joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140053c80
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x120
bt edx, 9
mov rbx, rcx
jae 0x140053c9f
or dword [rcx + 0x18], 8
bt edx, 0xa
jae 0x140053ca9
or dword [rcx + 0x18], 1
bt edx, 8
jae 0x140053cb3
or dword [rcx + 0x18], 2
mov eax, dword [rcx + 0x18]
test al, 8
je 0x140053cc6
bt eax, 0xb
jae 0x140053cc6
xor eax, 8
mov dword [rcx + 0x18], eax
mov eax, dword [rcx + 0x18]
test al, 1
je 0x140053cd9
bt eax, 8
jae 0x140053cd9
xor eax, 1
mov dword [rcx + 0x18], eax
mov eax, dword [rcx + 0x18]
test al, 2
je 0x140053cec
bt eax, 9
jae 0x140053cec
xor eax, 2
mov dword [rcx + 0x18], eax
mov eax, dword [rcx + 0x18]
test al, 0x10
je 0x140053cff
bt eax, 0xc
jae 0x140053cff
xor eax, 0x10
mov dword [rcx + 0x18], eax
xor edi, edi
cmp qword [rcx + 0x20], rdi
je 0x140053d76
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov r11d, dword [rbx + 0x18]
mov eax, r11d
and eax, 0x800
neg eax
sbb al, al
and al, byte [rsp + 0x31]
mov byte [rsp + 0x31], al
mov eax, r11d
and eax, 0x100
neg eax
sbb al, al
and al, byte [rsp + 0x32]
bt r11d, 9
mov byte [rsp + 0x32], al
jb 0x140053d52
mov eax, dword [rbx + 0x30]
mov byte [rsp + 0x30], dil
mov byte [rsp + rax + 0x20], dil
and r11d, 0x1000
lea rcx, [rsp + 0x20]
neg r11d
sbb al, al
and al, byte [rsp + 0x7b]
mov byte [rsp + 0x7b], al
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x140053e78
mov esi, reloc.WSOCK32.dll_recvfrom
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edi, 0x8000
test di, ax
jne 0x140053d9a
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x140053dae
bt dword [rbx + 0x18], 0xb
jb 0x140053dae
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.140053570
mov esi, reloc.WSOCK32.dll_select
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
jne 0x140053dcd
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x140053de1
bt dword [rbx + 0x18], 8
jb 0x140053de1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.140053570
mov ecx, dword [rbx + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
jne 0x140053dfd
mov ecx, dword [rbx + 0x30]
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x140053e12
bt dword [rbx + 0x18], 9
jb 0x140053e12
mov edx, dword [rbx + 0x30]
xor r8d, r8d
mov rcx, rbx
call fcn.140053570
mov esi, RegisterTypeLib
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
jne 0x140053e31
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x140053e45
bt dword [rbx + 0x18], 0xa
jb 0x140053e45
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.140053570
mov esi, 0x5b
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
jne 0x140053e64
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x140053e78
bt dword [rbx + 0x18], 0xc
jb 0x140053e78
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.140053570
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140053e90
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
xor edx, edx
mov edi, r8d
mov rbx, rcx
call fcn.140053c80
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call fcn.140053a40
test edi, edi
je 0x140053ecf
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1400537d0
sub edi, 1
jne 0x140053ebd
mov edx, dword [rbx + 0x18]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140053810

Function at 0x140053ef0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov ecx, edx
mov bl, r8b
mov esi, edx
call qword [sym.imp.USER32.dll_GetKeyState]
movzx edi, ax
and dil, 1
cmp bl, dil
je 0x140053f67
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
xor r8d, r8d
mov dl, al
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rbp
call fcn.140045020
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, sil
lea r8d, [r9 + 2]
mov dl, al
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rbp
call fcn.140045040
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov al, dil
add rsp, 0x20
pop rdi
ret

Function at 0x140053fb0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rcx, qword [r8]
mov rdi, rdx
mov rsi, r8
mov r12d, dword [rcx + rdx]
lea rax, [rcx + 4]
mov qword [r8], rax
lea eax, [r12 + 1]
movsxd rcx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140018cc8
lea ecx, [r12 + r12]
movsxd rbx, ecx
mov rcx, qword [rsi]
mov rbp, rax
lea rdx, [rdi + rcx]
mov r8, rbx
mov rcx, rax
call fcn.140019640
add qword [rsi], rbx
xor eax, eax
cmp r12d, eax
movsxd r11, r12d
mov word [rbp + r11*2], ax
jle 0x140054043
mov rax, rbp
mov rcx, r12
xor word [rax], r12w
add rax, 2
sub rcx, 1
jne 0x140054035
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r12
ret
Function at 0x140054d60
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
cmp r8b, 1
jne 0x140054d93
call fcn.140046470
test al, al
jne 0x140054db3
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, 1
jmp 0x140054da9
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
add rsp, 0x20
pop rbx
ret

Function at 0x140055150
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdx, qword [rcx]
mov r8b, 1
mov rdi, rcx
call fcn.140054d60
xor edx, edx
test ebx, ebx
lea ebx, [rdx + 0x25]
mov ecx, ebx
jns 0x1400551ad
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi]
mov r8, rbx
shl eax, 0x10
mov edx, 0x100
mov r9d, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8, rbx
jmp 0x1400551e9
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi]
mov edx, 0x100
shl eax, 0x10
mov r8d, reloc.OLEAUT32.dll_SafeArrayRedim
mov r9d, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, reloc.OLEAUT32.dll_SafeArrayRedim
mov rcx, qword [rdi]
shl eax, 0x10
mov edx, 0x101
mov r9d, eax
mov eax, 0xc0000001
or r9, rax
call qword [sym.imp.USER32.dll_PostMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rdi]
xor r8d, r8d
mov rcx, rdi
call fcn.140054d60
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400573e0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
sub rsp, 0x30
lea rcx, [0x1400c1e50]
mov r12d, r9d
mov rbp, r8
mov rsi, rdx
call fcn.140040460
movsxd rcx, eax
mov rax, qword [0x1400c1ef0]
mov rcx, qword [rax + rcx*8]
mov rbx, qword [rcx]
cmp rbp, rsi
jne 0x140057464
cmp qword [rbx + 0x2a8], 0
je 0x1400574d6
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
and qword [rsp + 0x28], 0
mov rcx, qword [rbx + 0x2a8]
mov qword [rsp + 0x20], rsi
mov r8d, dword [rsp + 0x50]
mov r9d, dword [rsp + 0x54]
xor edx, edx
call qword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x1400574f8
lea rcx, [0x1400c1e50]
mov rdx, rbp
call fcn.1400508a0
cmp eax, 0xffffffff
je 0x1400574d6
movsxd rdi, eax
mov rax, qword [0x1400c1f18]
mov rcx, qword [rax + rdi*8]
mov rdx, qword [rcx]
mov al, byte [rdx + 0xf4]
cmp al, 0xe
je 0x1400574d6
cmp al, 0xf
je 0x1400574d6
cmp al, 0x13
je 0x1400574d6
cmp al, 0x10
je 0x1400574d6
cmp qword [rdx + 0x10], 0
je 0x1400574d6
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r11, qword [0x1400c1f18]
and qword [rsp + 0x28], 0
mov rax, qword [r11 + rdi*8]
mov rcx, qword [rax]
mov rax, qword [rbx]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rax
jmp 0x14005744d
movzx r9d, word [rsp + 0x70]
movzx eax, r12w
mov r8, rbp
shl r9d, 0x10
mov edx, 0x7b
mov rcx, rsi
or r9, rax
call qword [sym.imp.USER32.dll_DefDlgProcW]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x14005b0e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x100
lea rcx, [rsp + 0x20]
mov ebx, r9d
mov esi, r8d
mov rdi, rdx
call fcn.140051750
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.140051680
test esi, esi
je 0x14005b135
mov rbx, rsi
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0xff
call fcn.140051710
xor byte [rdi], al
inc rdi
sub rbx, 1
jne 0x14005b118
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14005b450
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
sub dword [reloc.WSOCK32.dll_accept], 1
jne 0x14005b462
call fcn.140051920
mov rax, qword [0x1400c1450]
pxor xmm0, xmm0
mov ecx, dword [rax]
add rax, 4
mov qword [0x1400c1450], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x1400a2c60]
add rsp, 0x28
ret

Function at 0x14005b4c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
sub dword [reloc.WSOCK32.dll_accept], 1
jne 0x14005b4d2
call fcn.140051920
mov rax, qword [0x1400c1450]
mov ecx, dword [rax]
add rax, 4
mov qword [0x1400c1450], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
add rsp, 0x28
ret

Function at 0x14005c120
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov bl, dl
lea rdx, [rsp + 0x60]
call fcn.140017250
lea rcx, [rsp + 0x60]
call fcn.1400437b0
xor edi, edi
cmp al, dil
jne 0x14005c14e
xor al, al
jmp 0x14005c1b3
lea rcx, [rsp + 0x60]
cmp bl, dil
jne 0x14005c165
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, edi
setne al
jmp 0x14005c1b3
call fcn.140019b5c
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rdi
mov word [rsp + rax*2 + 0x62], di
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x30], rax
mov eax, 0x614
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp eax, edi
sete al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x14005c1d0
Capabilities:
Copy file
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x480
mov rbx, rdx
lea rdx, [rsp + 0x270]
mov dil, r8b
call fcn.140017250
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140017250
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ebx, ebx
cmp eax, ebx
jne 0x14005c252
cmp dil, bl
je 0x14005c24b
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x270]
call fcn.140019cfc
cmp eax, ebx
je 0x14005c244
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov al, 1
jmp 0x14005c2fe
xor al, al
jmp 0x14005c2fe
lea rcx, [rsp + 0x270]
call fcn.1400437b0
cmp al, bl
je 0x14005c24b
lea rcx, [rsp + 0x60]
call fcn.1400437b0
cmp al, bl
je 0x14005c30f
cmp dil, bl
je 0x14005c24b
lea rdx, [0x14009cf50]
lea rcx, [rsp + 0x270]
call fcn.140019124
lea rcx, [rsp + 0x270]
call fcn.140019b5c
lea rcx, [rsp + 0x60]
mov word [rsp + rax*2 + 0x272], bx
call fcn.140019b5c
lea rcx, [rsp + 0x20]
mov word [rsp + rax*2 + 0x62], bx
lea rax, [rsp + 0x270]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x38], rax
mov eax, 0x614
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 2
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp eax, ebx
sete al
mov rbx, qword [rsp + 0x490]
add rsp, 0x480
pop rdi
ret
lea rcx, [rsp + 0x60]
call fcn.140043310
cmp al, bl
je 0x14005c24b
lea rcx, [rsp + 0x60]
call fcn.1400437b0
cmp al, bl
jmp 0x14005c278
Function at 0x14005c340
Capabilities:
Copy file
Delete file
Enumerate files on windows
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
mov eax, 0x1100
call fcn.140031e20
sub rsp, rax
mov rbx, rdx
lea rdx, [rsp + 0x460]
xor edi, edi
mov r12b, r9b
mov r13b, r8b
mov sil, dil
call fcn.140017250
lea rdx, [rsp + 0x670]
mov rcx, rbx
call fcn.140017250
lea rdx, [rsp + 0x670]
lea rcx, [rsp + 0x460]
call fcn.140043700
lea rcx, [rsp + 0x460]
mov r14b, al
call fcn.1400437b0
cmp al, dil
je 0x14005c3cf
lea rdx, [0x14009cf50]
lea rcx, [rsp + 0x460]
call fcn.140019124
lea rcx, [rsp + 0x670]
call fcn.1400437b0
cmp al, dil
je 0x14005c3f5
lea rdx, [0x14009cf50]
lea rcx, [rsp + 0x670]
call fcn.140019124
lea rax, [rsp + 0xef0]
lea r9, [rsp + 0xad0]
lea r8, [rsp + 0xce0]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x460]
mov qword [rsp + 0x20], rax
call fcn.14001a7ac
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x460]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov bpl, 1
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14005c598
cmp bpl, 1
jne 0x14005c598
test byte [rsp + 0x880], 0x10
jne 0x14005c56a
lea rax, [rsp + 0x250]
lea r9, [rsp + 0x670]
lea r8, [rsp + 0xef0]
lea rdx, [rsp + 0xad0]
lea rcx, [rsp + 0x8ac]
mov qword [rsp + 0x20], rax
call fcn.140043530
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140019150
lea rdx, [rsp + 0xce0]
lea rcx, [rsp + 0x40]
call fcn.140019124
lea rdx, [rsp + 0x8ac]
lea rcx, [rsp + 0x40]
call fcn.140019124
lea rcx, [rsp + 0x250]
call fcn.140043820
cmp al, dil
je 0x14005c507
cmp r13b, dil
je 0x14005c58b
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, edi
je 0x14005c527
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x40]
cmp r12b, 1
jne 0x14005c55a
cmp r14b, dil
jne 0x14005c540
call qword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x14005c563
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, edi
je 0x14005c59b
jmp 0x14005c567
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, edi
je 0x14005c58b
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14005c563
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, edi
je 0x14005c58b
mov sil, 1
lea rdx, [rsp + 0x880]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, edi
jne 0x14005c44a
mov bpl, dil
jmp 0x14005c44a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x14005c5a7
mov dil, sil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, dil
lea r11, [rsp + 0x1100]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x14005c5d0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xac0
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov bpl, bl
call fcn.140017250
lea rcx, [rsp + 0x30]
call fcn.1400437b0
cmp al, bl
je 0x14005c615
lea rdx, [0x14009cf50]
lea rcx, [rsp + 0x30]
call fcn.140019124
lea rax, [rsp + 0x8b0]
lea r9, [rsp + 0x6a0]
lea r8, [rsp + 0x490]
lea rdx, [rsp + 0xad8]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.14001a7ac
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dil, 1
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14005c6d6
cmp dil, 1
jne 0x14005c6d6
test byte [rsp + 0x240], 0x10
jne 0x14005c6bc
lea rdx, [rsp + 0xad8]
lea rcx, [rsp + 0x30]
mov bpl, dil
call fcn.140019150
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x30]
call fcn.140019124
lea rdx, [rsp + 0x26c]
lea rcx, [rsp + 0x30]
call fcn.140019124
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x14005c6d9
lea rdx, [rsp + 0x240]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, ebx
jne 0x14005c663
mov dil, bl
jmp 0x14005c663
mov bl, bpl
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0xac0]
mov al, bl
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14005d2c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov cl, dl
mov esi, r8d
mov bpl, dl
call qword [sym.imp.USER32.dll_VkKeyScanA]
mov rcx, rbx
movsx edi, ax
cmp edi, 0xffffffff
jne 0x14005d2fa
mov dl, bpl
call fcn.14005d1f0
jmp 0x14005d331
mov edx, edi
call fcn.140053c80
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call fcn.140053a40
test esi, esi
je 0x14005d326
movzx edi, dil
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call fcn.1400537d0
sub esi, 1
jne 0x14005d314
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call fcn.140053810
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14005d7b0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x220
mov rbx, rcx
mov rcx, qword [rcx + 0x88]
mov edx, 0x3e9
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edi, edi
cmp rax, rdi
je 0x14005d845
lea rdx, [rsp + 0x20]
mov r8d, 0x100
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
test byte [rbx + 0x10], 1
je 0x14005d804
cmp word [rsp + 0x20], di
jne 0x14005d804
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
jmp 0x14005d845
movsd xmm0, qword [rbx + 0x18]
comisd xmm0, xmmword [0x1400a2c98]
jbe 0x14005d825
mov rcx, qword [rbx + 0x88]
mov edx, 0x40a
call qword [sym.imp.USER32.dll_KillTimer]
lea rcx, [rbx + 0x48]
lea rdx, [rsp + 0x20]
call fcn.1400089b0
mov rcx, qword [rbx + 0x88]
mov edx, 1
call qword [sym.imp.USER32.dll_EndDialog]
mov rbx, qword [rsp + 0x230]
add rsp, 0x220
pop rdi
ret
Function at 0x14005eb00
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx]
mov r12, rdx
lea r9, [rax + 0x18]
lea r8, [rax + 0x20]
mov edx, 0xb0
call qword [sym.imp.USER32.dll_SendMessageW]
mov r11d, dword [rsp + 0x50]
cmp dword [rsp + 0x58], r11d
jne 0x14005eb3f
xor al, al
jmp 0x14005ebbe
mov rcx, qword [rbp]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
mov rsi, rax
cmp eax, ebx
je 0x14005eb3b
lea ecx, [rax + 0x101]
lea eax, [rbx + 2]
mul rcx
lea rcx, [rbx - 1]
cmovo rax, rcx
mov rcx, rax
call fcn.140018cc8
mov rcx, qword [rbp]
lea r8d, [rsi + 1]
lea edx, [rbx + 0xd]
mov r9, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, rbx
je 0x14005ebb4
cmp dword [rsp + 0x50], esi
je 0x14005eba2
mov eax, dword [rsp + 0x50]
mov word [rdi + rax*2], bx
mov eax, dword [rsp + 0x58]
mov rcx, r12
lea rdx, [rdi + rax*2]
call fcn.1400089b0
mov bl, 1
mov rcx, rdi
call fcn.140018ec8
mov al, bl
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x140061e50
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x2e0
mov rbx, rcx
xor r12d, r12d
lea rcx, [rsp + 0x58]
mov rsi, r9
mov rbp, r8
mov rdi, rdx
mov qword [rsp + 0x30], r12
mov qword [rax + 0x20], r12
call fcn.1400083e0
lea rcx, [rsp + 0x38]
call fcn.1400083e0
lea rcx, [rsp + 0x78]
call fcn.1400083e0
lea rdx, str.SOFTWAREClasses_
lea rcx, [rsp + 0x58]
call fcn.1400089b0
lea rcx, [rsp + 0x58]
mov rdx, rbx
call fcn.140012750
lea rdx, str.CLSID
lea rcx, [rsp + 0x58]
call fcn.140012750
lea rdx, [0x14009a680]
lea rcx, [rsp + 0x38]
call fcn.1400089b0
cmp rdi, r12
je 0x140061f0c
cmp word [rdi], 0x5c
je 0x140061f0c
cmp word [rdi + 2], 0x5c
je 0x140061f0c
lea rdx, [0x1400a0c70]
lea rcx, [rsp + 0x38]
call fcn.1400089b0
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.140012750
cmp rsi, r12
je 0x140061f7f
xor edx, edx
lea rcx, [rsp + 0x98]
lea r8d, [rdx + 0x30]
call fcn.140019a70
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x9c], r12d
call fcn.140001110
lea rdx, str.IPC_
lea rcx, [rsp + 0x78]
call fcn.140012750
mov r11, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x320]
lea rcx, [rsp + 0x98]
xor r9d, r9d
mov r8, rsi
mov qword [rsp + 0xb0], r11
call sub.MPR.dll_WNetAddConnection2W
mov edi, eax
cmp eax, r12d
jne 0x14006206c
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
mov rdx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov edi, eax
cmp eax, r12d
jne 0x14006206c
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x318]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, r12d
jne 0x140062061
mov rcx, qword [rsp + 0x318]
lea rax, [rsp + 0x308]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x308], 0x1fe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r12d
jne 0x140062053
mov eax, dword [rsp + 0x308]
lea rcx, [rsp + 0xd0]
shr eax, 1
mov dword [rsp + 0x308], eax
mov word [rsp + rax*2 + 0xd0], r12w
call fcn.1400172a0
mov rdx, rbp
mov rcx, rax
mov rbx, rax
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov rcx, rbx
mov edi, eax
call fcn.140018ec8
mov rcx, qword [rsp + 0x318]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x78]
call fcn.140003410
lea rcx, [rsp + 0x38]
call fcn.140003410
lea rcx, [rsp + 0x58]
call fcn.140003410
lea r11, [rsp + 0x2e0]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret