joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001b80
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x88
mov eax, dword [0x180011948]
xorps xmm5, xmm5
movaps xmmword [rsp + 0x70], xmm6
xorps xmm3, xmm3
movss xmm6, dword [0x18000e9a4]
xorps xmm2, xmm2
movaps xmmword [rsp + 0x60], xmm7
movss xmm7, dword [rcx]
ucomiss xmm7, xmm5
movaps xmmword [rsp + 0x50], xmm8
movss xmm8, dword [0x18000e9c4]
movaps xmmword [rsp + 0x40], xmm9
movss xmm9, dword [0x18000e99c]
movaps xmmword [rsp + 0x30], xmm10
movss xmm10, dword [0x18000e9a0]
jp 0x180001be4
je 0x180001c79
movd xmm4, dword [0x18001195c]
cvtdq2ps xmm4, xmm4
comiss xmm7, xmm4
jbe 0x180001c40
xorps xmm0, xmm0
movaps xmm3, xmm4
subss xmm3, xmm7
movaps xmm1, xmm4
cvtsi2ss xmm0, eax
addss xmm3, xmm10
xorps xmm3, xmmword [0x18000ea30]
divss xmm3, xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, dword [0x180011954]
addss xmm1, xmm3
addss xmm1, xmm6
comiss xmm1, xmm0
jbe 0x180001c32
xorps xmm3, xmm3
jmp 0x180001c40
comiss xmm6, xmm3
jbe 0x180001c40
comiss xmm3, xmm9
jbe 0x180001c40
movaps xmm3, xmm6
comiss xmm4, xmm7
jbe 0x180001c79
movaps xmm3, xmm7
movd xmm0, eax
subss xmm3, xmm4
cvtdq2ps xmm0, xmm0
addss xmm3, xmm10
divss xmm3, xmm0
addss xmm4, xmm3
subss xmm4, xmm6
comiss xmm5, xmm4
ja 0x180001c75
comiss xmm3, xmm8
jbe 0x180001c79
comiss xmm9, xmm3
jbe 0x180001c79
movaps xmm3, xmm8
movss xmm7, dword [rcx + 4]
ucomiss xmm7, xmm5
jp 0x180001c89
je 0x180001d1e
movd xmm4, dword [0x180011960]
cvtdq2ps xmm4, xmm4
comiss xmm7, xmm4
jbe 0x180001ce5
xorps xmm0, xmm0
movaps xmm2, xmm4
subss xmm2, xmm7
movaps xmm1, xmm4
cvtsi2ss xmm0, eax
addss xmm2, xmm10
xorps xmm2, xmmword [0x18000ea30]
divss xmm2, xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, dword [0x180011958]
addss xmm1, xmm2
addss xmm1, xmm6
comiss xmm1, xmm0
jbe 0x180001cd7
xorps xmm2, xmm2
jmp 0x180001ce5
comiss xmm6, xmm2
jbe 0x180001ce5
comiss xmm2, xmm9
jbe 0x180001ce5
movaps xmm2, xmm6
comiss xmm4, xmm7
jbe 0x180001d1e
movaps xmm2, xmm7
movd xmm0, eax
subss xmm2, xmm4
cvtdq2ps xmm0, xmm0
addss xmm2, xmm10
divss xmm2, xmm0
addss xmm4, xmm2
subss xmm4, xmm6
comiss xmm5, xmm4
ja 0x180001d1a
comiss xmm2, xmm8
jbe 0x180001d1e
comiss xmm9, xmm2
jbe 0x180001d1e
movaps xmm2, xmm8
movzx eax, byte [0x1800119c8]
lea rdx, [0x180011c50]
mov rcx, qword [0x1800110a8]
xor r9d, r9d
mov byte [0x180011c51], al
cvttss2si eax, xmm3
mov byte [0x180011c50], 0
lea r8d, [r9 + 0x17]
mov byte [0x180011c54], 0
mov byte [0x180011c52], al
cvttss2si eax, xmm2
mov byte [0x180011c53], al
lea rax, [0x180011138]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_WriteFile]
movaps xmm6, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm10, xmmword [rsp + 0x30]
add rsp, 0x88
ret
Function at 0x180001da0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x13d0
call fcn.18000d5e0
sub rsp, rax
mov rax, qword [0x180011010]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov r8d, eax
mov dword [rsp + 0x13b4], 0xffffffff
mov dword [rsp + 0x34], eax
mov ecx, 1
nop dword [rax]
nop dword [rax + rax]
mov eax, r8d
shr eax, 0x1e
xor eax, r8d
imul r8d, eax, 0x6c078965
add r8d, ecx
mov dword [rsp + rcx*4 + 0x34], r8d
inc rcx
cmp rcx, 0x270
jb 0x180001e00
mov dword [rsp + 0x30], 0x270
mov qword [rbx], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], recv
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
test edi, edi
jle 0x180001ec2
lea rcx, [rsp + 0x30]
call fcn.180008c10
mov ecx, eax
mov eax, 0x4ec4ec4f
mul ecx
shr edx, 3
cmp edx, 0x9d89d89
jae 0x180001e52
mov eax, 0x4ec4ec4f
mul ecx
shr edx, 3
imul eax, edx, 0x1a
sub ecx, eax
lea edx, [rcx - 0x7fffffbf]
mov rcx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
cmp rcx, r8
jae 0x180001eb0
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp r8, 0x10
jb 0x180001ea6
mov rax, qword [rbx]
mov byte [rax + rcx], dl
mov byte [rax + rcx + 1], 0
jmp 0x180001ebc
movzx r9d, dl
mov rcx, rbx
call fcn.180008a60
sub rdi, 1
jne 0x180001e52
mov rax, rbx
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.18000c430
mov rbx, qword [rsp + 0x13e8]
add rsp, 0x13d0
pop rdi
ret

Function at 0x180001fb0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov eax, dword [0x18001194c]
cmp eax, 0x14
jne 0x180001fdd
lea ecx, [rax - 0xb]
call fcn.180001ef0
mov dword [0x18001194c], 0x28
mov byte [0x1800119d4], 0x9a
jmp 0x1800020cc
cmp eax, 0x28
jne 0x180002000
lea ecx, [rax - 0x1f]
call fcn.180001ef0
mov dword [0x18001194c], 0x3c
mov byte [0x1800119d4], 0x9b
jmp 0x1800020cc
cmp eax, 0x3c
jne 0x180002023
lea ecx, [rax - 0x33]
call fcn.180001ef0
mov dword [0x18001194c], 0x50
mov byte [0x1800119d4], 0x9c
jmp 0x1800020cc
cmp eax, 0x50
jne 0x180002046
lea ecx, [rax - 0x47]
call fcn.180001ef0
mov dword [0x18001194c], 0x64
mov byte [0x1800119d4], 0x9d
jmp 0x1800020cc
cmp eax, 0x64
jne 0x180002066
lea ecx, [rax - 0x5b]
call fcn.180001ef0
mov dword [0x18001194c], 0x78
mov byte [0x1800119d4], 0x9e
jmp 0x1800020cc
cmp eax, 0x78
jne 0x180002086
lea ecx, [rax - 0x6f]
call fcn.180001ef0
mov dword [0x18001194c], 0x8c
mov byte [0x1800119d4], 0x9f
jmp 0x1800020cc
cmp eax, 0x8c
jne 0x1800020aa
mov ecx, 9
call fcn.180001ef0
mov dword [0x18001194c], 0xb4
mov byte [0x1800119d4], 0xa1
jmp 0x1800020cc
cmp eax, 0xb4
jne 0x18000210e
mov ecx, 9
call fcn.180001ef0
mov dword [0x18001194c], 0xc8
mov byte [0x1800119d4], 0xa2
mov rcx, qword [0x1800110a8]
lea rax, [0x180011138]
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea rdx, [0x1800119d0]
mov dword [0x1800119d0], 0x101ff00
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [0x18001194c]
add rsp, 0x38
ret
Function at 0x180002120
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov eax, dword [0x18001194c]
cmp eax, 0xc8
jne 0x180002151
mov ecx, 9
call fcn.180001ef0
mov dword [0x18001194c], 0xb4
mov byte [0x1800119d4], 0xa1
jmp 0x18000223d
cmp eax, 0xb4
jne 0x180002178
mov ecx, 9
call fcn.180001ef0
mov dword [0x18001194c], 0x8c
mov byte [0x1800119d4], 0x9f
jmp 0x18000223d
cmp eax, 0x8c
jne 0x18000219f
mov ecx, 9
call fcn.180001ef0
mov dword [0x18001194c], 0x78
mov byte [0x1800119d4], 0x9e
jmp 0x18000223d
cmp eax, 0x78
jne 0x1800021bf
lea ecx, [rax - 0x6f]
call fcn.180001ef0
mov dword [0x18001194c], 0x64
mov byte [0x1800119d4], 0x9d
jmp 0x18000223d
cmp eax, 0x64
jne 0x1800021df
lea ecx, [rax - 0x5b]
call fcn.180001ef0
mov dword [0x18001194c], 0x50
mov byte [0x1800119d4], 0x9c
jmp 0x18000223d
cmp eax, 0x50
jne 0x1800021ff
lea ecx, [rax - 0x47]
call fcn.180001ef0
mov dword [0x18001194c], 0x3c
mov byte [0x1800119d4], 0x9b
jmp 0x18000223d
cmp eax, 0x3c
jne 0x18000221f
lea ecx, [rax - 0x33]
call fcn.180001ef0
mov dword [0x18001194c], 0x28
mov byte [0x1800119d4], 0x9a
jmp 0x18000223d
cmp eax, 0x28
jne 0x18000227f
lea ecx, [rax - 0x1f]
call fcn.180001ef0
mov dword [0x18001194c], 0x14
mov byte [0x1800119d4], 0x99
mov rcx, qword [0x1800110a8]
lea rax, [0x180011138]
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea rdx, [0x1800119d0]
mov dword [0x1800119d0], 0x101ff00
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [0x18001194c]
add rsp, 0x38
ret
Function at 0x180006e60
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x470
mov rax, qword [0x180011010]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea edx, [r12 + 1]
lea rcx, str.MyAgent
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r15, rax
test rax, rax
je 0x180006ef8
cmp qword [rbx + 0x18], 0x10
jb 0x180006ec8
mov rbx, qword [rbx]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbp, rax
test rax, rax
jne 0x180006f22
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov qword [rdi], r12
mov qword [rdi + 0x10], r12
mov ebx, recv
mov qword [rdi + 0x18], rbx
mov byte [rdi], r12b
xor r8d, r8d
lea rdx, [0x18000e608]
mov rcx, rdi
call fcn.180008770
jmp 0x180007011
mov qword [rsp + 0x38], r12
mov r14, r12
mov qword [rsp + 0x48], r12
mov ebx, recv
mov qword [rsp + 0x50], rbx
mov byte [rsp + 0x38], r12b
lea r9, [rsp + 0x30]
mov r8d, 0x400
lea rdx, [rsp + 0x60]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x180006fee
nop
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x180006fee
mov esi, eax
mov rax, rbx
sub rax, r14
cmp rsi, rax
ja 0x180006fab
lea rax, [r14 + rsi]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
cmp rbx, 0x10
cmovae rax, qword [rsp + 0x38]
lea rbx, [rax + r14]
mov r8d, esi
lea rdx, [rsp + 0x60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
jmp 0x180006fc2
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x60]
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1800088d0
lea r9, [rsp + 0x30]
mov r8d, 0x400
lea rdx, [rsp + 0x60]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x180006fee
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x48]
jmp 0x180006f60
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdi + 0x10], xmm1
mov rax, rdi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18000c430
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180007560
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x180011010]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r12d, r12d
mov qword [rbp + 7], r12
mov qword [rbp + 0x17], r12
mov qword [rbp + 0x1f], recv
mov byte [rbp + 7], r12b
lea r8d, [r12 + 0x22]
lea rdx, str.http:__116.62.114.30:8080_
lea rcx, [rbp + 7]
call fcn.180008770
nop
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.180006e60
nop
mov qword [rbp - 0x19], r12
mov qword [rbp - 9], r12
mov qword [rbp - 1], recv
xor r8d, r8d
lea rdx, [0x18000e608]
lea rcx, [rbp - 0x19]
call fcn.180008770
lea rdx, [rbp - 0x39]
mov rbx, qword [rbp - 0x39]
mov rsi, qword [rbp - 0x21]
cmp rsi, 0x10
cmovae rdx, rbx
lea rcx, [rbp - 0x19]
mov rdi, qword [rbp - 0x19]
mov r13, qword [rbp - 1]
cmp r13, 0x10
cmovae rcx, rdi
mov r14, qword [rbp - 9]
mov r8, r14
mov r15, qword [rbp - 0x29]
cmp r15, r14
cmovb r8, r15
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180007645
cmp r14, r15
jae 0x18000763f
lea eax, [r12 - 1]
jmp 0x180007645
mov eax, r12d
seta al
lea rdx, [rbp - 0x39]
cmp rsi, 0x10
cmovae rdx, rbx
test eax, eax
jne 0x180007750
cmp r13, 0x10
jb 0x18000769b
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x18000768b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000768b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.18000c450
mov rsi, qword [rbp - 0x21]
mov rbx, qword [rbp - 0x39]
cmp rsi, 0x10
jb 0x1800076d5
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800076cd
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800076cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.18000c450
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], recv
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x180007723
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000771e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000771e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000c450
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.18000c430
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x18000e794]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1800084b0
Capabilities:
Delete file
Set file attributes
Terminate process
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x180008660
mov edx, 0x4037
mov qword [0x180011998], rcx
mov r8d, 0x5635
call fcn.18000c060
cmp eax, 1
je 0x180008510
mov dword [0x1800119b8], eax
cmp eax, 0xffffffff
jne 0x180008608
lea r9d, [rax + 0x11]
xor ecx, ecx
lea r8, [0x18000e700]
lea rdx, [0x18000e710]
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.C:_Windows_D3DREF9.dll
mov qword [rsp + 0x40], rdi
mov dword [0x1800119b8], 1
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:_Windows_d3dref9.dll
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:_Windows_System_D3DREF9.dll
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:_Windows_System_d3dref9.dll
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [0x1800110a8]
lea rdi, [0x180011138]
xor r9d, r9d
mov dword [0x1800119d0], 0x101ff00
lea rdx, [0x1800119d0]
mov byte [0x1800119d4], 0x7b
mov qword [rsp + 0x20], rdi
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov rcx, qword [0x1800110a8]
lea rdx, [0x1800119d0]
xor r9d, r9d
mov dword [0x1800119d0], 0x101ff00
mov byte [0x1800119d4], 0x7c
mov qword [rsp + 0x20], rdi
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov rcx, qword [0x1800110a8]
lea rdx, [0x1800119d0]
xor r9d, r9d
mov dword [0x1800119d0], 0x101ff00
mov byte [0x1800119d4], 0x7d
mov qword [rsp + 0x20], rdi
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rdi, qword [rsp + 0x40]
call fcn.180007770
call fcn.180007560
mov edx, 0x80
lea rcx, str.C:_Windows_System32_d3dref9.dll
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea rcx, str.C:_Windows_D3DREF9.dll
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:_Windows_d3dref9.dll
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:_Windows_System_D3DREF9.dll
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:_Windows_System_d3dref9.dll
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, rbx
call fcn.180006c60
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x180008c10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x180008c71
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x180008c30
mov ecx, dword [r10]
jmp 0x180008d5a
cmp ecx, 0x4e0
jb 0x180008d5a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x180008c90
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x180008ce0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x18000b240
Capabilities:
Check for unmoving mouse cursor
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov edi, ecx
mov ebx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov esi, 5
lea r14, [0x180011138]
lea ebp, [rsi - 0xa]
mov rax, qword [rsp + 0x60]
mov r8d, dword [rsp + 0x64]
cmp eax, edi
jne 0x18000b287
cmp r8d, ebx
je 0x18000b31a
mov edx, edi
sub edx, eax
test edx, edx
jle 0x18000b296
cmp edx, esi
cmovg edx, esi
jmp 0x18000b29d
jns 0x18000b29d
cmp edx, ebp
cmovl edx, ebp
mov eax, ebx
sub eax, r8d
cmp eax, 1
jle 0x18000b2ae
cmp eax, esi
cmovg eax, esi
jmp 0x18000b2b8
cmp eax, 0xffffffff
jge 0x18000b2b8
cmp eax, ebp
cmovl eax, ebp
movzx ecx, byte [0x1800119c8]
xor r9d, r9d
mov byte [0x180011c51], cl
mov rcx, qword [0x1800110a8]
mov byte [0x180011c52], dl
lea rdx, [0x180011c50]
lea r8d, [r9 + 0x17]
mov byte [0x180011c50], 0
mov byte [0x180011c53], al
mov byte [0x180011c54], 0
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.DLL_Sleep]
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x18000b270
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x18000b330
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
movzx eax, byte [0x1800119c8]
xor r9d, r9d
mov byte [0x180011c51], al
lea rax, [0x180011138]
mov byte [0x180011c52], cl
mov rcx, qword [0x1800110a8]
mov byte [0x180011c53], dl
lea r8d, [r9 + 0x17]
lea rdx, [0x180011c50]
mov byte [0x180011c50], 0
mov byte [0x180011c54], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, 1
add rsp, 0x38
ret

Function at 0x18000b390
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
movzx eax, byte [0x1800119c8]
lea rdx, [0x180011c00]
mov rcx, qword [0x1800110a8]
or al, 1
xor r9d, r9d
mov byte [0x1800119c8], al
mov byte [0x180011c01], al
lea rax, [0x180011138]
mov qword [rsp + 0x20], rax
mov byte [0x180011c00], 0
lea r8d, [r9 + 0x17]
mov word [0x180011c02], 0
mov byte [0x180011c04], 0
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, 1
add rsp, 0x38
ret

Function at 0x18000b400
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
movzx eax, byte [0x1800119c8]
lea rdx, [0x180011bb0]
mov rcx, qword [0x1800110a8]
and al, 0xfe
xor r9d, r9d
mov byte [0x1800119c8], al
mov byte [0x180011bb1], al
lea rax, [0x180011138]
mov qword [rsp + 0x20], rax
mov byte [0x180011bb0], 0
lea r8d, [r9 + 0x17]
mov word [0x180011bb2], 0
mov byte [0x180011bb4], 0
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, 1
add rsp, 0x38
ret

Function at 0x18000b470
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
movzx eax, byte [0x1800119c8]
lea rdx, [0x180011b60]
mov rcx, qword [0x1800110a8]
or al, 2
xor r9d, r9d
mov byte [0x1800119c8], al
mov byte [0x180011b61], al
lea rax, [0x180011138]
mov qword [rsp + 0x20], rax
mov byte [0x180011b60], 0
lea r8d, [r9 + 0x17]
mov word [0x180011b62], 0
mov byte [0x180011b64], 0
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, 1
add rsp, 0x38
ret
Function at 0x18000b4e0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
movzx eax, byte [0x1800119c8]
lea rdx, [0x180011b10]
mov rcx, qword [0x1800110a8]
and al, 0xfd
xor r9d, r9d
mov byte [0x1800119c8], al
mov byte [0x180011b11], al
lea rax, [0x180011138]
mov qword [rsp + 0x20], rax
mov byte [0x180011b10], 0
lea r8d, [r9 + 0x17]
mov word [0x180011b12], 0
mov byte [0x180011b14], 0
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, 1
add rsp, 0x38
ret

Function at 0x18000b550
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
movzx ecx, cl
mov dword [0x180011ac0], 0x1ff00
call fcn.18000b7b0
mov rcx, qword [0x1800110a8]
lea rbx, [0x180011138]
xor r9d, r9d
mov byte [0x180011ac4], al
lea rdx, [0x180011ac0]
mov qword [rsp + 0x20], rbx
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov rcx, qword [0x1800110a8]
lea rdx, [0x180011ac0]
xor r9d, r9d
mov dword [0x180011ac0], 0x1ff00
mov byte [0x180011ac4], 0
mov qword [rsp + 0x20], rbx
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x18000b5e0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
xor r9d, r9d
mov byte [0x1800119d4], cl
mov rcx, qword [0x1800110a8]
lea rax, [0x180011138]
lea rdx, [0x1800119d0]
mov dword [0x1800119d0], 0x101ff00
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, 1
add rsp, 0x38
ret

Function at 0x18000b630
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
movzx ecx, cl
mov dword [0x180011a70], 0x1ff00
call fcn.18000b7b0
mov rcx, qword [0x1800110a8]
lea rdx, [0x180011a70]
xor r9d, r9d
mov byte [0x180011a74], al
lea rax, [0x180011138]
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, 1
add rsp, 0x38
ret

Function at 0x18000b680
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [0x1800110a8]
lea rax, [0x180011138]
xor r9d, r9d
mov dword [0x180011a20], 0x1ff00
lea rdx, [0x180011a20]
mov byte [0x180011a24], 0
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, 1
add rsp, 0x38
ret
Function at 0x18000b6d0
Capabilities:
Log keystrokes via polling
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
movzx eax, byte [rcx]
mov edi, edx
mov rbx, rcx
test al, al
je 0x18000b798
mov qword [rsp + 0x40], rsi
lea rsi, [0x180011138]
movsx ecx, al
call qword [sym.imp.USER32.dll_VkKeyScanW]
movsx ecx, ax
call fcn.18000b7b0
movzx ecx, al
mov dword [0x180011ac0], 0x1ff00
call fcn.18000b7b0
mov rcx, qword [0x1800110a8]
lea rdx, [0x180011ac0]
xor r9d, r9d
mov byte [0x180011ac4], al
mov qword [rsp + 0x20], rsi
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov rcx, qword [0x1800110a8]
lea rdx, [0x180011ac0]
xor r9d, r9d
mov dword [0x180011ac0], 0x1ff00
mov byte [0x180011ac4], 0
mov qword [rsp + 0x20], rsi
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, edi
call qword [sym.imp.KERNEL32.DLL_Sleep]
movzx eax, byte [rbx + 1]
lea rbx, [rbx + 1]
test al, al
jne 0x18000b6f6
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret