joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140040df0
Capabilities:
Get common file path

Disassembly:
mov dword [rsp + 0x18], r8d
push rbp
push r13
push r14
sub rsp, 0x50
cmp qword [rcx], 0
mov ebp, r9d
mov r13, rdx
mov r14, rcx
jne 0x140040fdf
cmp dword [rcx + 8], 0xffffffff
jne 0x140040fdf
mov qword [rsp + 0x70], rbx
lea rbx, [rcx + 0x250]
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140040e40
movzx ecx, word [r14 + rax*2 + 0x24e]
cmp cx, 0x5c
je 0x140040e78
cmp cx, 0x2f
je 0x140040e78
sub rbx, 2
cmp word [rbx + 2], 0
lea rbx, [rbx + 2]
jne 0x140040e65
mov eax, dword [0x140113a30]
mov dword [rbx], eax
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r15
cmp ebp, 1
jne 0x140040ed5
mov r9d, ebp
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x140040ee6
mov eax, 0x2000000
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop r13
pop rbp
ret
lea eax, [rbp - 2]
cmp eax, 1
jbe 0x140040ee6
mov ecx, 0x10000
mov eax, ecx
jmp 0x140040eaf
xor edi, edi
xor r12b, r12b
xor r15b, r15b
mov esi, edi
cmp ebp, 1
je 0x140040f3e
cmp ebp, 2
jne 0x140040f5c
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140040f39
mov ecx, 0x200
mov eax, ecx
jmp 0x140040eaf
mov r15b, 1
jmp 0x140040f41
mov rsi, r13
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
setne r12b
mov ecx, gethostbyname
call fcn.1400a2614
lea ecx, [rbp - 1]
mov rbx, rax
cmp ecx, 1
jbe 0x140040f90
mov word [rax], 0x100
mov byte [rax + 0x18], dil
mov qword [rax + 0x20], r13
mov eax, dword [rsp + 0x80]
mov dword [rbx + 0x28], eax
mov dword [rbx + 0x2c], edi
mov dword [rbx + 0x14], edi
jmp 0x140040fc2
mov byte [rax], 1
mov byte [rax + 0x18], r15b
mov byte [rax + 1], r12b
mov qword [rax + 8], rsi
mov byte [rax + 0x10], dil
mov dword [rax + 0x14], edi
test r12b, r12b
je 0x140040fc2
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbx + 0x14], eax
mov rcx, rbx
call fcn.14003fb10
test rax, rax
mov qword [r14], rax
mov ecx, 0x200
cmove edi, ecx
mov eax, edi
jmp 0x140040eaf
mov eax, 0x1000000
add rsp, 0x50
pop r14
pop r13
pop rbp
ret
Function at 0x140041720
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbx
push rsi
sub rsp, 0x458
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14004175d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004175d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [rsi]
test ax, ax
je 0x14004186e
mov qword [rsp + 0x480], rbp
mov rcx, rsi
mov qword [rsp + 0x450], rdi
mov rdi, rsi
nop
cmp ax, 0x2f
je 0x14004178c
cmp ax, 0x5c
jne 0x14004178f
mov rdi, rcx
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x140041780
xor ebp, ebp
cmp rdi, rsi
je 0x1400417e4
sub rdi, rsi
lea rcx, [rsp + 0x230]
sar rdi, 1
mov rdx, rsi
add rdi, rdi
mov r8, rdi
call fcn.1400a4bc0
cmp rdi, 0x208
jae 0x140041888
lea rdx, [rsp + 0x230]
mov word [rsp + rdi + 0x230], bp
mov rcx, rbx
call fcn.140041720
mov word [rsp + 0x20], bp
test rbx, rbx
je 0x140041810
lea rcx, [rsp + 0x20]
sub rcx, rbx
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x140041800
lea rcx, [rsp + 0x20]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], bp
lea rcx, [rcx + 2]
jne 0x140041820
xor edx, edx
nop dword [rax]
movzx eax, word [rsi + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140041830
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004185e
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rbp, qword [rsp + 0x480]
mov rdi, qword [rsp + 0x450]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400a24f0
add rsp, 0x458
pop rsi
pop rbx
ret
call fcn.1400a2ebc
int3
Function at 0x140043a10
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x180
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbp, r9
mov rsi, r8
mov edi, edx
mov rbx, rcx
mov r14, qword [rsp + 0x1d0]
cmp qword [rcx + 0x710], 0
je 0x140043b57
cmp edx, 0x100
jne 0x140043b37
cmp si, 0xd
jne 0x140043b37
cmp byte [rcx + 0x71a], 0
je 0x140043a91
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140043b37
cmp byte [rbx + 0x71b], 0
jne 0x140043b37
mov rdi, qword [rbx + 0x58]
test rdi, rdi
je 0x140043b33
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
xor esi, esi
mov word [rsp + 0x38], si
lea rax, [rsp + 0xc0]
mov qword [rsp + 0xb8], rax
mov word [rsp + 0xc0], si
mov qword [rsp + 0x140], rbx
lea r8d, [rsi - 1]
lea rdx, str.return
lea rcx, [rsp + 0x30]
call fcn.14000cdd0
mov qword [rsp + 0x158], rsi
mov qword [rsp + 0x160], rsi
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140016cc0
nop
lea rax, [rsp + 0xc0]
mov rcx, qword [rsp + 0xb8]
cmp rcx, rax
je 0x140043b1f
call fcn.1400a9798
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
cmp rcx, rax
je 0x140043b33
call fcn.1400a9798
xor eax, eax
jmp 0x140043b5c
mov rax, qword [rbx + 0x710]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r14
mov r9, rbp
mov r8, rsi
mov edx, edi
call qword [rax + 0x18]
jmp 0x140043b5c
mov eax, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400a24f0
add rsp, 0x180
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400489b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push r14
push r15
sub rsp, 0x20
mov rax, rdx
mov r15, r9
shr rax, 0x10
mov r14, r8
mov rbx, rdx
mov rsi, rcx
test ax, ax
je 0x1400489ff
cmp word [rdx], 0x3c
je 0x1400489ff
call fcn.140009b50
mov r8b, 1
mov rdx, rbx
lea rcx, [rax + 0x28]
call fcn.14000d690
test rax, rax
je 0x1400489ff
mov rax, qword [rax]
test rax, rax
cmovne rbx, rax
mov rax, rbx
mov qword [rsp + 0x40], rbp
shr rax, 0x10
mov qword [rsp + 0x48], rdi
test ax, ax
je 0x140048a57
cmp word [rbx], 0x3c
mov rdx, rbx
mov rcx, rsi
jne 0x140048a49
call fcn.140047950
test al, al
jne 0x140048aef
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
call fcn.140047b10
test al, al
je 0x140048a2e
jmp 0x140048aef
mov rdi, qword [rsi + 0x158]
test rdi, rdi
jne 0x140048a75
mov rdi, qword [0x140151648]
test rdi, rdi
cmove rdi, qword [0x140151638]
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140048a2e
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
jne 0x140048aab
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x140048a2e
mov rdx, rbx
mov qword [rsi + 0x148], r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8d, ebx
mov rcx, rsi
mov rdx, rax
call fcn.140047a20
test al, al
je 0x140048a2e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov qword [rsi + 0x150], r14
mov r9, qword [rsp + 0x68]
mov rdx, r15
mov r8, qword [rsp + 0x60]
mov rcx, rsi
call fcn.140048b10
jmp 0x140048a30
Function at 0x140056910
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x170
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x178], rbx
mov qword [rbp + 0x180], rsi
mov rax, qword [0x140148020]
xor rax, rbp
mov qword [rbp + 0x140], rax
mov rsi, rcx
cmp byte [rcx + 0x30], 0
je 0x140056a77
cmp qword [rcx + 0x20], 0
je 0x140056a77
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea r8d, [rax + 1]
movsxd rax, r8d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14005697f
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400a3420
sub rsp, rcx
lea rbx, [rsp + 0x20]
test rbx, rbx
je 0x140056a77
mov rdx, rbx
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rsi + 0x20]
add rcx, 0x1f8
mov r8d, 0xffffffff
mov rdx, rbx
call fcn.14000cdd0
mov rbx, qword [rsi + 0x20]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
mov rdi, rax
lea rax, [rbp + 8]
mov qword [rbp], rax
xor r14d, r14d
mov word [rbp + 8], r14w
lea rax, [rbp + 0x90]
mov qword [rbp + 0x88], rax
mov word [rbp + 0x90], r14w
mov qword [rbp + 0x110], rbx
lea r8d, [r14 - 1]
lea rdx, str.textchanged
lea rcx, [rbp]
call fcn.14000cdd0
mov qword [rbp + 0x128], r14
mov qword [rbp + 0x130], r14
xor r8d, r8d
lea rdx, [rbp]
mov rcx, rdi
call fcn.140016cc0
nop
lea rax, [rbp + 0x90]
mov rcx, qword [rbp + 0x88]
cmp rcx, rax
je 0x140056a49
call fcn.1400a9798
lea rax, [rbp + 8]
mov rcx, qword [rbp]
cmp rcx, rax
je 0x140056a5b
call fcn.1400a9798
mov rcx, qword [rsi + 0x20]
mov rax, qword [rcx]
call qword [rax + gethostname]
cmp byte [rax + 0x1e1], 0
je 0x140056a77
mov rcx, qword [rsi + 0x20]
call fcn.140020590
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rbp
call fcn.1400a24f0
mov rbx, qword [rbp + 0x178]
mov rsi, qword [rbp + 0x180]
lea rsp, [rbp + 0x150]
pop r14
pop rdi
pop rbp
ret

Function at 0x1400572d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140020370
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x200]
test al, al
jne 0x140057308
cmp qword [rbx + 0x5e0], 0
je 0x140057308
mov rcx, qword [rbx + 0x58]
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.1400163a0
add rsp, 0x20
pop rbx
ret

Function at 0x140057310
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x200]
test al, al
jne 0x140057340
cmp qword [rbx + 0x5e0], 0
je 0x140057340
mov rcx, qword [rbx + 0x58]
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.1400163a0
add rsp, 0x20
pop rbx
ret
Function at 0x14005bb50
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
sub rsp, 0x2d8
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14005bc08
xor edx, edx
lea rcx, [rsp + 0x1c0]
mov r8d, 0xff
call fcn.1400a5270
mov edx, 0xff
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x14005bc08
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov r8d, dword [rcx]
mov eax, r8d
shr eax, 8
movzx eax, al
movzx ecx, r8b
shl ecx, 8
add eax, ecx
mov ecx, r8d
shl eax, 8
shr ecx, 0x10
movzx edx, cl
add eax, edx
shr r8d, 0x18
shl eax, 8
add eax, r8d
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1400a24f0
add rsp, 0x2d8
ret
xor eax, eax
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1400a24f0
add rsp, 0x2d8
ret
Function at 0x14006e8d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r15, r8
movzx r12d, dl
mov r14, rcx
test r8, r8
je 0x14006e990
movsxd rax, dword [r8 + 0x7a8]
test eax, eax
jle 0x14006e979
xor esi, esi
mov qword [rsp + 0x50], r13
mov ebp, esi
mov r13, rax
test eax, eax
jle 0x14006e974
mov edi, esi
cmp ebp, dword [r15 + 0x7a8]
jge 0x14006e92c
mov rbx, qword [r15 + 0x7a0]
mov rbx, qword [rbx + rdi*8]
jmp 0x14006e92f
mov rbx, rsi
mov rax, qword [rbx]
movzx edx, r12b
mov rcx, rbx
call qword [rax + 0x208]
cmp dword [rbx + 0x7a8], esi
je 0x14006e96a
mov rax, qword [rbx + 0x778]
cmp byte [rax + 0xae0], sil
jne 0x14006e96a
mov rax, qword [r14]
mov r8, rbx
movzx edx, r12b
mov rcx, r14
call qword [rax + 0x478]
inc ebp
inc rdi
cmp rdi, r13
jl 0x14006e916
mov r13, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov rax, qword [rcx + 0x5a8]
add rcx, 0x5a8
call qword [rax + 0x18]
xor esi, esi
mov edi, eax
test eax, eax
jle 0x14006e979
movzx ebp, r12b
xor bpl, 1
nop dword [rax]
nop word [rax + rax]
mov r8, qword [r14 + 0x5a8]
lea rcx, [r14 + 0x5a8]
mov edx, esi
call qword [r8]
mov r8b, 1
movzx edx, bpl
mov rbx, rax
mov rcx, qword [rax + 0x778]
mov r9, qword [rcx]
call qword [r9 + 0x390]
cmp dword [rbx + 0x7a8], 0
je 0x14006ea1a
mov rcx, qword [rbx + 0x778]
cmp byte [rcx + 0xae0], 0
jne 0x14006ea1a
mov rax, qword [r14]
mov r8, rbx
movzx edx, r12b
mov rcx, r14
call qword [rax + 0x478]
inc esi
cmp esi, edi
jl 0x14006e9c0
jmp 0x14006e979

Function at 0x14007a7d0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor ecx, ecx
mov ebx, r8d
mov rsi, rdx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor edx, edx
mov ecx, ebx
mov r8, rax
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
add ebx, 0xffffffdf
mov edi, eax
cmp ebx, 0xd
ja case.0x14007a82a.41
lea rdx, [0x140000000]
mov ecx, dword [rdx + rbx*4 + 0x7a8a0]
add rcx, rdx
jmp rcx
bts edi, 8
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1400a5270
shl edi, 0x10
lea rdx, [rsp + 0x20]
mov ecx, edi
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
xor eax, eax
lea rcx, [rsi + 8]
mov qword [rsi], rcx
lea rdx, [rsp + 0x20]
mov word [rcx], ax
mov rcx, rsi
lea r8d, [rax - 1]
call fcn.14000cdd0
mov rax, rsi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400a24f0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14007e870
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
movzx edi, cl
mov ecx, 0xf0
call fcn.1400a2614
mov rsi, rax
mov qword [rsp + 0x68], rax
xor edx, edx
mov r8d, 0xf0
mov rcx, rax
call fcn.1400a5270
mov byte [rsi], 0
lea r14, [rsi + 4]
xor r12d, r12d
mov dword [r14], r12d
mov qword [rsi + 8], r12
xor eax, eax
mov byte [rsi + 0x10], al
lea edx, [rax + 2]
lea rcx, [rsi + 0x18]
call fcn.1400a1618
nop
lea rbx, [rsi + 0x68]
mov qword [rsp + 0x70], rbx
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov qword [rbx + 0x20], r12
lea ecx, [r12 + 0x10]
call fcn.1400a2614
mov qword [rax + 8], r12
mov qword [rbx], rax
mov qword [rax], rbx
lea rcx, [rsi + 0x90]
call fcn.1400a1710
nop
lea rbx, [rsi + 0xd8]
mov qword [rsp + 0x70], rbx
mov qword [rbx], r12
mov qword [rbx + 8], r12
lea ecx, [r12 + 0x60]
call fcn.1400a2614
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov byte [rsi + 0xe8], r12b
mov byte [rsi + 0xe8], dil
cmp byte [rsi], r12b
jne 0x14007e9a0
mov byte [rsi], 1
lea rcx, [rsi + 0x18]
call fcn.1400a1654
test eax, eax
jne 0x14007e9ba
mov eax, r12d
xchg byte [rsi + 0x10], al
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r12d
mov r9, rsi
lea r8, [0x14007e860]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
lea rdx, [rsi + 0x18]
lea rcx, [rsi + 0x90]
call fcn.1400a1740
lea rcx, [rsi + 0x18]
call fcn.1400a1678
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, eax
call fcn.1400a18bc
int3
Function at 0x1400825b0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r14, r9
mov rbx, rdx
mov r15, rcx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400825f9
xor eax, eax
jmp 0x1400827c5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
mov ecx, 0x48
call fcn.1400a2614
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x28], rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x44]
call fcn.1400a5270
mov dword [rsp + 0x40], 0x238
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor ebp, ebp
mov ecx, ebp
mov dword [rsp + 0x20], ecx
test eax, eax
je 0x1400826bf
nop
cmp dword [rsp + 0x48], esi
cmove ecx, dword [rsp + 0x60]
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.1400827f0
lea rcx, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rcx + r8*2], bp
jne 0x140082690
lea rdx, [rsp + 0x6c]
mov rcx, rax
call fcn.1400040b0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400826bf
mov ecx, dword [rsp + 0x20]
jmp 0x140082660
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rsp + 0x28]
mov rax, qword [r8 + 8]
mov rcx, r8
mov edx, dword [rsp + 0x20]
cmp byte [rax + 0x19], bpl
jne 0x1400826f7
nop
cmp dword [rax + 0x20], edx
jae 0x1400826eb
mov rax, qword [rax + 0x10]
jmp 0x1400826f1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], bpl
je 0x1400826e0
cmp byte [rcx + 0x19], bpl
jne 0x1400827b9
cmp edx, dword [rcx + 0x20]
jb 0x1400827b9
cmp rcx, r8
je 0x1400827b9
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1400827f0
cmp qword [rax + 0x18], 8
jb 0x14008272c
mov rax, qword [rax]
mov r8, rax
mov edx, 0x104
mov rcx, r14
call fcn.1400a96b0
mov r8d, dword [rsp + 0x20]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400827ad
mov r9d, 0x104
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x1400827a4
movzx ecx, word [rbx]
test cx, cx
je 0x1400827a4
mov edx, 0x5f
movabs r8, 0x1000000004000001
sub cx, 0x20
cmp cx, 0x3c
ja 0x140082798
bt r8, rcx
jae 0x140082798
mov word [rbx], dx
add rbx, 2
movzx ecx, word [rbx]
test cx, cx
jne 0x140082785
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x20]
mov dword [r15], eax
mov ebp, 1
lea rcx, [rsp + 0x28]
call fcn.140082900
mov eax, ebp
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400a24f0
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x290
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400831b0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x208
call fcn.1400a5270
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], 0
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140083220
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140004fe0
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400a24f0
add rsp, 0x250
pop rbx
ret

Function at 0x140083330
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x208
xor edi, edi
call fcn.1400a5270
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [rdi + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
test eax, eax
jns 0x1400833a4
xor r8d, r8d
lea rdx, [0x14011205c]
jmp 0x1400833bf
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x1400833b0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140004fe0
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400a24f0
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret

Function at 0x1400833f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x208
xor edi, edi
call fcn.1400a5270
xor r9d, r9d
lea r8d, [rdi + 0x17]
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
test eax, eax
jne 0x14008345d
xor r8d, r8d
lea rdx, [0x14011205c]
jmp 0x14008347f
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], di
jne 0x140083470
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140004fe0
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400a24f0
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret