joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a670
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a6b5
xor al, al
jmp 0x14000a702
cmp word [rbx], 0
je 0x14000a6cd
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a6c0
cmp word [rsp + 0x30], 0
je 0x14000a6fb
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a723
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a6e0
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000c510
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000fccc
int3
Function at 0x14000cdd0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000ce1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ce1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ce1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ce1a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ce1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000ce1c
xor al, al
add rsp, 0x28
ret

Function at 0x14000fad8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fb47
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fb47
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fb47
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fb47
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fb47
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fb47
cmp dword [rcx + 0xf8], 0
je 0x14000fb47
mov ecx, ebx
call fcn.14000fbec
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000f9e0
nop
cmp dword [rbp + 0x20], 0
jne 0x14000fba8
call fcn.1400147bc
cmp eax, 1
jne 0x14000fb98
xor dl, dl
jmp 0x14000fba2
call fcn.140014788
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x14000fbb3
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000fbbc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000fad8

Function at 0x14000fcc0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fb47
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fb47
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fb47
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fb47
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fb47
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fb47
cmp dword [rcx + 0xf8], 0
je 0x14000fb47
mov ecx, ebx
call fcn.14000fbec
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000f9e0
nop
cmp dword [rbp + 0x20], 0
jne 0x14000fba8
call fcn.1400147bc
cmp eax, 1
jne 0x14000fb98
xor dl, dl
jmp 0x14000fba2
call fcn.140014788
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x14000fbb3
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000fbbc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000fad8
Function at 0x1400194b8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001953f
mov rsi, rbx
cmp word [rax], bp
je 0x1400194fe
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400194e8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400194e4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400169f0
mov rdi, rax
test rax, rax
je 0x14001952c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400206d0
mov rbp, rdi
xor ecx, ecx
call fcn.1400159d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001ba60
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001ba76
mov al, 1
jmp 0x14001bae2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001ba87
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001bae0
mov ecx, dword [rcx + 0x18]
nop
call fcn.140019c5c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001bae0
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001bae0
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001bae0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001bae2
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001ff20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001ff48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001ff48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140131000
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
add byte [rax], al
add byte [rcx - 0x6b], cl
cmp dword [rax + 0xb], 0
add byte [rbp + 0xd8bbbf], cl
add bh, bh
loopne 0x14013180f
mov al, byte [rsi - 0xfffff5]
rol byte [rcx + 0x58], 1
rcr r10d, 0x85
lea ebp, [rdi - 0xdcf4]
cmp r9d, 0x6929035d
syscall
movabs rdi, 0x36d30b1e4ce014eb
jmp rax
or al, 0x23
invalid

Function at 0x140131b8e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rsp + 0x48]
add r10, 0x40269a
jmp 0x140131abc

Function at 0x140132b20
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
cmp ebx, 0x41ae6fd9
cmp rdx, rbp
jmp 0x14013302f
cmp edx, 0xcdb0e89b
rcl r8d, 0x66
lea r11d, [rcx - 0xcb76]
and ebx, 0xe61bdeb8
je 0x140132d3f
jne 0x140132d3f
popf
jp 0x140133954
rcr r9d, 0x9e
jmp 0x14013301b
jmp rcx
test r14d, 0x4f4210e7
or r15d, 0xf972961
or esi, 0x5ab25c78
je 0x14013305e
jne 0x14013305e
neg r13
rcr r12d, 0xd4
inc r12
ror ecx, 0xc1
rol r13d, 0xde
jmp rcx
jmp 0x140132d0a
ror byte [rax - 0x73], 0x49
add dword [rbx], esi
ret 0xa2e9
Function at 0x14013376e
Capabilities:
Get number of processors

Disassembly:
rcl eax, 0xa1
loopne 0x1401337d6
popfq
movabs rdi, 0xd5264f405f920eb
test r10, rdi
rcr r11d, 0x5b
je 0x14013340f
call rcx
add edi, 0x5207dd10
call fcn.140132fb0
scasd eax, dword [rdi]
lea ecx, [rdi]
Function at 0x140001670
Capabilities:
Execute command
Set console window title

Disassembly:
sub rsp, 0x28
lea rcx, str.BlackHack_PVE_Free
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xc
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._INFO________Initiating_Update_Download_Sequence...
call fcn.140001710
mov rcx, rax
lea rdx, [0x1400018f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001000
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._INFO__Injecting...
call fcn.140001710
mov rcx, rax
lea rdx, [0x1400018f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140001240
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 1
add rsp, 0x28
ret

Function at 0x1400024c8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002512
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002512
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002512
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002512
cmp dword [rcx + 0x84], 0xe
jbe 0x140002512
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002514
xor al, al
add rsp, 0x28
ret
Function at 0x14000b530
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1401b72c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [0x1401c2c8e]
test eax, eax
jne 0x14000b56c
mov rcx, qword [rsp + 0xa0]
call fcn.14000b760
nop
jmp 0x14000b745
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1401c2d50], eax
jle 0x14000b5b9
lea rcx, [0x1401c2d50]
call fcn.140177208
cmp dword [0x1401c2d50], 0xffffffff
jne 0x14000b5b9
lea rcx, [0x1401c2cb0]
call fcn.140006f30
nop
lea rcx, [0x1401c2d50]
call fcn.14017719c
nop
mov rax, qword [rsp + 0xa0]
mov ecx, dword [reloc.WS2_32.dll_accept]
cmp dword [rax + 0xc0], ecx
jbe 0x14000b71b
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xa0]
add rax, 0xc4
mov qword [rsp + 0x38], rax
vmovss xmm2, dword [0x14019e520]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
call fcn.14000ac60
mov r8, qword [rax]
lea rdx, [rsp + 0x50]
lea rcx, [0x1401c2cb0]
call fcn.14000ac10
mov r8, qword [rax]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
call fcn.14000abc0
mov r8, qword [rax]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x70]
call fcn.14000ac10
nop
mov rax, qword [rsp + 0xa0]
vmovss xmm0, dword [rax + 0x118]
vmulss xmm0, xmm0, dword [0x14019e238]
vmovss xmm1, dword [rsp + 0x7c]
vdivss xmm0, xmm1, xmm0
vmulss xmm0, xmm0, dword [0x1401c33a0]
vcvttss2si eax, xmm0
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0xa0]
vmovss xmm0, dword [rax + 0x118]
vmulss xmm0, xmm0, dword [0x14019e238]
vmovss xmm1, dword [rsp + 0x78]
vdivss xmm0, xmm1, xmm0
vmulss xmm0, xmm0, dword [0x1401c33a4]
vcvttss2si eax, xmm0
mov dword [rsp + 0x30], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14000b6e5
mov eax, dword [rsp + 0x30]
neg eax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
mov edx, dword [rsp + 0x34]
mov ecx, 1
call qword [sym.imp.USER32.dll_mouse_event]
nop
mov rax, qword [rsp + 0xa0]
add rax, 0xc4
mov qword [rsp + 0x40], rax
vmovss xmm2, dword [0x14019e520]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call fcn.14000ac60
mov rax, qword [rax]
mov qword [0x1401c2cb0], rax
jmp 0x14000b737
vxorps xmm2, xmm2, xmm2
vxorps xmm1, xmm1, xmm1
lea rcx, [rsp + 0x68]
call fcn.14000a900
mov rax, qword [rax]
mov qword [0x1401c2cb0], rax
mov rcx, qword [rsp + 0xa0]
call fcn.14000b760
nop
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140177140
add rsp, 0x98
ret
Function at 0x140022d00
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.140023400
nop
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x1400278f0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x140027913
mov rcx, qword [rsp + 0x40]
call fcn.1400279d0
nop
jmp 0x14002792b
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x14002792b
mov rcx, qword [rsp + 0x40]
call fcn.140027a80
nop
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x1400279d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x1400279f1
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x140027a75
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x140027a40
mov dword [rsp + 4], 0x9908b0df
jmp 0x140027a48
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1400279e4
add rsp, 0x18
ret
Function at 0x140027a80
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x140027ab0
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x140027b32
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x140027afe
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x140027b06
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140027aa5
mov qword [rsp + 8], 0xe3
jmp 0x140027b4a
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x140027bd1
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x140027b9b
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x140027ba3
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140027b3d
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x140027c25
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x140027c2d
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x14002a880
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
vmovss dword [rsp + 0x20], xmm3
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14002a8b6
mov rax, qword [rsp + 0x38]
mov byte [rax], 1
jmp 0x14002a91b
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
test eax, eax
je 0x14002a91b
xor edx, edx
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov r8d, 8
movzx edx, al
movzx ecx, byte [rsp + 0x40]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov r8d, 2
movzx edx, al
movzx ecx, byte [rsp + 0x40]
call qword [sym.imp.USER32.dll_keybd_event]
mov rax, qword [rsp + 0x38]
mov byte [rax], 0
add rsp, 0x28
ret
Function at 0x14002c0b0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
movzx eax, byte [0x1401c2d8c]
test eax, eax
jne 0x14002c0c4
jmp 0x14002c172
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14002c0de
jmp 0x14002c172
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14002c0f5
jmp 0x14002c172
vmovss xmm3, dword [0x14019e630]
mov r8d, 0x44
lea rdx, [0x1401c229e]
mov ecx, 0x41
call fcn.14002a880
vmovss xmm3, dword [0x14019e630]
mov r8d, 0x41
lea rdx, [0x1401c22a0]
mov ecx, 0x44
call fcn.14002a880
vmovss xmm3, dword [0x14019e630]
mov r8d, 0x53
lea rdx, [0x1401c229f]
mov ecx, 0x57
call fcn.14002a880
vmovss xmm3, dword [0x14019e630]
mov r8d, 0x57
lea rdx, [0x1401c229d]
mov ecx, 0x53
call fcn.14002a880
nop
add rsp, 0x28
ret

Function at 0x14002c7a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x1401b72c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, byte [0x1401c2d7c]
test eax, eax
jne 0x14002c7c8
jmp 0x14002c89e
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14002c7df
mov byte [rsp + 0x21], 1
jmp 0x14002c7e4
mov byte [rsp + 0x21], 0
movzx eax, byte [rsp + 0x21]
mov byte [rsp + 0x20], al
mov rcx, qword [rsp + 0x50]
call fcn.14000c980
mov byte [rsp + 0x22], al
lea rdx, [rsp + 0x30]
lea rcx, [0x1401c3210]
call fcn.140032e10
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14002c853
movzx eax, byte [rsp + 0x22]
test eax, eax
je 0x14002c853
mov dword [rsp + 0x24], reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x28]
call fcn.14001fb30
mov rcx, rax
call fcn.14001fb50
nop
mov edx, 0x10001
lea rcx, [0x1401c3210]
call fcn.140032dd0
nop
jmp 0x14002c89e
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14002c879
movzx eax, byte [rsp + 0x22]
test eax, eax
jne 0x14002c879
mov edx, 0x100
lea rcx, [0x1401c3210]
call fcn.140032dd0
nop
jmp 0x14002c89e
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14002c89e
cmp dword [rsp + 0x30], 0x10001
jne 0x14002c89e
mov edx, 0x100
lea rcx, [0x1401c3210]
call fcn.140032dd0
nop
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140177140
add rsp, 0x48
ret
Function at 0x140032810
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x4d0
lea rbp, [rsp + 0x20]
mov rax, qword [0x1401b72c0]
xor rax, rbp
mov qword [rbp + 0x4a0], rax
mov dword [rbp + 0x60], 0x438
mov rax, qword [rbp + 0x4c0]
mov edx, dword [rax + 0x10]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
call fcn.140032770
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x90]
mov qword [rbp + 0x20], rax
cmp qword [rbp + 0x20], 0
jne 0x14003288d
mov qword [rbp + 0x30], 0
jmp 0x14003292b
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 8]
cmp word [rax + rcx*2], 0
jne 0x14003289d
mov rax, qword [rbp + 8]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x1400328cc
mov qword [rbp + 0x28], 0
jmp 0x140032923
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x40], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x1400328f4
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.140177d20
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x40]
mov r8d, ecx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call fcn.140032780
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x30], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.14001dea0
mov rcx, qword [rbp + 0x30]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x140032951
inc rcx
test dl, dl
jne 0x14003293e
xor eax, eax
jmp 0x140032956
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140032982
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.140007910
mov rax, qword [rbp + 0x48]
jmp 0x1400329bb
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x14003286e
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov qword [rbp + 0x50], 0
mov rcx, qword [rbp + 0x4c8]
call fcn.140007910
mov rax, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x4a0]
xor rcx, rbp
call fcn.140177140
lea rsp, [rbp + 0x4b0]
pop rbp
ret