joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, rdx
mov rsi, r8
mov rdi, rcx
lea rdx, str._AUTOHOTKEY_SCRIPT_
mov r8d, 0xa
xor ecx, ecx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov byte [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140020948
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x28], eax
test eax, eax
je 0x140020948
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140020948
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140020948
mov ecx, 0x58
call fcn.1400cb000
test rax, rax
je 0x1400208ee
mov rcx, rax
call fcn.14001e4e0
mov rbx, rax
jmp 0x1400208f0
xor ebx, ebx
mov dword [rsp + 0x58], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov rax, qword [rbx]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov qword [rbp], rbx
mov dword [rbx + 0xc], 0
call qword [rax + VariantCopy]
test al, al
je 0x14002092d
lea rdx, [rsp + 0x58]
mov r8d, 0xfde9
mov rcx, rbx
call fcn.1400a9e10
mov rax, qword [rdi + 0xb80]
inc dword [0x1401183e8]
mov qword [0x140117640], rax
mov eax, 3
jmp 0x14002095a
lea rdx, str.Could_not_extract_script_from_EXE.
mov r8, rsi
mov rcx, rdi
call fcn.140040520
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x140005570]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x140005580]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call sym._amsg_exit
jmp 0x14000123c
mov rax, qword [0x140005580]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x140005580]
mov dword [rax], 1
mov rax, qword [0x1400055c0]
mov rdx, rax
mov rax, qword [0x1400055b0]
mov rcx, rax
call sym._initterm
jmp 0x14000123c
mov dword [0x140009024], 1
mov rax, qword [0x140005580]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x1400055a0]
mov rdx, rax
mov rax, qword [0x140005590]
mov rcx, rax
call sym._initterm
mov rax, qword [0x140005580]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x140005570]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x1400054d0]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x1400054d0]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call sym._pei386_runtime_relocator
mov rax, qword [sym._gnu_exception_handler]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x140005560]
mov qword [rdx], rax
lea rax, [sym.__mingw_invalidParameterHandler]
mov rcx, rax
call sym._set_invalid_parameter_handler
call sym._fpreset
mov eax, dword [0x140009004]
lea rdx, [0x140009008]
mov ecx, eax
call sym.duplicate_ppstrings
call sym.__main
mov rax, qword [0x1400054f0]
mov rax, qword [rax]
mov rdx, qword [0x140009010]
mov qword [rax], rdx
mov rcx, qword [0x140009010]
mov rdx, qword [0x140009008]
mov eax, dword [0x140009004]
mov r8, rcx
mov ecx, eax
call sym.wmain
mov dword [0x14000901c], eax
mov eax, dword [0x140009020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x14000901c]
mov ecx, eax
call sym.exit
mov eax, dword [0x140009024]
test eax, eax
jne 0x14000136c
call sym._cexit
mov eax, dword [0x14000901c]
add rsp, 0x70
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140005520]
mov dword [rax], 1
mov rax, qword [0x140005530]
mov dword [rax], 1
mov rax, qword [0x140005540]
mov dword [rax], 1
mov rax, qword [0x1400054a0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400016d0
Capabilities:
Hide graphical window

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400018a0
Capabilities:
Hide graphical window

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xe0
mov qword [rbp + 0x10], rcx
movabs rax, 0x74007300750043
movabs rdx, 0x73004d006d006f
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
movabs rax, 0x670073004d006d
movabs rdx, 0x78006f0042
mov qword [rbp - 0x26], rax
mov qword [rbp - 0x1e], rdx
pxor xmm0, xmm0
movaps xmmword [rbp - 0x80], xmm0
movaps xmmword [rbp - 0x70], xmm0
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x50], xmm0
movq qword [rbp - 0x40], xmm0
lea rax, [sym.CustomMsgBoxProc_HWND____unsigned_int__unsigned_long_long__long_long_]
mov qword [rbp - 0x78], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x68], rax
lea rax, [rbp - 0x30]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x50], 6
lea rax, [rbp - 0x80]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_RegisterClassW]
call rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x58], 0
mov rdx, qword [rbp + 0x10]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x96
mov dword [rsp + 0x30], 0xf0
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0xc80000
lea r8, [0x1400050c8]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_CreateWindowExW]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov edx, 5
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
nop
add rsp, 0xe0
pop rbp
ret
Function at 0x1400020f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140002dc2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140009168]
test eax, eax
je 0x140002e5a
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140009170]
mov qword [rbp - 8], rax
jmp 0x140002e3e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140002e32
cmp qword [rbp - 0x10], 0
je 0x140002e32
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002df8
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140002e5b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140002f60
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140002f88
mov eax, 0
jmp 0x140002fd6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140002fb1
mov eax, 0
jmp 0x140002fd6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140002fd1
mov eax, 0
jmp 0x140002fd6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x140002fdc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14000305a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140003051
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140003051
mov rax, qword [rbp - 8]
jmp 0x14000306f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140003024
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140089d4b
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
push r15
mov rax, 8
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140089d55
sub rsp, 0x28
call fcn.1400f55c0
mov byte [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push 0x28
sub rsp, 0x20
call fcn.14008b04e
add rsp, 0x20
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call fcn.14008b252
and rax, rax
je 0x140089e68
lea rax, [rsp + 0x38]
lea rax, [rsp + 0x38]
mov rax, rax
push rax
movabs rax, 0x1401b49fa
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.14008b258
and rax, rax
je 0x140089e5e
lea rax, [rsp + 0x40]
lea rbp, [rsp + 0x40]
mov dword [rbp], 1
lea rbp, [rsp + 0x38]
movsxd rax, dword [rbp]
push rax
lea rbp, [rsp + 0x48]
push rbp
pop rbp
pop rax
mov dword [rbp + 4], eax
lea rbp, [rsp + 0x38]
movsxd rax, dword [rbp + 4]
push rax
lea rbp, [rsp + 0x48]
push rbp
pop rbp
pop rax
mov dword [rbp + 8], eax
push rbp
pop rbp
mov dword [rbp + 0xc], 2
lea rax, [rsp + 0x60]
mov rax, rax
push rax
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push 0x10
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push 0
push qword [rsp + 0x58]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14008b25e
add rsp, 0x30
mov rax, rax
push rax
pop rax
mov byte [rsp + 0x28], al
push qword [rsp + 0x30]
pop rcx
call fcn.14008b048
movsx rax, byte [rsp + 0x28]
movsx rax, al
jmp 0x140089e77
add rsp, 0x68
pop r15
pop rbp
ret
Function at 0x1400e3218
Capabilities:
Hash data using sha384

Disassembly:
and qword [rcx + 0x80], 0
mov dword [rcx + 0xc8], 0x30
lea rdx, [0x14018def0]
add rcx, 0x88
mov r8d, 0x40
jmp fcn.14008b348

Function at 0x1400e3360
Capabilities:
Hash data using sha512

Disassembly:
and qword [rcx + 0x80], 0
mov r8d, 0x40
lea rdx, [0x14018deb0]
mov dword [rcx + 0xc8], r8d
add rcx, 0x88
jmp fcn.14008b348
Function at 0x1400e5494
Capabilities:
Hash data using sha256

Disassembly:
and qword [rcx + 0x40], 0
mov r8d, 0x20
lea rdx, [0x14018e030]
mov dword [rcx + 0x68], r8d
add rcx, 0x48
jmp fcn.14008b348
Function at 0x1400e8700
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov rdi, rdx
mov rax, r9
mov r12, r9
cqo
mov rbx, r8
mov r13, rcx
and edx, 0xf
add rax, rdx
mov rbp, rax
and eax, 0xf
sub rax, rdx
sar rbp, 4
mov rsi, rax
test rax, rax
je 0x1400e874b
test rbp, rbp
jne 0x1400e8748
xor eax, eax
jmp 0x1400e8929
dec rbp
mov qword [rsp + 0x80], r14
mov r14, qword [rsp + 0xa0]
movups xmm0, xmmword [r14]
movups xmm1, xmm0
movups xmmword [rsp + 0x20], xmm0
test rbp, rbp
je 0x1400e87d2
mov qword [rsp + 0x88], r15
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [r13 + 4]
lea rcx, [r13 + 0xf8]
mov r9, rbx
mov r8, rdi
call fcn.1400e7390
mov eax, dword [rsp + 0x20]
add rdi, 0x10
xor dword [rbx], eax
mov eax, dword [rsp + 0x24]
add rbx, 0x10
xor dword [rbx - 0xc], eax
mov eax, dword [rsp + 0x28]
xor dword [rbx - 8], eax
mov eax, dword [rsp + 0x2c]
xor dword [rbx - 4], eax
movups xmm0, xmmword [rdi - 0x10]
movups xmm1, xmm0
movups xmmword [rsp + 0x20], xmm0
dec rbp
jne 0x1400e8780
mov r15, qword [rsp + 0x88]
test rsi, rsi
je 0x1400e891a
movups xmm0, xmmword [rdi]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rcx, [r13 + 0xf8]
movups xmmword [r14], xmm0
mov edx, dword [r13 + 4]
movups xmmword [rsp + 0x40], xmm0
call fcn.1400e7390
xor r9d, r9d
test rsi, rsi
je 0x1400e88e5
cmp rsi, 0x10
jb 0x1400e88a9
lea r10, [rsi + 0xf]
lea rdx, [rsi + 0xf]
lea r8, [rbx + 0x10]
add r10, rdi
add rdx, rbx
lea rcx, [rdi + 0x10]
cmp r8, r10
ja 0x1400e8837
cmp rdx, rcx
jae 0x1400e88a9
lea rax, [rsp + rsi + 0x2f]
cmp r8, rax
ja 0x1400e884b
lea r8, [rsp + 0x30]
cmp rdx, r8
jae 0x1400e88a9
lea rdx, [rsp + 0x30]
cmp rdx, r10
ja 0x1400e885a
cmp rax, rcx
jae 0x1400e88a9
mov rax, rsi
mov rdx, rsi
lea r8, [rsp + 0x30]
and eax, 0xf
sub r8, rdi
sub rdx, rax
mov rax, rbx
sub rax, rdi
nop dword [rax]
nop dword [rax + rax]
movdqu xmm1, xmmword [rcx]
movdqu xmm0, xmmword [r8 + rcx - 0x10]
add r9, 0x10
lea rcx, [rcx + 0x10]
pxor xmm0, xmm1
movdqu xmmword [rax + rcx - 0x10], xmm0
movdqu xmmword [r8 + rcx - 0x20], xmm1
cmp r9, rdx
jb 0x1400e8880
cmp r9, rsi
jae 0x1400e88e5
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x30]
mov r10, rbx
sub rdi, rax
sub r10, rcx
lea r8, [rsp + 0x30]
add r8, r9
inc r9
movzx eax, byte [r8 + rdi + 0x10]
movzx edx, al
xor dl, byte [r8]
mov byte [r8], al
mov byte [r8 + r10 + 0x10], dl
cmp r9, rsi
jb 0x1400e88c1
mov edx, dword [r13 + 4]
lea r8, [rsp + 0x30]
lea rcx, [r13 + 0xf8]
mov r9, rbx
call fcn.1400e7390
mov eax, dword [rsp + 0x20]
xor dword [rbx], eax
mov eax, dword [rsp + 0x24]
xor dword [rbx + 4], eax
mov eax, dword [rsp + 0x28]
xor dword [rbx + 8], eax
mov eax, dword [rsp + 0x2c]
xor dword [rbx + 0xc], eax
jmp 0x1400e891e
movups xmmword [r14], xmm1
mov r14, qword [rsp + 0x80]
mov rax, r12
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140109030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push r15
sub rsp, 8
mov r14, rdx
mov r15, rcx
cmp r8, 5
jae 0x14010904f
xor eax, eax
add rsp, 8
pop r15
pop r14
ret
mov r9d, dword [rcx + 0x4e00]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rbp
mov ebp, dword [rcx + 0x4e04]
mov qword [rsp + 0x30], rsi
mov rsi, qword [rcx + 0x4df8]
lea rbx, [r8 - 4]
mov qword [rsp + 0x38], rdi
xor r10d, r10d
mov qword [rsp], r12
lea r12, [0x140000000]
add rbx, rdx
nop dword [rax]
lea rax, [r10 + r14]
cmp rax, rbx
jae 0x1401090b3
nop dword [rax]
movzx ecx, byte [rax]
and cl, 0xfe
cmp cl, 0xe8
je 0x1401090b3
inc rax
cmp rax, rbx
jb 0x1401090a0
mov r10, rax
sub r10, r14
cmp rax, rbx
jae 0x1401091d7
mov rcx, r10
sub rcx, rsi
cmp rcx, 3
jbe 0x1401090f0
xor r9d, r9d
movzx edx, byte [rax + 4]
mov rsi, r10
lea ecx, [rdx - 1]
cmp cl, 0xfd
ja 0x140109136
and r9d, 3
add r9d, r9d
or r9d, 1
inc r10
jmp 0x140109090
dec ecx
shl r9d, cl
and r9d, 7
je 0x1401090d1
movzx ecx, byte [r9 + r12 + 0x191158]
mov rdx, rax
sub rdx, rcx
cmp byte [r9 + r12 + 0x191150], 0
movzx ecx, byte [rdx + 4]
je 0x140109120
inc cl
test cl, 0xfe
jne 0x1401090d1
and r9d, 3
mov rsi, r10
add r9d, r9d
or r9d, 1
inc r10
jmp 0x140109090
movzx ecx, byte [rax + 3]
movzx r8d, dl
shl r8d, 8
or r8d, ecx
movzx ecx, byte [rax + 2]
shl r8d, 8
or r8d, ecx
movzx ecx, byte [rax + 1]
shl r8d, 8
or r8d, ecx
sub r8d, r10d
sub r8d, ebp
test r9d, r9d
je 0x1401091a8
movzx r11d, byte [r9 + r12 + 0x191158]
shl r11d, 3
neg r11d
nop word [rax + rax]
lea ecx, [r11 + 0x18]
mov edx, r8d
shr edx, cl
inc dl
test dl, 0xfe
jne 0x1401091a8
lea ecx, [r11 + 0x20]
mov edx, 1
shl edx, cl
dec edx
xor r8d, edx
sub r8d, r10d
sub r8d, ebp
jmp 0x140109180
mov ecx, r8d
mov byte [rax + 1], r8b
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [rax + 4], cl
mov ecx, r8d
shr ecx, 0x10
mov byte [rax + 3], cl
mov ecx, r8d
shr ecx, 8
add r10, 5
mov byte [rax + 2], cl
jmp 0x140109090
add dword [r15 + 0x4e04], r10d
mov r12, qword [rsp]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov qword [r15 + 0x4df8], rsi
mov rsi, qword [rsp + 0x30]
mov dword [r15 + 0x4e00], r9d
mov rax, r10
add rsp, 8
pop r15
pop r14
ret
Function at 0x141110510
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14111051a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x141110543
pop rbp
sub rbp, 0x33
sub rbp, 0x1110510
sub rsp, 0x20
jmp 0x141110562
mov rax, 0x1110510
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x255d4dbe
xor byte [rax], dl
inc rax
dec rcx
jne 0x141110581
jmp 0x141110598
div byte [rdi]
push rdi
xor eax, 0xbebe8237
mov esi, 0xb67f3ff6
mov edi, 0xbff6bebe
push rdi
idiv byte [rcx + 0x7e]
mov dh, 0xbe
mov esi, 0x7c79f6be
xchg esi, eax
mov esi, 0x49f6bebe
pop rsp
idiv byte [rdi - 0x4dc0ca81]
mov esi, 0xbff6bebe
push rsi
out dx, al
out dx, al
test byte [rsi], 0x4a
sub al, 0x93
mov esi, 0xbebebebe
test byte [rdi], 0xa4
int3
Function at 0x1400012d0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140024008]
jne 0x1400096d4
rol rcx, 0x10
test cx, 0xffff
jne 0x1400096d0
ret 0
ror rcx, 0x10
jmp 0x1400132b0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140028080]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140028178]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140013335
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140028080]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140013357
mov rax, qword [rsp + 0x88]
mov qword [0x140028178], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140028118], rax
mov rax, qword [0x140028178]
mov qword [0x140027ff0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140028100], rax
mov dword [0x140027fe0], 0xc0000409
mov dword [0x140027fe4], 1
mov rax, qword [0x140024008]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140024668]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14001f430]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1400014f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x140024008]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov edi, 1
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov bl, dil
mov dword [rsp + 0x30], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor r9d, r9d
cmp eax, r9d
jne 0x140001581
mov eax, dword [rsp + 0x30]
cmp eax, 0x100
ja 0x140001581
mov ecx, dword [rsp + 0x34]
cmp ecx, edi
je 0x140009e0d
cmp ecx, 3
jbe 0x140001581
cmp ecx, 5
ja 0x140009df1
cmp eax, 4
jb 0x140001581
cmp dword [rsp + 0x40], r9d
setne bl
jmp 0x140001581
mov al, bl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400012d0
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
ret
cmp ecx, 0xb
jne 0x140001581
cmp eax, 8
jb 0x140001581
cmp qword [rsp + 0x40], r9
jmp 0x14000157c
shr eax, 1
movzx ebx, r9b
mov ecx, r9d
cmove ebx, edi
cmp eax, r9d
jbe 0x140001581
lea rdx, [rsp + 0x40]
cmp r9w, word [rdx]
je 0x140009e48
mov r8d, 0x30
cmp r8w, word [rdx]
jne 0x140009e51
add ecx, edi
add rdx, 2
cmp ecx, eax
jb 0x140009e27
jmp 0x140001581
cmp ecx, r9d
jne 0x140001581
mov bl, dil
jmp 0x140001581
Function at 0x140001870
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ebx, 2
mov rsi, r8
mov r12, r9
cmp dword [rdx], ebx
mov rdi, rcx
mov eax, 0x80004005
sete r8b
cmp dword [rdx], ebx
jne 0x14000bcbe
mov rdx, rsi
call fcn.1400018f0
xor r13d, r13d
cmp eax, r13d
jl 0x1400018c2
jmp 0x1400018bf
mov eax, r13d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r15d, 1
cmp dword [rdx], r15d
jne 0x1400018c2
mov rdx, qword [rdx + 8]
xor r13d, r13d
add rcx, 0x18
mov bp, r13w
call fcn.1400115e8
lea ecx, [r15 + 0xf]
mov r14b, al
cmp word [rsi + 0x1e], cx
je 0x14000bd01
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14000bd01
mov ebp, r15d
mov ecx, 0x11
cmp word [rsi + 0x1e], cx
je 0x14000bd1f
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14000bd1f
or bp, bx
mov ecx, 0x12
cmp word [rsi + 0x1e], cx
je 0x14000bd3e
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14000bd3e
or bp, 4
mov eax, 0x5b
cmp word [rsi + 0x1e], ax
je 0x14000bd77
lea ecx, [rax + 1]
cmp word [rsi + 0x1e], cx
je 0x14000bd77
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x5b
movzx ebx, ax
call qword [sym.imp.USER32.dll_GetKeyState]
or bx, ax
mov eax, 0x8000
test ax, bx
je 0x14000bd77
or bp, 8
movzx eax, word [rsi + 0x1e]
mov ecx, 0xff
cmp ax, cx
je 0x14000bdb5
cmp dword [rsi + 0x20], 0x100
je 0x14000bd9d
cmp dword [rsi + 0x20], 0x104
je 0x14000bd9d
mov word [rdi], r13w
jmp 0x14000bdac
cmp word [rdi], ax
jne 0x14000bda9
add word [rdi + 2], r15w
jmp 0x14000bdb1
mov word [rdi], ax
mov word [rdi + 2], r15w
mov dword [r12], r15d
movzx eax, word [rsi + 0x18]
mov byte [r12 + 4], r14b
mov word [r12 + 0x12], bp
mov word [r12 + 8], ax
movzx eax, word [rsi + 0x1e]
mov word [r12 + 0xa], ax
mov eax, dword [rsi + 0x20]
mov dword [r12 + 0xc], eax
movzx eax, word [rdi + 2]
mov word [r12 + 0x10], ax
jmp 0x1400018bf