14001ccc2
mov ebx, 5
lea r11, [rbp - 0x28]
lea r8, [rbp - 0x1f]
lea edi, [rbx + 3]
cmp r10d, 8
jge 0x14001cd01
mov dl, byte [r8 + 1]
mov al, byte [r8]
mov cl, r10b
shr dl, cl
mov ecx, ebx
shl al, cl
jmp 0x14001cd2b
mov ecx, r10d
and ecx, 0x80000007
jge 0x14001cd13
dec ecx
or ecx, 0xfffffff8
inc ecx
mov dl, byte [r8 - 1]
mov eax, 8
sub eax, ecx
mov cl, al
mov al, byte [r8]
shl dl, cl
lea ecx, [r10 - 8]
shr al, cl
add dl, al
inc r10d
dec ebx
mov byte [r11], dl
inc r11
add r8, 3
dec rdi
jne 0x14001cce9
mov al, byte [rbp - 0x28]
mov byte [rbp - 0x2c], al
mov al, byte [rbp - 0x27]
mov byte [rbp - 0x2b], al
mov al, byte [rbp - 0x26]
mov byte [rbp - 0x2d], al
mov al, byte [rbp - 0x25]
mov byte [rbp - 0x2e], al
mov al, byte [rbp - 0x24]
mov byte [rbp - 0x2f], al
mov al, byte [rbp - 0x23]
mov byte [rbp - 0x30], al
mov al, byte [rbp - 0x22]
mov byte [rbp - 0x29], al
mov al, byte [rbp - 0x21]
mov byte [rbp - 0x2a], al
lea rax, [0x140128ed8]
mov al, byte [r9 + rax]
inc r9
xor byte [rbp + r9 - 0x31], al
cmp r9, 8
jl 0x14001cd71
mov rax, qword [rbp - 0x30]
mov qword [rsi], rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400e79e0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
Function at 0x14001d1b4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x160], rax
movsxd rdi, edx
call fcn.14001d38c
lea rdx, [rsp + 0x50]
mov ecx, 0x23
call fcn.14001be1c
mov edx, 0x9845c0cc
mov ecx, 0x206eafab
mov r8d, 0x5f35ff9e
movsxd rbx, eax
call fcn.140001720
lea rcx, [rsp + 0x50]
lea rcx, [rcx + rbx*2]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 2]
lea rcx, [rsp + 0x50]
mov edx, 0x40000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001d2da
xor eax, eax
lea ecx, [rdi - 1]
mov word [rsp + 0x40], 0x8b88
mov word [rsp + 0x45], ax
mov byte [rsp + 0x47], al
mov byte [rsp + 0x42], 0x8d
cmp ecx, 2
ja 0x14001d27f
mov al, byte [rsp + rdi + 0x3f]
jmp 0x14001d281
mov al, 1
and qword [rsp + 0x20], 0
mov edi, 4
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x44]
mov r8d, edi
mov rcx, rbx
mov byte [rsp + 0x44], al
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
and qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov r8d, edi
mov rcx, rbx
mov word [rsp + 0x41], ax
mov byte [rsp + 0x43], al
mov byte [rsp + 0x40], 0x8c
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400e79e0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x14001d38c
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x20
lea rdx, [rsp + 0x30]
lea rcx, [0x14001d300]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x14001d3dc
lea edx, [rbx + 2]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [rbx + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x30]
test rax, rax
setne al
add rsp, 0x20
pop rbx
ret
Function at 0x14001d3e8
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x50], rax
and dword [rsp + 0x24], 0
and dword [rsp + 0x34], 0
mov rdi, rdx
mov dword [rdx + 8], 6
lea rcx, [rsp + 0x38]
mov r8d, 0x10c
xor edx, edx
mov dword [rsp + 0x30], 0x114
call fcn.1400ea1b0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x34], 5
jne 0x14001d4e7
mov edx, 0x8e9c4cf4
mov ecx, 0x36b7234d
mov r8d, 0x49ec7393
mov dword [rsp + 0x20], 4
call fcn.140001720
mov rbx, 0xffffffff80000000
lea r9, [rsp + 0x20]
lea r8, [rdi + 0x10]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov edx, 0x1480334b
mov ecx, 0xacab5c9e
mov r8d, 0xd3f00c2c
mov dword [rsp + 0x20], 4
call fcn.140001720
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x24]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [rsp + 0x24]
dec ecx
je 0x14001d4e0
dec ecx
je 0x14001d4d7
cmp ecx, 2
jne 0x14001d4e7
mov dword [rdi + 0xc], 3
jmp 0x14001d4e7
mov dword [rdi + 0xc], 2
jmp 0x14001d4e7
mov dword [rdi + 0xc], 1
mov al, 1
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400e79e0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14001d50c
Capabilities:
Check os version
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x260], rax
and dword [rsp + 0x24], 0
movsxd rdi, edx
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0x10c
mov dword [rsp + 0x20], 0x114
call fcn.1400ea1b0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 5
jne 0x14001d63a
mov edx, 0x63f42b24
mov ecx, 0xdbdf4217
mov r8d, 0xa484146f
call fcn.140001720
mov edx, 0xf5a9d1b8
mov ecx, 0x4d82bf2f
mov r8d, 0x32d9eedf
mov rbx, rax
call fcn.140001720
lea r8, [rbp + 0x40]
mov rcx, 0xffffffff80000000
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14001d5c3
lea r8, [rbp + 0x40]
lea edx, [rax + 5]
mov rcx, rbx
call fcn.14001be84
lea eax, [rdi - 1]
mov ebx, 1
mov dword [rbp + 0x44], 2
mov dword [rbp + 0x40], ebx
mov dword [rbp + 0x48], 4
cmp eax, 2
ja 0x14001d5e5
mov ebx, dword [rbp + rdi*4 + 0x3c]
mov edx, 0xcd29b423
mov ecx, 0x7502dd70
mov r8d, 0xa598b68
call fcn.140001720
mov edx, 0x5850a745
mov ecx, 0xe07bce72
mov r8d, 0x9f209822
mov rdi, rax
call fcn.140001720
lea r8, [rbp + 0x40]
mov rcx, 0xffffffff80000000
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14001d67b
lea r8, [rbp + 0x40]
mov edx, ebx
mov rcx, rdi
call fcn.14001be84
jmp 0x14001d67b
lea rdx, [rbp + 0x50]
mov ecx, 0x23
call fcn.14001be1c
mov edx, 0xcd5648f9
mov ecx, 0x757d21ae
mov r8d, 0xa267793
movsxd rbx, eax
call fcn.140001720
lea rcx, [rbp + 0x50]
lea rcx, [rcx + rbx*2]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1400e79e0
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14001d6b8
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x460
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, rdx
lea rdx, [rsp + 0x240]
mov ecx, 0x1a
mov r14d, r8d
call fcn.14001be1c
xor r13d, r13d
mov edx, 0x7bd62762
mov ecx, 0xc3fd4efb
mov r8d, 0xbca6180e
movsxd rbx, eax
mov esi, r13d
mov ebp, r13d
mov word [rsp + 0x30], r13w
call fcn.140001720
lea rcx, [rsp + 0x240]
lea rcx, [rcx + rbx*2]
mov rdx, rax
mov r8d, r14d
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x4b3286f8
mov ecx, 0xf319ef3f
mov r8d, 0x8c42b9be
call fcn.140001720
lea ebx, [r13 + 1]
lea r9, [0x14001d6a0]
mov rdx, rax
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x240]
mov r8b, bl
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call fcn.14001f6c8
cmp word [rsp + 0x30], r13w
je 0x14001d804
lea rcx, [rsp + 0x30]
call fcn.14001f944
test al, al
je 0x14001d804
cmp r14d, 6
jne 0x14001d79f
mov dword [rdi + 8], 3
jmp 0x14001d7b7
cmp r14d, 5
jne 0x14001d7ae
mov dword [rdi + 8], 2
jmp 0x14001d7b7
cmp r14d, 3
jne 0x14001d7b7
mov dword [rdi + 8], ebx
lea r9, [rsp + 0x30]
lea rdx, str.BDRegionCode
lea rcx, str.General
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, 0x4f107bca
mov ecx, 0xf73b13eb
mov r8d, 0x8860448c
mov esi, eax
call fcn.140001720
lea r9, [rsp + 0x30]
lea rcx, str.General
mov rdx, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebp, eax
dec esi
je 0x14001d823
dec esi
je 0x14001d81a
cmp esi, 2
jne 0x14001d826
mov dword [rdi + 0xc], 3
jmp 0x14001d826
mov dword [rdi + 0xc], 2
jmp 0x14001d826
mov dword [rdi + 0xc], ebx
cmp ebp, 0xaf01cec2
je 0x14001d878
cmp ebp, 0xbc110012
je 0x14001d873
cmp ebp, 0xd3a535fb
je 0x14001d86a
cmp ebp, 0xdcab1f36
je 0x14001d861
cmp ebp, 0xf0cc1274
je 0x14001d858
test ebp, ebp
jne 0x14001d87f
mov dword [rdi + 0x10], r13d
jmp 0x14001d87f
mov dword [rdi + 0x10], 3
jmp 0x14001d87f
mov dword [rdi + 0x10], 4
jmp 0x14001d87f
mov dword [rdi + 0x10], 5
jmp 0x14001d87f
mov dword [rdi + 0x10], ebx
jmp 0x14001d87f
mov dword [rdi + 0x10], 2
mov al, bl
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400e79e0
mov rbx, qword [rsp + 0x490]
add rsp, 0x460
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret

Function at 0x14001dd20
Capabilities:
Encode data using xor

Disassembly:
movabs r9, 0xc717a4084aa96593
mov r14, r9
pushfq
xor r14, 0x18ba4aa1
and r9, 0x750cc92c
bswap r9
mov r9, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x18daeb06
mov r14, qword [rsp + 0x10]
jl 0x14001dd2e
jno 0x14028299a
sub al, byte [rax + 0x23ee297b]
int3
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
call fcn.140363678
jp 0x140282932
invalid
Function at 0x14001e090
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rdx
cmp r8d, 4
jne 0x14001e0cb
mov cl, r9b
call fcn.14001bd30
mov eax, 5
jmp 0x14001e1bd
cmp r8d, 5
jne 0x14001e1bb
mov dword [rbp - 0x18], 0x320030
mov dword [rbp - 0x14], 0x470050
mov dword [rbp - 0x10], 0x560031
mov dword [rbp - 0xc], 0x30
cmp r9d, 1
je 0x14001e111
cmp r9d, 2
jne 0x14001e103
lea eax, [r8 + 0x32]
jmp 0x14001e10d
cmp r9d, 3
jne 0x14001e111
lea eax, [r9 + 0x3f]
mov word [rbp - 0x10], ax
mov edx, 0xe31ce4ea
mov ecx, 0x5b378e3d
mov r8d, 0x246cdbad
call fcn.140001720
lea r8, [rbp - 0x20]
mov rcx, 0xffffffff80000000
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14001e1d9
mov edx, 0x1f2bb2cd
mov ecx, 0xa700d7fe
mov r8d, 0xd85b8d81
call fcn.140001720
mov rcx, qword [rbp - 0x20]
mov r9d, 1
mov rdx, rax
lea rax, [rbp - 0x18]
xor r8d, r8d
mov dword [rsp + 0x28], InitCommonControls
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 5
jne 0x14001e1d9
mov edx, 0x6d840a3f
mov ecx, 0xd5af6f1e
mov r8d, 0xaaf43558
call fcn.140001720
lea r9d, [rbx + 0xb]
lea r8, [0x140128df8]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400e79e0
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
mov eax, 4
jmp 0x14001e1bd

Function at 0x14001ede8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, 0x40
mov rdx, rdi
shl eax, 0x10
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
mov rcx, rdi
movsxd rbx, eax
call fcn.14001ed8c
test ebx, ebx
jle 0x14001ee2b
mov eax, 0x2b
mov word [rdi + rbx*2], ax
inc ebx
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001ee38
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov esi, r8d
mov edi, edx
mov rbx, rcx
test r8d, r8d
jne 0x14001ee6e
test edx, edx
jne 0x14001ee6e
mov word [rcx], r14w
jmp 0x14001ef30
test sil, 2
je 0x14001ee88
mov rdx, rcx
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call fcn.14001ede8
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
mov ebp, 1
test bpl, sil
je 0x14001eea4
lea ecx, [rbp + 0xf]
mov rdx, rbx
call fcn.14001ede8
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
test sil, 4
je 0x14001eebe
mov rdx, rbx
mov ecx, 0x12
call fcn.14001ede8
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
lea eax, [rdi - 0x30]
cmp eax, 9
jbe 0x14001ef21
lea eax, [rdi - 0x41]
cmp eax, 0x19
jbe 0x14001ef21
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp edi, 0x2e
ja 0x14001eeed
movabs rdx, 0x71fe00000000
bt rdx, rdi
jb 0x14001eefd
cmp edi, 0xbc
je 0x14001eefd
cmp edi, 0xbe
jne 0x14001ef01
bts eax, 8
shl eax, 0x10
mov r8d, 0x40
mov rdx, rbx
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
mov rcx, rbx
mov ebp, eax
call fcn.14001ed8c
jmp 0x14001ef29
mov word [rbx], di
mov word [rbx + 2], r14w
movsxd rcx, ebp
lea rbx, [rbx + rcx*2]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret

Function at 0x14001f490
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0xe0
mov rbx, rdx
xor edx, edx
mov sil, r8b
mov rdi, rcx
lea rcx, [rax - 0x70]
lea r8d, [rdx + 0x60]
call fcn.1400ea1b0
lea rax, [rsp + 0x50]
mov ebp, 1
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0xac], ebp
mov word [rsp + 0xb0], bp
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
cmp sil, bpl
jne 0x14001f529
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0xe0]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14001f55c
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0x10c
mov qword [rsp + 0x20], 0x114
xor ebx, ebx
call fcn.1400ea1b0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
setae bl
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400e79e0
add rsp, 0x150
pop rbx
ret
Function at 0x14001f5c4
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov r8, rcx
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
add rsp, 0x38
ret

Function at 0x14001f5ec
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
or dword [rbp + 0x7f], 0xffffffff
mov rdi, rdx
xor edx, edx
mov rsi, r8
mov rbx, rcx
lea r8d, [rdx + 0x6c]
lea rcx, [rbp - 0x25]
mov r14d, r9d
call fcn.1400ea1b0
mov eax, r14d
mov dword [rbp - 0x29], 0x70
neg eax
sbb r9d, r9d
and r9d, 0x40
mov dword [rbp - 0x25], r9d
call fcn.14001f55c
lea rdx, str.runas
test eax, eax
lea rcx, str.open
mov qword [rbp - 0x11], rbx
cmovne rcx, rdx
mov qword [rbp - 9], rdi
mov qword [rbp - 1], rsi
mov qword [rbp - 0x19], rcx
lea rcx, [rbp - 0x29]
mov dword [rbp + 7], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test r14d, r14d
je 0x14001f6ab
test eax, eax
je 0x14001f6ab
cmp qword [rbp + 0xf], 0x20
jle 0x14001f6ab
mov rcx, qword [rbp + 0x3f]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x3f]
lea rdx, [rbp + 0x7f]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0x3f]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x7f]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret