joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140062e98
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, dword [rcx + 0x44]
mov rbx, rcx
mov edx, dword [rbx + 0x94]
mov esi, dword [rbx + 0x58]
sub esi, dword [rbx + 0x9c]
mov ecx, dword [rbx + 0x44]
sub esi, edx
add ecx, 0xfffffefa
add ecx, edi
cmp edx, ecx
jb 0x140062f4d
mov rcx, qword [rbx + 0x50]
mov r8, rdi
lea rdx, [rcx + rdi]
call fcn.1400b1820
mov r9d, dword [rbx + 0x74]
mov rax, qword [rbx + 0x68]
sub dword [rbx + 0x98], edi
sub dword [rbx + 0x94], edi
sub dword [rbx + 0x84], edi
lea r8, [rax + r9*2]
xor eax, eax
lea r8, [r8 - 2]
movzx edx, word [r8]
movzx ecx, dx
sub cx, di
cmp edx, edi
cmovae ax, cx
mov word [r8], ax
add r9d, 0xffffffff
jne 0x140062f00
mov rax, qword [rbx + 0x60]
mov r9d, edi
lea r8, [rax + rdi*2]
xor eax, eax
lea r8, [r8 - 2]
movzx edx, word [r8]
movzx ecx, dx
sub cx, di
cmp edx, edi
cmovae ax, cx
mov word [r8], ax
add r9d, 0xffffffff
jne 0x140062f2b
add esi, edi
mov rcx, qword [rbx]
cmp dword [rcx + 8], 0
je 0x14006303a
mov edx, dword [rbx + 0x9c]
mov r8d, esi
mov eax, dword [rbx + 0x94]
add rdx, rax
add rdx, qword [rbx + 0x50]
call fcn.140062b94
add dword [rbx + 0x9c], eax
mov r9d, dword [rbx + 0x9c]
cmp r9d, 3
jb 0x140062fb5
mov eax, dword [rbx + 0x94]
mov rdx, qword [rbx + 0x50]
mov ecx, dword [rbx + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rbx + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rbx + 0x7c]
mov dword [rbx + 0x70], r8d
cmp r9d, 0x106
jae 0x140062fcb
mov rax, qword [rbx]
cmp dword [rax + 8], 0
jne 0x140062eb2
mov ecx, dword [rbx + 0x1718]
mov esi, dword [rbx + 0x58]
cmp ecx, esi
jae 0x14006303a
mov edi, dword [rbx + 0x94]
add edi, r9d
cmp ecx, edi
jae 0x14006300c
sub esi, edi
mov ecx, edi
mov eax, 0x102
cmp esi, eax
cmova esi, eax
add rcx, qword [rbx + 0x50]
mov r8d, esi
xor edx, edx
call fcn.1400b1c70
lea eax, [rsi + rdi]
mov dword [rbx + 0x1718], eax
jmp 0x14006303a
lea eax, [rdi + 0x102]
cmp ecx, eax
jae 0x14006303a
sub edi, ecx
sub esi, ecx
mov eax, 0x102
add edi, eax
cmp edi, esi
cmova edi, esi
add rcx, qword [rbx + 0x50]
mov r8d, edi
xor edx, edx
call fcn.1400b1c70
add dword [rbx + 0x1718], edi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140066f50
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rdi, rcx
mov rax, qword [0x140174018]
mov qword [rcx], rax
lea rbx, [rcx + 0x20]
mov qword [rsp + 0x78], rbx
and qword [rbx], 0
and qword [rbx + 8], 0
mov rcx, rbx
call fcn.1400674d4
mov qword [rbx], rax
and qword [rdi + 0x18], 0
and qword [rdi + 8], 0
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
mov dword [rdi + 0x10], eax
mov rax, rdi
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x1400671c0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov r9d, edx
mov rsi, rcx
mov eax, r9d
xor edx, edx
div dword [rcx + 0x10]
mov rcx, qword [rcx + 8]
add r8d, edx
mov ebx, edx
mov qword [rsp + 0x20], r8
sub r9d, edx
xor r8d, r8d
lea edx, [r8 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
add rbx, rax
lea rcx, [rsi + 0x20]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
mov rdi, rax
call fcn.140066ea0
mov rcx, qword [rsp + 0x30]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov qword [rcx + 0x28], rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140068524
Capabilities:
Create directory
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [r11 - 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rsi, rcx
mov rax, qword [0x140174018]
mov qword [r11 + 0x10], rax
mov rcx, qword [rcx]
or ebp, 0xffffffff
cmp dword [rcx - 8], 0
jle 0x140068565
lea edx, [rbp + 0x3b]
call fcn.1400b2680
test rax, rax
jne 0x140068569
mov eax, ebp
jmp 0x14006856f
sub rax, qword [rsi]
sar rax, 1
lea edi, [rax + 2]
test eax, eax
cmovs edi, eax
mov rcx, qword [rsi]
test edi, edi
js 0x1400685a8
cmp edi, dword [rcx - 8]
jge 0x1400685a8
movsxd rax, edi
lea rcx, [rcx + rax*2]
mov edx, VarDateFromDisp
call fcn.1400b2680
mov rdi, rax
test rax, rax
jne 0x1400685a0
mov edi, ebp
jmp 0x1400685ae
sub rdi, qword [rsi]
sar rdi, 1
jmp 0x1400685aa
mov edi, ebp
test edi, edi
jns 0x1400685bd
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.140067f7c
jmp 0x140068608
mov r8d, edi
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.140069b8c
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140067f7c
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140174010]
je 0x140068608
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x140068608
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
call fcn.1400b0230
xor edx, edx
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140068629
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14006868f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x14006868f
cmp edi, ebp
je 0x140068641
inc edi
jmp 0x140068577
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140174010]
je 0x140068660
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x140068660
call fcn.1400b0230
nop
mov rax, qword [rsi]
add rax, 0xfffffffffffffff4
cmp rax, qword [0x140174010]
je 0x140068688
mov ecx, ebp
lock xadd dword [rax], ecx
add ecx, ebp
test ecx, ecx
jg 0x140068688
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.1400b0230
mov eax, 1
jmp 0x1400686d8
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140174010]
je 0x1400686ae
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x1400686ae
call fcn.1400b0230
nop
mov rcx, qword [rsi]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140174010]
je 0x1400686d6
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x1400686d6
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.1400b0230
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140069468
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x868
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1401740c0]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x40], rcx
and dword [rsp + 0x30], 0
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x50]
call fcn.1400b1c70
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x50]
lea r8, [0x1401202c0]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, [rsp + 0x50]
mov rcx, rbp
call fcn.140067e3c
mov dword [rsp + 0x30], 1
lea r8, [0x140120508]
lea rdx, [0x14012050c]
mov rcx, rbp
call fcn.14006a118
mov rax, rbp
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1400b0730
add rsp, 0x868
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140069e58
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov rdi, r9
mov rax, r8
mov rbx, rdx
test r9, r9
je 0x140069f12
mov rcx, qword [rcx]
xor r8d, r8d
mov qword [r11 - 0x10], r9
lea r9, [r11 + 0x20]
mov qword [r11 - 0x18], rdx
mov rdx, rax
mov dword [rsp + 0x58], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, eax
test eax, eax
jne 0x140069f00
test rbx, rbx
je 0x140069f00
cmp dword [rdi], esi
jbe 0x140069efd
mov ecx, dword [rsp + 0x58]
test ecx, ecx
je 0x140069ef3
cmp ecx, 2
jbe 0x140069ee2
cmp ecx, 7
jne 0x140069ef3
test byte [rdi], 1
jne 0x140069ef3
mov eax, dword [rdi]
shr eax, 1
cmp eax, 1
jb 0x140069ef3
mov ecx, dword [rdi]
shr rcx, 1
cmp word [rbx + rcx*2 - 2], si
jne 0x140069ef3
cmp eax, 1
jbe 0x140069f00
cmp word [rbx + rcx*2 - 4], si
jmp 0x140069ef1
test byte [rdi], 1
jne 0x140069ef3
mov eax, dword [rdi]
shr rax, 1
cmp word [rbx + rax*2 - 2], si
je 0x140069f00
mov word [rbx], si
mov eax, ntohs
jmp 0x140069f02
mov word [rbx], si
mov eax, edx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x80004005
call fcn.1400671a4
int3
Function at 0x1400714e8
Capabilities:
Get file size

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov r14, rcx
xor esi, esi
mov rax, qword [0x140174018]
mov qword [r11 + 0x18], rax
xor edi, edi
cmp dword [rcx + 0xf0], edi
jle 0x1400715d4
mov edx, edi
mov rcx, r14
call fcn.140072304
lea rcx, [rax + 8]
xor edx, edx
call fcn.140069064
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140067e3c
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rbx, qword [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14007159f
lea rdx, [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rbp
test eax, eax
je 0x140071599
add rsi, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140174010]
je 0x1400715bd
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x1400715bd
call fcn.1400b0230
inc edi
cmp edi, dword [r14 + 0xf0]
jl 0x14007151b
mov rax, qword [rsp + 0x90]
lea rcx, [rax - 0xc]
cmp rcx, qword [0x140174010]
je 0x1400715f2
or edx, 0xffffffff
lock xadd dword [rcx], edx
sub edx, 1
jg 0x1400715f2
call fcn.1400b0230
mov rax, rsi
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400721ec
Capabilities:
Get file size
Get file system object information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x320
mov rax, qword [0x1401740c0]
xor rax, rsp
mov qword [rsp + 0x310], rax
and qword [rdx], 0
mov rsi, rcx
lea rcx, str.Unknown
mov rdi, r9
mov rbp, r8
mov r14, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, str.Unknown
mov rcx, rbp
mov edx, eax
call fcn.1400670f0
and qword [rdi], 0
xor r9d, r9d
and qword [rsp + 0x30], 0
mov edx, 0x80000000
and dword [rsp + 0x28], 0
mov rcx, qword [rsi + 8]
lea r8d, [r9 + 1]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140072274
xor eax, eax
jmp 0x1400722e3
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14007228e
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov rcx, qword [rsi + 8]
lea r8, [rsp + 0x50]
mov r9d, 0x2b8
mov dword [rsp + 0x20], 0x701
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x268]
mov qword [r14], rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [rsp + 0x268]
mov rcx, rbp
mov edx, eax
call fcn.1400670f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.1400b0730
add rsp, 0x320
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140072ae0
Capabilities:
Get file size

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [r11 - 0x30], 0xfffffffffffffffe
mov r14, rdx
xor ebp, ebp
mov rcx, qword [0x140174018]
mov qword [rsp + 0x40], rcx
mov rbx, qword [rdx + 0xe8]
mov rbx, qword [rbx]
mov rax, qword [rdx + 0xe8]
mov qword [r11 + 0x20], rax
cmp rbx, rax
je 0x140072c13
lea rcx, [rbx + 0x30]
xor edx, edx
call fcn.140069064
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.140067e3c
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rdi, qword [rsp + 0x88]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140072b9e
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rsi
test eax, eax
je 0x140072b98
add rbp, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rdi - 0xc]
cmp rcx, qword [0x140174010]
je 0x140072bbc
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x140072bbc
call fcn.1400b0230
cmp byte [rbx + 0x19], 0
jne 0x140072bf6
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x140072bda
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140072bcc
jmp 0x140072bf6
mov rax, qword [rbx + 8]
jmp 0x140072bed
cmp rbx, qword [rax + 0x10]
jne 0x140072bf3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140072be0
mov rbx, rax
mov rax, qword [r14 + 0xe8]
mov qword [rsp + 0x98], rax
cmp rbx, rax
jne 0x140072b24
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140174010]
je 0x140072c31
or edx, 0xffffffff
lock xadd dword [rcx], edx
sub edx, 1
jg 0x140072c31
call fcn.1400b0230
mov rax, rbp
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140079e74
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140079e9a
mov r8, rdx
mov rdx, qword [rbx]
call fcn.14007ee68
jmp 0x140079f01
cmp byte [0x140176388], 0
jne 0x140079ede
lea rcx, [0x1401202e8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140079ece
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140176380], rax
jmp 0x140079ed5
mov rax, qword [0x140176380]
mov byte [0x140176388], 1
jmp 0x140079ee5
mov rax, qword [0x140176380]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140079efb
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x140079f01
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14007cb6c
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
mov ebx, 1
mov ecx, dword [rcx + 0x90]
mov sil, bl
mov eax, ecx
and eax, 0xc
cmp al, 0xc
jne 0x14007cbda
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x30], rcx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
movsxd rcx, eax
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdi + 8]
mov dword [rsp + 0x40], 0xfffffffe
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rcx, qword [rdi + 8]
movsxd rbx, eax
call qword [sym.imp.USER32.dll_GetParent]
mov r8, rbx
lea r9, [rsp + 0x30]
mov edx, 0x4e
jmp 0x14007cc04
shr ecx, 2
test bl, cl
je 0x14007cc0f
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rcx, qword [rdi + 8]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetParent]
mov r9, qword [rdi + 8]
mov edx, VarUI4FromDisp
movzx r8d, bx
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14007cc52
mov r8, qword [rdi + 0x50]
lea rdx, str.open
mov dword [rsp + 0x28], ebx
xor r9d, r9d
and qword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
seta sil
test sil, sil
je 0x14007cc52
or byte [rdi + 0x94], 2
mov r8d, ebx
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rbx, qword [rsp + 0x60]
mov al, sil
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x14007d130
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401740c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0x80]
mov rbx, rcx
mov rcx, qword [rcx + 8]
xor r8d, r8d
movsx eax, r9w
mov edx, 0x1012
mov dword [rsp + 0x20], eax
shr r9, 0x10
movsx eax, r9w
lea r9, [r11 - 0x30]
mov dword [rsp + 0x24], eax
xor eax, eax
mov qword [r11 - 0x2c], rax
mov qword [r11 - 0x24], rax
mov rax, qword [r11 - 0x38]
mov qword [r11 - 0x30], rax
call qword [sym.imp.USER32.dll_SendMessageW]
xor esi, esi
cmp eax, 0xffffffff
je 0x14007d1be
cmp dword [rsp + 0x30], 8
jne 0x14007d1be
lea ecx, [rsi + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14007d1be
mov edx, dword [rsp + 0x34]
mov rcx, rbx
call fcn.140079710
mov dword [rdi], esi
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b0730
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14007daf4
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov r10, r9
mov rdi, rcx
cmp dword [rsp + 0x70], ebp
jne 0x14007dbf2
lea esi, [rbp + 1]
cmp r8d, esi
jne 0x14007db64
mov rdx, qword [rsp + 0x60]
mov r8d, esi
mov qword [rax - 0x18], rdx
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_CallWindowProcW]
mov rcx, qword [rdi + 8]
lea r9d, [rbp + 0x24]
xor r8d, r8d
mov edx, 0x1036
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rbx
mov eax, esi
jmp 0x14007dbf4
mov edx, 0x201
cmp r8d, edx
jne 0x14007db99
mov r9, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
mov r8, r10
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], esi
call fcn.14007d130
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
cmp dword [rsp + 0x70], ebp
je 0x14007dbf2
jmp 0x14007db5d
mov edx, 0x203
cmp r8d, edx
je 0x14007db6e
cmp r8d, 0x100
jne 0x14007dbf2
cmp r10, 0x20
jne 0x14007dbea
mov rcx, qword [rcx + 8]
mov r9, rsi
or r8, 0xffffffffffffffff
mov edx, 0x100c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
cmp eax, 0xffffffff
je 0x14007dbea
mov ecx, send
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14007dbea
mov edx, ebx
mov rcx, rdi
call fcn.140079710
mov rax, qword [rsp + 0x68]
mov qword [rax], rsi
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14007ee68
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14007eecb
lea rcx, [0x1401202e8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007eedf
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007eedf
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x14007eee4
cmp dword [rcx + 8], 0
je 0x14007eedf
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14007eee4
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14007f060
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1401740c0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x70], rdi
xor edx, edx
lea r8d, [rdi + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14007f0ed
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14007f0ed
call fcn.1400790f4
mov ebx, eax
jmp 0x14007f1fe
mov r8, r15
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14007f10e
call fcn.1400790f4
jmp 0x14007f1ed
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14007f104
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14007f149
mov ebx, 0x8007000e
jmp 0x14007f1ef
mov ecx, eax
test eax, eax
je 0x14007f181
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14007f177
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14007f181
lea rcx, [rsp + 0x70]
call fcn.140078e4c
jmp 0x14007f18b
mov ecx, 0x80070216
call fcn.1400671a4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x14007f19d
cmp qword [rsp + 0x70], rdi
je 0x14007f13f
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14007f104
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], di
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14007eef4
mov ebx, eax
test rsi, rsi
je 0x14007f1fe
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14007f215
lea rcx, [rsp + 0x70]
call fcn.14007c44c
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1400b0730
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140080138
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov rdi, r8
mov rbp, rdx
mov r14, rcx
test r8, r8
jne 0x140080166
lea eax, [rbx + 0xd]
jmp 0x14008019b
mov rsi, rdi
mov rcx, rsi
call fcn.1400bdb3c
inc eax
lea rsi, [rsi + rax*2]
lea ebx, [rbx + rax*2]
cmp eax, 1
jne 0x140080169
mov rcx, qword [r14]
lea r9d, [rax + 6]
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14008194c
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1401740c0]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x20], VarUI4FromDisp
mov r8d, VarUI4FromDisp
lea rcx, [rsp + 0x24]
call fcn.1400b1c70
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
test eax, eax
je 0x1400819a5
cmp dword [rsp + 0x24], 5
jae 0x1400819aa
cmp dword [rsp + 0x24], 4
jne 0x1400819a5
cmp dword [rsp + 0x28], 0x5a
jae 0x1400819aa
mov ecx, 1
mov al, cl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400b0730
add rsp, 0x158
ret

Function at 0x140082be8
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, dword [r8 + 0x18]
mov rdi, rcx
call fcn.14008f814
mov rcx, rax
call fcn.14008f674
test ebx, ebx
js 0x140082cb7
mov edx, dword [rdi + 0x5e0]
mov rcx, rax
call fcn.140072980
mov rcx, rax
mov edx, ebx
call fcn.140072304
test rax, rax
je 0x140082cb7
mov rbx, qword [rax + 8]
cmp dword [rbx - 0xc], 0
jl 0x140082c44
mov qword [rsp + 0x50], rbx
lock inc dword [rbx - 0xc]
jmp 0x140082c71
mov rax, qword [0x140174018]
mov qword [rsp + 0x50], rax
test rbx, rbx
jne 0x140082c59
xor eax, eax
jmp 0x140082c62
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
lea rcx, [rsp + 0x50]
mov edx, eax
call fcn.1400670f0
mov rbx, qword [rsp + 0x50]
lea rdx, str.open
mov r8, rbx
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140174010]
je 0x140082cb7
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x140082cb7
call fcn.1400b0230
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret