joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000510c
Capabilities:
Get common file path
Print debug messages
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rdi, rdx
mov esi, ecx
lea rdx, str.RegistryMachineSystemCurrentControlSetControlNlsCodePage
xor ebx, ebx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x40], 0x30
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], rbx
mov edx, 0x80000000
mov dword [rsp + 0x58], 0x40
lea rcx, [rbp + 0x208]
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x18000524a
mov r8d, esi
mov dword [rbp + 0x200], 0x222
lea rdx, [0x18000b4a0]
lea rcx, [rsp + 0x70]
call qword [0x180014938]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rbp + 0x208]
lea rax, [rbp + 0x200]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x60]
mov eax, dword [rbp + 0x200]
lea r8d, [rbx + 2]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x180005212
mov edx, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, eax
lea r8, [rbp - 0x54]
lea rdx, str._ws
lea rcx, [rdi + rax*2]
call qword [0x180014938]
mov ebx, 1
jmp 0x18000523b
mov rax, qword [0x180014958]
test rax, rax
je 0x18000523b
lea rdx, str.GetNlsTablePath_failed_to_get_NLS_table_n
lea rcx, [0x1800128f0]
call rax
lea rcx, [0x1800128f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rbp + 0x208]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x180005273
mov rax, qword [0x180014958]
test rax, rax
je 0x180005273
lea rdx, str.GetNlsTablePath_failed_to_open_NLS_key_n
lea rcx, [0x1800128f0]
call rax
lea rcx, [0x1800128f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, ebx
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2d0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180005288
Capabilities:
Access peb ldr_data
Print debug messages
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x250
mov rax, qword gs:[0x30]
lea r14, [0x1800128f0]
mov rsi, qword [rax + 0x60]
mov rax, qword [0x180014958]
test rax, rax
je 0x1800052dc
lea rdx, str.OEMCP_FixNLSTable_enter_n
mov rcx, r14
call rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rax, qword [0x180014958]
mov r8, qword [rsi + 0xa8]
test r8, r8
je 0x180005302
test rax, rax
je 0x180005463
lea rdx, str.No_need_for_fixup__Peb__OemCodePageData_X_n
mov rcx, r14
call rax
jmp 0x18000545a
call qword [sym.imp.KERNEL32.dll_GetOEMCP]
mov ecx, eax
lea rdx, [rsp + 0x40]
call fcn.18000510c
test eax, eax
je 0x180005463
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
and dword [rsp + 0x28], 0
mov r8d, 3
xor r9d, r9d
mov dword [rsp + 0x20], r8d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180005432
and qword [rsp + 0x28], 0
xor r9d, r9d
and dword [rsp + 0x20], 0
xor edx, edx
mov rcx, rax
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
test rax, rax
je 0x180005404
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0xa8], rax
test rax, rax
je 0x1800053cf
mov r9, qword [0x180014958]
test r9, r9
je 0x1800053c5
mov r8, rax
lea rdx, str.Peb__OemCodePageData_set_to__X
mov rcx, r14
call r9
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
jmp 0x180005465
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [0x180014958], 0
je 0x180005404
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Codepage_MapViewOfFile_failed:__d_n
mov rcx, r14
mov r8d, eax
call qword [0x180014958]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [0x180014958], 0
je 0x180005463
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Codepage_CreateFileW_failed:__d_n
mov rcx, r14
mov r8d, eax
call qword [0x180014958]
jmp 0x18000545a
cmp qword [0x180014958], 0
je 0x180005463
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsp + 0x40]
mov rcx, r14
mov r9d, eax
lea rdx, str.Cannot_open_NLS_file__S:_gle_d_n
call qword [0x180014958]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
Function at 0x180005480
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rcx, [0x18000b5f8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ebx, ebx
lea rsi, [0x1800128f0]
mov rdi, rax
mov rax, qword [0x180014958]
test rax, rax
je 0x1800054c9
lea rdx, str.OEMCP_CallInitializeCustomCP_n
mov rcx, rsi
call rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, [rsp + 0x30]
call fcn.180005964
mov r8d, eax
test eax, eax
js 0x18000551c
mov rcx, qword [rsp + 0x30]
lea rdx, [0x18000b5f8]
xor r8d, r8d
call fcn.18000601c
test rax, rax
je 0x18000550f
mov rcx, qword [rsp + 0x30]
lea rdx, [0x18000b638]
call fcn.1800060d4
mov eax, eax
test rax, rax
je 0x18000550f
lea rbx, [rax + rdi]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x18000553d
mov rax, qword [0x180014958]
test rax, rax
je 0x180005544
lea rdx, str.REG_OpenLDNTVDM_failed:__08X_n
mov rcx, rsi
call rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rax, qword [0x180014958]
test rdi, rdi
je 0x180005552
test rbx, rbx
je 0x180005552
call rbx
jmp 0x180005574
test rax, rax
je 0x180005572
mov r9, rbx
lea rdx, str.failed:_nt_X__fnInitializeCustomCP_X_n
mov r8, rdi
mov rcx, rsi
call rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180005704
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.pifprop.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
jne 0x180005750
lea rcx, str.pifprop.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x180005750
mov rax, qword [0x180014958]
test rax, rax
je 0x1800057f0
lea rdx, str.LDNTVDM:_PifProp.dll_not_present_n
jmp 0x1800057da
lea rdx, str.PifMgr_OpenProperties
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18000d670], rax
test rax, rax
je 0x1800057c7
lea rdx, str.PifMgr_GetProperties
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18000d660], rax
test rax, rax
je 0x1800057c7
lea rdx, str.PifMgr_SetProperties
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18000d668], rax
test rax, rax
je 0x1800057c7
lea rdx, str.PifMgr_CloseProperties
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18000d678], rax
test rax, rax
je 0x1800057c7
mov eax, 1
jmp 0x1800057f2
mov rax, qword [0x180014958]
test rax, rax
je 0x1800057f0
lea rdx, str.LDNTVDM:_Pifprop_doesnt_export_Pifmgr_functions__maybe_better_update_DLL__n
lea rcx, [0x1800130f0]
call rax
lea rcx, [0x1800130f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x180005a64
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
mov edi, r9d
lea rcx, [rsp + 0x38]
mov rsi, r8
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x30]
mov r8d, 2
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x20], 0x18
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov edx, eax
test eax, eax
js 0x180005ad8
cmp dword [rsp + 0x4c], edi
jne 0x180005ad8
cmp edi, 4
je 0x180005ad2
cmp edi, 0xb
jne 0x180005ad8
mov rcx, qword [rsp + 0x54]
mov qword [rsi], rcx
jmp 0x180005ad8
mov eax, dword [rsp + 0x54]
mov dword [rsi], eax
mov rbx, qword [rsp + 0x70]
mov eax, edx
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x18000601c
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r11d, r8d
lea r10, [0x18000d268]
mov rbx, rdx
xor r9d, r9d
mov r8, qword [r10]
cmp r8, rdx
je 0x180006066
inc r9d
add r10, 0x18
movsxd rax, r9d
cmp rax, 4
jb 0x180006036
mov rax, qword [0x180014958]
test rax, rax
je 0x1800060c4
mov r8, rdx
lea rdx, str.SymCache_GetDLLKey__S__not_found_n
jmp 0x1800060ae
and dword [rsp + 0x28], 0
movsxd rax, r9d
mov dword [rsp + 0x20], r11d
lea r9, [rax + rax*2]
lea rax, str.kernel32.dll
lea rdi, [rax + r9*8]
mov r9, qword [rax + r9*8 + 0x10]
mov rdx, qword [rdi]
call fcn.180005aec
test eax, eax
je 0x180006098
mov rax, rdi
jmp 0x1800060c6
mov rax, qword [0x180014958]
test rax, rax
je 0x1800060c4
mov r8, rbx
lea rdx, str.SymCache_GetDLLKey__S__found__but_update_failed_n
lea rcx, [0x1800138f0]
call rax
lea rcx, [0x1800138f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1800060d4
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, 4
lea r8, [rsp + 0x40]
mov rbx, rdx
call fcn.180005a64
mov r9d, eax
test eax, eax
js 0x1800060fa
mov eax, dword [rsp + 0x40]
jmp 0x180006128
mov rax, qword [0x180014958]
test rax, rax
je 0x180006126
mov r8, rbx
lea rdx, str.RegQueryValueEx__S__failed:__08X_n
lea rcx, [0x1800138f0]
call rax
lea rcx, [0x1800138f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x180006130
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
and qword [rsp + 0x48], 0
cmp dword [0x18000d654], 0
je 0x180006158
mov eax, 1
jmp 0x18000627a
mov rax, qword [0x180014958]
lea rbx, [0x1800138f0]
test rax, rax
je 0x180006180
lea rdx, str.UpdateSymbolCache___n
mov rcx, rbx
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, [rsp + 0x48]
call fcn.180005964
mov r8d, eax
test eax, eax
js 0x180006253
mov ebx, 1
lea rdi, [0x18000d268]
mov dword [0x18000d654], ebx
xor esi, esi
and dword [rsp + 0x28], 0
mov r9, qword [rdi + 8]
mov r8, qword [rdi]
mov rdx, qword [rdi - 8]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x20], ebx
call fcn.180005aec
and dword [0x18000d654], eax
lea rdi, [rdi + 0x18]
add esi, ebx
movsxd rax, esi
cmp rax, 4
jb 0x1800061a9
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_NtClose]
lea r9, [rsp + 0x48]
xor ecx, ecx
lea rdx, str.RegistryMachineSoftwareWOW6432Nodeldntvdm
call fcn.1800059d8
test eax, eax
jns 0x18000620c
lea rdx, [rsp + 0x48]
call fcn.180005990
test eax, eax
js 0x180006274
lea rdi, [0x18000d348]
mov r9, qword [rdi + 8]
mov r8, qword [rdi]
mov rdx, qword [rdi - 8]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call fcn.180005aec
and dword [0x18000d654], eax
add rdi, 0x18
lea rax, [0x18000d378]
cmp rdi, rax
jl 0x180006213
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x180006274
mov rax, qword [0x180014958]
test rax, rax
je 0x180006274
lea rdx, str.RegCreateKeyEx_failed:__08X_n
mov rcx, rbx
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x18000d654]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800065b4
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x390
mov rbx, rdx
mov dword [rsp + 0x50], 0x33c
mov rdi, r8
lea rdx, [rsp + 0x50]
mov rsi, rcx
xor r8d, r8d
mov rcx, rbx
call qword [0x1800148f0]
test eax, eax
jne 0x18000662a
cmp qword [0x180014958], 0
je 0x180006623
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rbx
lea rdx, str.SymSrvGetFileIndexInfo__s__failed:__d
mov r9d, eax
lea rcx, [0x1800140f0]
call qword [0x180014958]
lea rcx, [0x1800140f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x1800066ce
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and qword [rsp + 0x48], 0
lea r9, [rsp + 0x374]
and qword [rsp + 0x40], 0
lea r8, [rsp + 0x26d]
mov rcx, rax
mov qword [rsp + 0x38], rdi
mov eax, dword [rsp + 0x384]
mov rdx, rsi
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x388]
mov dword [rsp + 0x20], eax
call qword [0x180014928]
mov edi, eax
test eax, eax
jne 0x1800066cc
cmp qword [0x180014958], 0
je 0x1800066cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rsp + 0x384]
lea rdx, str.SymFindFileInPath__s___d___d__failed:__d
mov r9d, dword [rsp + 0x388]
mov r8, rbx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rcx, [0x1800140f0]
call qword [0x180014958]
lea rcx, [0x1800140f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, edi
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1800066e4
Capabilities:
Delete file
Get common file path
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rdi, rcx
lea r8, [rsp + 0x50]
mov rdx, rcx
xor ecx, ecx
call fcn.1800065b4
test eax, eax
je 0x18000680f
lea r8, [rsp + 0x20]
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0x18000680f
cmp dword [rsp + 0x40], 0
jne 0x18000680f
mov rax, qword [0x180014958]
test rax, rax
je 0x18000676b
lea r8, [rsp + 0x50]
lea rdx, str.Detected_0_byte_symbol_file:__s__removing_n
lea rcx, [0x1800140f0]
call rax
lea rcx, [0x1800140f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rbp + 0x60]
mov ecx, 0x104
lea rbx, str.SymbolCache
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, eax
lea rcx, [rbp + 0x60]
sub rax, rbx
add rcx, rax
mov al, byte [rbx]
mov byte [rcx + rbx], al
inc rbx
test al, al
jne 0x180006798
lea r8, [rsp + 0x50]
mov rdx, rdi
lea rcx, [rbp + 0x60]
call fcn.1800065b4
test eax, eax
je 0x18000680f
lea r8, [rsp + 0x20]
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0x18000680f
cmp dword [rsp + 0x40], 0
jne 0x18000680f
mov rax, qword [0x180014958]
test rax, rax
je 0x180006804
lea r8, [rsp + 0x50]
lea rdx, str.Detected_0_byte_symbol_file:__s__removing_n
lea rcx, [0x1800140f0]
call rax
lea rcx, [0x1800140f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140001830
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x160
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov ebx, edx
mov qword [rsp + 0x38], rcx
mov rdi, rcx
xor edx, edx
mov ecx, ebx
xor r14d, r14d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea rcx, [rsp + 0x50]
mov esi, eax
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
jne 0x140001898
xorps xmm0, xmm0
mov rax, rdi
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
jmp 0x140001a16
mov ecx, 0x10
mov qword [rsp + 0x190], rbp
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x1400018b9
or byte [rsp + 0x60], 0x80
jmp 0x1400018be
and byte [rsp + 0x60], 0x7f
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x1400018d4
or byte [rsp + 0x64], 1
jmp 0x1400018d9
and byte [rsp + 0x64], 0xfe
xor eax, eax
mov dword [rsp + 0x28], r14d
lea r9, [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x50]
mov word [rsp + 0x40], ax
mov edx, esi
mov dword [rsp + 0x20], 4
mov ecx, ebx
call qword [sym.imp.USER32.dll_ToUnicode]
movsxd rbx, eax
xorps xmm0, xmm0
movabs rbp, 0x7ffffffffffffffe
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
cmp rbx, rbp
ja 0x140001a3a
mov qword [rdi + 0x18], 7
cmp rbx, 8
jae 0x140001959
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x38]
add rbx, rbx
mov rcx, rdi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r14w
jmp 0x140001a0b
mov rax, rbx
or rax, 7
cmp rax, rbp
jbe 0x140001975
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x1400019a7
mov ecx, 0xa
mov rbp, rax
cmp rax, rcx
movabs rax, 0x7fffffffffffffff
cmovb rbp, rcx
lea rcx, [rbp + 1]
cmp rcx, rax
ja 0x140001a40
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400019d6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001a40
mov rcx, rax
call fcn.140001b28
test rax, rax
je 0x1400019cf
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400019e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400019e5
call fcn.140001b28
mov rsi, rax
jmp 0x1400019e8
mov rsi, r14
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x38]
add rbx, rbx
mov qword [rdi], rsi
mov r8, rbx
mov qword [rdi + 0x18], rbp
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rsi], r14w
mov rbp, qword [rsp + 0x190]
mov rax, rdi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140001b00
mov rbx, qword [rsp + 0x198]
add rsp, 0x160
pop r14
pop rdi
pop rsi
ret
call fcn.140001810
int3
call fcn.140001770
int3
Function at 0x140001a50
Capabilities:
Log keystrokes via application hook

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor r9d, r9d
lea rdx, section..text
xor r8d, r8d
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rbx, rax
test rax, rax
je 0x140001ad6
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140001acd
nop dword [rax + rax]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140001aa0
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140001b00
add rsp, 0x60
pop rbx
ret

Function at 0x140002494
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400024de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400024de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400024de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400024de
cmp dword [rcx + 0x84], 0xe
jbe 0x1400024de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400024e0
xor al, al
add rsp, 0x28
ret
Function at 0x1800193d8
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rdx]
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx], rax
je 0x1800194aa
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18001948a
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x18001948a
mov r15d, dword [r9 + 0x20]
dec r10d
mov ebp, 0x89643ca8
lea rcx, [r15 + r10*4]
mov r11d, dword [rcx + r8]
add r11, r8
mov sil, byte [r11]
inc r11
test sil, sil
je 0x180019485
movsx ecx, sil
sub sil, 0x41
mov edx, ecx
or edx, 0x20
cmp sil, 0x19
mov sil, byte [r11]
cmova edx, ecx
inc r11
xor edx, ebp
imul ebp, edx, 0x1000193
test sil, sil
jne 0x180019456
cmp ebp, 0x4606a76a
je 0x18001948f
test r10d, r10d
jne 0x180019438
mov rax, qword [rax]
jmp 0x180019413
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rax, qword [rbx]
movzx ecx, byte [rax]
cmp ecx, 5
ja 0x1800194d9
je 0x1800194d9
test ecx, ecx
je 0x1800194d9
sub ecx, 1
je 0x1800194cf
sub ecx, 1
jne 0x1800194d9
mov rax, qword [rdi + 0x10]
cmp qword [rbx + 0x10], rax
jmp 0x1800194e1
mov rax, qword [rdi + 8]
cmp qword [rbx + 8], rax
jmp 0x1800194e1
mov rax, qword [rdi + 0x18]
cmp qword [rbx + 0x18], rax
mov rbx, qword [rsp + 0x40]
sete al
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x180019598
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
xor r10d, r10d
mov rbx, rdx
mov r11, rcx
test r9b, r9b
je 0x1800195ea
test r8, r8
je 0x18001960d
movabs r9, 0x100000001b3
mov al, byte [r10 + rbx]
mov dl, byte [r10 + rbx]
add al, 0x20
movzx ecx, al
sub dl, 0x41
movzx eax, byte [r10 + rbx]
cmp dl, 0x19
cmova ecx, eax
inc r10
imul r11, r9
movsx rax, cl
xor r11, rax
cmp r10, r8
jb 0x1800195ba
jmp 0x18001960d
test r8, r8
je 0x18001960d
movabs r9, 0x100000001b3
movsx rcx, byte [r10 + rdx]
inc r10
imul r11, r9
xor r11, rcx
cmp r10, r8
jb 0x1800195f9
mov rbx, qword [rsp + 8]
mov rax, r11
ret
xor r8d, r8d
cmp byte [rcx], r8b
je 0x180023c5e
inc r8
cmp byte [r8 + rcx], 0
jne 0x180023c54
mov r9b, dl
mov rdx, rcx
movabs rcx, 0xcbf29ce484222325
jmp 0x180019598
Function at 0x18001d85c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov r15, rdx
cmp byte [rcx], 4
mov rdi, rcx
je 0x18001d932
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18001d912
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x18001d912
mov r12d, dword [r9 + 0x20]
dec r10d
mov ebp, 0x914e85f8
lea rcx, [r12 + r10*4]
mov r11d, dword [rcx + r8]
add r11, r8
mov sil, byte [r11]
inc r11
test sil, sil
je 0x18001d90d
movsx ecx, sil
sub sil, 0x41
mov edx, ecx
or edx, 0x20
cmp sil, 0x19
mov sil, byte [r11]
cmova edx, ecx
inc r11
xor edx, ebp
imul ebp, edx, 0x1000193
test sil, sil
jne 0x18001d8de
cmp ebp, 0x917fdd1a
je 0x18001d917
test r10d, r10d
jne 0x18001d8c0
mov rax, qword [rax]
jmp 0x18001d89b
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
cmp byte [rdi], 4
lea rax, [rdi + 8]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
cmove rbx, rax
mov rdi, qword [rsp + 0x58]
mov al, byte [rbx]
mov rbx, qword [rsp + 0x40]
mov byte [r15], al
add rsp, 0x20
pop r15
pop r14
pop r12
ret