joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800905f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, byte [rdx]
mov rbx, r8
dec eax
mov r8, rdx
mov rdi, rcx
cmp eax, 0x20
ja case.0x1800906d9.4
lea rsi, [0x180000000]
nop dword [rax]
cdqe
movzx eax, byte [rsi + rax + 0x90858]
mov ecx, dword [rsi + rax*4 + 0x9082c]
add rcx, rsi
jmp rcx
mov rax, qword [rbx + 0xd0]
movzx r8d, byte [r8 + 1]
add rax, 0xffffffffffffffc4
lea r8, [rax + r8*2]
movzx eax, byte [r8]
dec eax
cmp eax, 0x20
jbe 0x180090620
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rax, dword [rbx + 0xcc]
movzx edx, word [rsi + rax*2 + 0xa4f70]
mov rcx, rdi
call fcn.18008eea0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x9c]
cmp al, 8
jae case.0x1800906d9.4
lea edx, [rax + 0x6d]
mov rcx, rdi
call fcn.18008eea0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [r8 + 1]
add eax, 0xfffffffe
cmp eax, 0x1a
ja case.0x1800906d9.4
cdqe
movzx eax, byte [rsi + rax + 0x90888]
mov ecx, dword [rsi + rax*4 + 0x9087c]
add rcx, rsi
jmp rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180091690
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800908b0
movzx eax, byte [rbx + 0xa2]
mov r9, rbx
mov rcx, rdi
mov rdx, qword [rbx + rax*8 + 0xa8]
inc al
mov byte [rbx + 0xa2], al
call fcn.18008f420
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx edx, byte [rbx + 0x34]
mov rcx, rdi
call fcn.18008ee70
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0x60]
cmp eax, 2
jne 0x18009076e
lea edx, [rax + 0x35]
jmp 0x180090780
cmp eax, 1
jne 0x18009077b
lea edx, [rax + 0x1f]
lea eax, [rdx + 0x19]
jmp 0x180090785
mov edx, 0x39
mov eax, 0x20
cmp byte [rbx + 0x37], 0
mov rcx, rdi
cmovne edx, eax
call fcn.18008eea0
movsxd rax, dword [rbx + 8]
mov rcx, rdi
movzx edx, byte [rax + rsi + 0xa5130]
call fcn.18008eea0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0x60]
cmp eax, 2
jne 0x1800907c7
lea edx, [rax + 0x31]
jmp 0x1800907d9
cmp eax, 1
jne 0x1800907d4
lea edx, [rax + 0x19]
lea eax, [rdx - 0xa]
jmp 0x1800907de
mov edx, 0x10
mov eax, 0x1a
cmp byte [rbx + 0x37], 0
mov rcx, rdi
cmovne edx, eax
call fcn.18008eea0
mov rbx, qword [rsp + 0x30]
xor al, al
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rax, dword [rbx + 0xb8]
jmp 0x18009066e
movzx edx, byte [rbx + 0xa0]
and edx, 7
add edx, 0x85
jmp 0x180090676
movsxd rax, dword [rbx + 0x98]
jmp 0x18009066e
Function at 0x1400e52e9
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
jmp 0x1402a64f0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x218
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x4e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x238]
mov rax, qword [0x14030a8c0]
xor rax, rbp
mov qword [rbp + 0x1e8], rax
lea rcx, [0x140327151]
call fcn.1400e7e4a
nop
mov qword [rbp + 8], 0
mov dword [rbp + 0x24], 0
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 8]
mov ecx, 0xb
call fcn.1400e72d8
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0xc0000004
jne 0x1402a65bd
cmp qword [rbp + 8], 0
je 0x1402a6585
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov eax, dword [rbp + 0x24]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 8], rax
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 8]
mov ecx, 0xb
call fcn.1400e72d8
mov dword [rbp + 0x44], eax
jmp 0x1402a6562
cmp dword [rbp + 0x44], 0
jge 0x1402a65e4
cmp qword [rbp + 8], 0
je 0x1402a65dd
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
xor eax, eax
jmp 0x1402a671f
mov rax, qword [rbp + 8]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x1402a65fa
xor eax, eax
jmp 0x1402a671f
mov dword [rbp + 0x84], 0
jmp 0x1402a6614
mov eax, dword [rbp + 0x84]
inc eax
mov dword [rbp + 0x84], eax
mov rax, qword [rbp + 0x68]
mov eax, dword [rax]
cmp dword [rbp + 0x84], eax
jae 0x1402a670a
mov eax, dword [rbp + 0x84]
imul rax, rax, 0x128
mov rcx, qword [rbp + 0x68]
lea rax, [rcx + rax + 8]
mov ecx, dword [rbp + 0x84]
imul rcx, rcx, 0x128
mov rdx, qword [rbp + 0x68]
movzx ecx, word [rdx + rcx + 0x2e]
lea rax, [rax + rcx + 0x28]
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.1400e6540
nop
mov rcx, qword [rbp + 0x210]
call fcn.1400e542e
mov qword [rbp + 0x1d8], rax
lea rcx, [rbp + 0xa8]
call fcn.1400e542e
mov qword [rbp + 0x1e0], rax
mov rdx, qword [rbp + 0x1d8]
mov rcx, qword [rbp + 0x1e0]
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x1402a66f8
mov eax, dword [rbp + 0x84]
imul rax, rax, 0x128
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx + rax + 0x18]
mov qword [rbp + 0xe8], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1c8], rax
lea rcx, [rbp + 0xa8]
call fcn.1400e58c5
mov rax, qword [rbp + 0x1c8]
jmp 0x1402a671f
lea rcx, [rbp + 0xa8]
call fcn.1400e58c5
nop
jmp 0x1402a6606
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402f3a30]
call fcn.1400e76b1
mov rax, rdi
mov rcx, qword [rbp + 0x1e8]
xor rcx, rbp
call fcn.1400e66b7
lea rsp, [rbp + 0x1f8]
pop rdi
pop rbp
ret
Function at 0x1400e5474
Capabilities:
Write file on windows

Disassembly:
jmp 0x1401e7890
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140326506]
call fcn.1400e7e4a
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x1401e78e8
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1401e79fa
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x1401e7993
cmp qword [rbp + 0x28], 0
jle 0x1401e7993
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x1401e7931
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.1400e7b5c
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x1401e79e9
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x1401e79e9
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400e5c71
Capabilities:
Get common file path

Disassembly:
jmp 0x1402a6300
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x468]
mov rax, qword [0x14030a8c0]
xor rax, rbp
mov qword [rbp + 0x410], rax
mov dword [rbp + 0x3f4], 0
lea rcx, [0x140327151]
call fcn.1400e7e4a
nop
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rbp + 0x10]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rbp + 0x234], eax
cmp dword [rbp + 0x234], 0
je 0x1402a638e
cmp dword [rbp + 0x234], 0x105
jbe 0x1402a63e8
lea rdx, str.____Failed_to_get_temp_path
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400e681a
mov qword [rbp + 0x408], rax
lea rdx, [0x1400e66df]
mov rcx, qword [rbp + 0x408]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rdx, [0x1402bdf2c]
mov rcx, qword [rbp + 0x440]
call fcn.1400e5f55
mov eax, dword [rbp + 0x3f4]
or eax, 1
mov dword [rbp + 0x3f4], eax
mov rax, qword [rbp + 0x440]
jmp 0x1402a645b
lea rcx, [rbp + 0x10]
call qword [sym.imp.ucrtbased.dll_wcslen]
movzx eax, word [rbp + rax*2 + 0xe]
cmp eax, 0x5c
jne 0x1402a6435
lea rcx, [rbp + 0x10]
call qword [sym.imp.ucrtbased.dll_wcslen]
lea rax, [rax + rax - 2]
mov qword [rbp + 0x3d8], rax
cmp qword [rbp + 0x3d8], 0x20a
jae 0x1402a6421
jmp 0x1402a6427
call fcn.1400e720b
nop
xor eax, eax
mov rcx, qword [rbp + 0x3d8]
mov word [rbp + rcx + 0x10], ax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x440]
call fcn.1400e5f55
mov eax, dword [rbp + 0x3f4]
or eax, 1
mov dword [rbp + 0x3f4], eax
mov rax, qword [rbp + 0x440]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402f3850]
call fcn.1400e76b1
mov rax, rdi
mov rcx, qword [rbp + 0x410]
xor rcx, rbp
call fcn.1400e66b7
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x1400e5e15
Capabilities:
Enumerate gui resources

Disassembly:
jmp 0x1401e9250
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x178]
mov rax, qword [0x14030a8c0]
xor rax, rbp
mov qword [rbp + 0x128], rax
lea rcx, [0x14032681f]
call fcn.1400e7e4a
nop
mov qword [rbp + 0x118], 0
lea r8, [rbp + 0x150]
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.1400e55a0
nop
lea rdx, [rbp + 8]
lea rcx, [0x1401e9060]
call qword [sym.imp.USER32.dll_EnumWindows]
mov dword [rbp + 0x34], eax
cmp dword [rbp + 0x34], 0
jne 0x1401e92ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x1401e92ed
cmp qword [rbp + 8], 0
je 0x1401e92ed
mov rax, qword [rbp + 8]
jmp 0x1401e92ef
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402c4370]
call fcn.1400e76b1
mov rax, rdi
mov rcx, qword [rbp + 0x128]
xor rcx, rbp
call fcn.1400e66b7
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1400e5e2e
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1402067b0
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x20]
lea rcx, [0x1403268cc]
call fcn.1400e7e4a
nop
mov eax, 4
imul rax, rax, 1
lea rcx, [0x14030dd70]
cmp dword [rcx + rax], 0
jne 0x140206859
mov dword [rbp + 4], 0xedb88320
mov dword [rbp + 0x24], 0
jmp 0x140206807
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0x100
jae 0x140206859
mov eax, dword [rbp + 0x24]
mov dword [rbp + 0x44], eax
mov dword [rbp + 0x64], 0
jmp 0x140206827
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 8
jae 0x140206847
mov eax, dword [rbp + 0x44]
shr eax, 1
mov ecx, dword [rbp + 0x44]
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor eax, ecx
mov dword [rbp + 0x44], eax
jmp 0x14020681f
mov eax, dword [rbp + 0x24]
lea rcx, [0x14030dd70]
mov edx, dword [rbp + 0x44]
mov dword [rcx + rax*4], edx
jmp 0x1402067ff
mov eax, dword [rbp + 0x1d0]
not eax
mov dword [rbp + 0x1d0], eax
mov eax, dword [rbp + 0x1d0]
mov dword [rbp + 0x84], eax
mov rax, qword [rbp + 0x1c0]
mov qword [rbp + 0xa8], rax
cmp dword [rbp + 0x1c8], 0
jle 0x140206904
mov eax, dword [rbp + 0x1c8]
mov dword [rbp + 0x194], eax
mov eax, dword [rbp + 0x1c8]
dec eax
mov dword [rbp + 0x1c8], eax
cmp dword [rbp + 0x194], 0
je 0x1402068ff
mov eax, dword [rbp + 0x84]
shr eax, 8
mov ecx, dword [rbp + 0x84]
and ecx, 0xff
mov rdx, qword [rbp + 0xa8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
lea rdx, [0x14030dd70]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x194], eax
mov rax, qword [rbp + 0xa8]
inc rax
mov qword [rbp + 0xa8], rax
mov eax, dword [rbp + 0x194]
mov dword [rbp + 0x84], eax
jmp 0x14020688a
jmp 0x1402069bc
mov rax, qword [rbp + 0xa8]
movzx eax, byte [rax]
mov byte [rbp + 0x194], al
mov rax, qword [rbp + 0xa8]
inc rax
mov qword [rbp + 0xa8], rax
movzx eax, byte [rbp + 0x194]
mov byte [rbp + 0xc4], al
movzx eax, byte [rbp + 0xc4]
test eax, eax
je 0x1402069bc
movzx eax, byte [rbp + 0xc4]
cmp eax, 0x23
jne 0x140206987
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0xa8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140206987
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0xa8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140206987
mov eax, dword [rbp + 0x1d0]
mov dword [rbp + 0x84], eax
mov eax, dword [rbp + 0x84]
shr eax, 8
mov ecx, dword [rbp + 0x84]
and ecx, 0xff
movzx edx, byte [rbp + 0xc4]
xor ecx, edx
mov ecx, ecx
lea rdx, [0x14030dd70]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x84], eax
jmp 0x140206904
mov eax, dword [rbp + 0x84]
not eax
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret
Function at 0x1400e626b
Capabilities:
Write file on windows

Disassembly:
jmp 0x14021a090
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x14030a8c0]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x1403268cc]
call fcn.1400e7e4a
nop
mov rax, qword [0x14030dcf0]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
xorps xmm0, xmm0
movss dword [rax + 0x2cd4], xmm0
cmp qword [rbp + 0x160], 0
jne 0x14021a100
jmp 0x14021a158
mov qword [rbp + 0x28], 0
lea rcx, [rbp + 0x28]
call fcn.1400e81bf
mov qword [rbp + 0x48], rax
lea rdx, [0x1402cc8b0]
mov rcx, qword [rbp + 0x160]
call fcn.1400e6397
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x14021a135
jmp 0x14021a158
mov r9, qword [rbp + 0x68]
mov r8, qword [rbp + 0x28]
mov edx, 1
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ucrtbased.dll_fwrite]
nop
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ucrtbased.dll_fclose]
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x1402c57f0]
call fcn.1400e76b1
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.1400e66b7
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x1400e6a09
Capabilities:
Terminate process

Disassembly:
jmp 0x1402abf60
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400e6a72
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x1402a6180
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rcx, [0x140327151]
call fcn.1400e7e4a
nop
mov rcx, qword [rbp + 0x180]
call fcn.1400e6513
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x188]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x188]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 0x14]
mov rcx, qword [rbp + 0x28]
lea rax, [rcx + rax + 0x18]
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x64], 0
jmp 0x1402a61fc
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 6]
cmp dword [rbp + 0x64], eax
jae 0x1402a62a4
mov eax, dword [rbp + 0x64]
imul rax, rax, 0x28
mov rcx, qword [rbp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov r8, qword [rbp + 8]
mov rdx, qword [rbp + 0x180]
mov rcx, rax
call fcn.1400e6144
test eax, eax
jne 0x1402a629f
mov rax, qword [rbp + 0x88]
mov rcx, rax
call fcn.1400e6513
cmp qword [rbp + 8], rax
jne 0x1402a629f
mov rax, qword [rbp + 0x88]
cmp dword [rax + 0xc], 0
jne 0x1402a6269
xor eax, eax
jmp 0x1402a62a6
cmp qword [rbp + 0x190], 0
je 0x1402a6286
mov rax, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x88]
mov ecx, dword [rcx + 8]
mov dword [rax], ecx
mov rax, qword [rbp + 0x88]
mov eax, dword [rax + 0xc]
mov rcx, qword [rbp + 0x188]
add rcx, rax
mov rax, rcx
jmp 0x1402a62a6
jmp 0x1402a61f4
xor eax, eax
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x1400e6b03
Capabilities:
Terminate process

Disassembly:
jmp 0x1401e9360
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x40]
lea rcx, [0x14032681f]
call fcn.1400e7e4a
nop
lea rdx, [0x14030db50]
mov ecx, 0x20
call fcn.1400e6356
test eax, eax
jge 0x1401e93a1
mov ecx, 3
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov r8d, 0x40
xor edx, edx
lea rcx, [0x14030db70]
call fcn.1400e7346
nop
mov dword [0x14030db98], 1
mov dword [0x14030db88], 1
mov rax, qword [rbp + 0x100]
mov qword [0x14030db90], rax
mov dword [0x14030db84], 0
mov dword [0x14030db78], 0x15
mov eax, dword [0x14030dcdc]
mov dword [0x14030db70], eax
mov eax, dword [0x14030dce0]
mov dword [0x14030db74], eax
mov dword [0x14030db9c], 1
mov dword [0x14030dba0], 0x50
mov dword [0x14030dbac], 0x80000000
mov rax, qword [0x14030db50]
mov rax, qword [rax]
mov rax, qword [rax + 0xa0]
mov qword [rbp + 0xd8], rax
lea rax, [0x14030db60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
lea rax, [0x14030db70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x40
mov r9, qword [rbp + 0x100]
mov r8d, 1
xor edx, edx
mov rcx, qword [0x14030db50]
call qword [rbp + 0xd8]
test eax, eax
jge 0x1401e94a4
mov rax, qword [0x14030db50]
mov rax, qword [rax]
mov rcx, qword [0x14030db50]
call qword [rax + 0x10]
nop
mov ecx, 4
call qword [sym.imp.ucrtbased.dll_exit]
nop
xor ecx, ecx
call fcn.1400e7d0f
nop
call fcn.1400e73be
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rax + 0x18], 0
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x98]
mov qword [rbp + 0xd8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
movss xmm2, dword [0x1402c04cc]
lea rdx, str.C:WindowsFonts_arialbd.ttf
mov rcx, qword [rbp + 0xd8]
call fcn.1400e8007
nop
xor ecx, ecx
call fcn.1400e5b27
nop
call fcn.1400e7ca6
nop
mov rcx, qword [rbp + 0x100]
call fcn.1400e5cc6
nop
mov rcx, qword [0x14030db60]
call fcn.1400e5555
nop
xor eax, eax
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1400e6e69
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x140256400
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14030a8c0]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x140326a43]
call fcn.1400e7e4a
nop
call fcn.1400e73be
mov qword [rbp + 8], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [0x140313758]
call qword [sym.imp.USER32.dll_GetClientRect]
nop
mov eax, dword [rbp + 0x2c]
mov ecx, dword [rbp + 0x34]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm0, eax
mov eax, dword [rbp + 0x28]
mov ecx, dword [rbp + 0x30]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm1, eax
movaps xmm2, xmm0
lea rcx, [rbp + 0x154]
call fcn.1400e6dc9
mov rax, qword [rax]
mov rcx, qword [rbp + 8]
mov qword [rcx + 8], rax
lea rcx, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
nop
mov rax, qword [0x140313760]
mov rcx, qword [rbp + 0x58]
sub rcx, rax
mov rax, rcx
cvtsi2ss xmm0, rax
cvtsi2ss xmm1, qword [0x140313768]
divss xmm0, xmm1
mov rax, qword [rbp + 8]
movss dword [rax + 0x10], xmm0
mov rax, qword [rbp + 0x58]
mov qword [0x140313760], rax
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1402564f2
mov dword [rbp + 0x164], 1
jmp 0x1402564fc
mov dword [rbp + 0x164], 0
mov rax, qword [rbp + 8]
movzx ecx, byte [rbp + 0x164]
mov byte [rax + 0x118], cl
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14025652e
mov dword [rbp + 0x164], 1
jmp 0x140256538
mov dword [rbp + 0x164], 0
mov rax, qword [rbp + 8]
movzx ecx, byte [rbp + 0x164]
mov byte [rax + 0x119], cl
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14025656a
mov dword [rbp + 0x164], 1
jmp 0x140256574
mov dword [rbp + 0x164], 0
mov rax, qword [rbp + 8]
movzx ecx, byte [rbp + 0x164]
mov byte [rax + 0x11a], cl
mov rax, qword [rbp + 8]
mov byte [rax + 0x11b], 0
call fcn.140256850
nop
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0xc8]
test eax, eax
je 0x1402565b1
mov dword [rbp + 0x164], 0xffffffff
jmp 0x1402565bc
call fcn.1400e6a54
mov dword [rbp + 0x164], eax
mov eax, dword [rbp + 0x164]
mov dword [rbp + 0x74], eax
mov eax, dword [rbp + 0x74]
cmp dword [0x14030a7a4], eax
je 0x1402565df
mov eax, dword [rbp + 0x74]
mov dword [0x14030a7a4], eax
call fcn.1402566d0
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x1402d99f0]
call fcn.1400e76b1
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.1400e66b7
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret