joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000dfc0
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x14003d040]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rax, qword gs:[0x60]
xor ebp, ebp
mov r14, rcx
mov rdx, qword [rax + 0x18]
mov rsi, qword [rdx + 0x20]
test rsi, rsi
je 0x14000e0d7
mov r15d, 0x104
movzx eax, word [rsi + 0x48]
test ax, ax
je 0x14000e0d7
cmp ax, r15w
jae 0x14000e0d7
mov rax, qword [rsi + 0x50]
mov ebx, ebp
cmp word [rax], bx
je 0x14000e060
mov rdi, rbp
mov rcx, rbp
nop word [rax + rax]
movzx ecx, word [rcx + rax]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
inc ebx
mov byte [rsp + rdi + 0x30], al
mov rax, qword [rsi + 0x50]
mov edi, ebx
lea rcx, [rbx + rbx]
cmp word [rcx + rax], bp
jne 0x14000e040
mov eax, ebx
cmp rax, r15
jae 0x14000e203
mov byte [rsp + rax + 0x30], bpl
mov rdx, 0xffffffffffffffff
lea rax, [rsp + 0x30]
nop dword [rax]
inc rdx
cmp byte [rax + rdx], bpl
jne 0x14000e080
mov eax, ebp
mov r8, rbp
test rdx, rdx
je 0x14000e0cb
movsx ecx, byte [rsp + r8 + 0x30]
inc r8
add ecx, eax
imul eax, ecx, 0x81
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r8, rdx
jne 0x14000e093
lea ecx, [rax + rax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
cmp eax, 0x367dc15a
je 0x14000e1fa
mov rsi, qword [rsi]
test rsi, rsi
jne 0x14000e012
mov r8d, 0x4d5f406e
mov qword [rsp + 0x20], rbp
lea rdx, [rsp + 0x20]
call fcn.14000e210
mov r8d, 0x878d3ca2
mov qword [r14], rax
lea rdx, [rsp + 0x20]
call fcn.14000e210
mov r8d, 0xc88d2aec
mov qword [r14 + 8], rax
lea rdx, [rsp + 0x20]
call fcn.14000e210
mov r8d, 0xdd94c1c0
mov qword [r14 + 0x10], rax
lea rdx, [rsp + 0x20]
call fcn.14000e210
mov r8d, 0x66e2c7ce
mov qword [r14 + 0x20], rax
lea rdx, [rsp + 0x20]
call fcn.14000e210
mov r8d, 0xbadbb20b
mov qword [r14 + 0x28], rax
lea rdx, [rsp + 0x20]
call fcn.14000e210
mov r8d, 0x408ab9ea
mov qword [r14 + 0x30], rax
lea rdx, [rsp + 0x20]
call fcn.14000e210
mov r8d, 0x2396fe91
mov qword [r14 + 0x38], rax
lea rdx, [rsp + 0x20]
call fcn.14000e210
mov r8d, 0x970fde44
mov qword [r14 + 0x40], rax
lea rdx, [rsp + 0x20]
call fcn.14000e210
mov r8d, 0xe288b704
mov qword [r14 + 0x48], rax
lea rdx, [rsp + 0x20]
call fcn.14000e210
mov r8d, 0x63042c93
mov qword [r14 + 0x50], rax
lea rdx, [rsp + 0x20]
call fcn.14000e210
mov r8d, 0xf1dd17cc
mov qword [r14 + 0x58], rax
lea rdx, [rsp + 0x20]
call fcn.14000e210
mov qword [r14 + 0x18], rax
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14002d020
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rbp, qword [rsi + 0x20]
jmp 0x14000e0d7
call fcn.14002d520
int3
Function at 0x14000e210
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xf0
mov r10, qword [rdx]
mov ebp, r8d
test r10, r10
je 0x14000e390
mov eax, 0x5a4d
cmp word [r10], ax
jne 0x14000e390
movsxd rax, dword [r10 + 0x3c]
add rax, r10
cmp dword [rax], 0x4550
jne 0x14000e390
movups xmm0, xmmword [rax + 0x18]
lea rcx, [rsp]
xor r11d, r11d
movups xmm1, xmmword [rax + 0x28]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
mov eax, dword [rsp + 0x70]
add rax, r10
mov ebx, dword [rax + 0x20]
mov r15d, dword [rax + 0x1c]
add rbx, r10
mov edi, dword [rax + 0x24]
add r15, r10
mov r14d, dword [rax + 0x14]
add rdi, r10
test r14d, r14d
je 0x14000e390
nop
movzx eax, word [rdi]
mov r9d, dword [rbx]
mov esi, dword [r15 + rax*4]
add rsi, r10
add r9, r10
jne 0x14000e326
xor eax, eax
jmp 0x14000e37c
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp byte [r9 + rdx], 0
jne 0x14000e330
xor eax, eax
xor r8d, r8d
test rdx, rdx
je 0x14000e36c
nop dword [rax]
nop dword [rax + rax]
movsx ecx, byte [r8 + r9]
inc r8
add ecx, eax
imul eax, ecx, 0x81
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r8, rdx
jne 0x14000e350
lea ecx, [rax + rax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
cmp ebp, eax
je 0x14000e3af
inc r11d
add rbx, 4
add rdi, 2
cmp r11d, r14d
jb 0x14000e310
xor eax, eax
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rax, rsi
jmp 0x14000e392
Function at 0x14000ea60
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], bpl
mov dword [rsp + 0x20], 1
mov rax, qword [rdx + 0x10]
cmp rax, 0xf
jbe 0x14000eabc
mov rdx, rax
call fcn.14001ca20
mov qword [rbx + 0x10], rbp
mov rax, qword [rdi + 0x10]
mov r15d, 0xfffffffa
cmp qword [rdi + 0x18], 0xf
jbe 0x14000ead4
mov r14, qword [rdi]
mov rcx, r14
mov rdi, r14
jmp 0x14000eada
mov r14, rdi
mov rcx, rdi
lea r13, [rax + rcx]
cmp rdi, r13
je 0x14000ebd1
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop
shl ebp, 8
movzx eax, byte [r14]
add ebp, eax
add r15d, 8
js 0x14000eb76
movsxd r12, ebp
movsxd rdi, r15d
lea ecx, [r15 + 6]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
mov esi, edx
imul eax, edx, 0xfffffffa
add r15d, eax
nop dword [rax + rax]
mov rax, r12
mov rcx, rdi
sar rax, cl
and eax, 0x3f
movzx r9d, byte [rax + r8]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14000eb5d
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x14000eb52
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000eb6c
mov rcx, rbx
call fcn.140006550
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
sub rdi, 6
sub rsi, 1
jne 0x14000eb20
inc r14
cmp r14, r13
jne 0x14000eaf0
cmp r15d, 0xfffffffa
jle 0x14000ebd1
lea ecx, [r15 + 8]
shl ebp, 8
movsxd rax, ebp
sar rax, cl
and eax, 0x3f
movzx r9d, byte [rax + r8]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14000ebc9
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x14000ebbe
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000ebd1
mov rcx, rbx
call fcn.140006550
mov rcx, qword [rbx + 0x10]
test cl, 3
je 0x14000ec19
nop word [rax + rax]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14000ec05
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x14000ebfd
mov rax, qword [rbx]
mov word [rax + rcx], 0x3d
jmp 0x14000ec10
mov r9b, 0x3d
mov rcx, rbx
call fcn.140006550
mov rcx, qword [rbx + 0x10]
test cl, 3
jne 0x14000ebe0
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140016430
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14003d040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rdx
mov qword [rsp + 0x40], rdx
mov rax, qword [rdx]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x24], r9d
mov rax, qword [r8]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], eax
lea rcx, str.Advapi32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400164b9
lea rdx, str.SystemFunction033
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call rax
mov rcx, rdi
test eax, eax
je 0x1400164ff
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400164fb
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1400164e9
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140016562
mov rcx, r8
call fcn.14002d3e4
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
xor al, al
jmp 0x14001654a
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x140016548
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140016536
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140016562
mov rcx, r8
call fcn.14002d3e4
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002d020
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14002ddcc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002de16
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002de16
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002de16
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002de16
cmp dword [rcx + 0x84], 0xe
jbe 0x14002de16
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002de18
xor al, al
add rsp, 0x28
ret
Function at 0x1400687f0
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
sub rsp, 0x278
mov rbx, rdx
lea rax, [rsp + 0x50]
mov edx, 0x8005
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140068a3c
mov qword [rsp + 0x290], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x298], rdi
xor esi, esi
mov qword [rsp + 0x270], r14
xor bpl, bpl
mov r14d, esi
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp word [rax + rdi*2], si
jne 0x140068850
movaps xmmword [rsp + 0x260], xmm6
test rdi, rdi
je 0x1400688cc
mov ecx, 0x18
call fcn.1400eeed0
mov r14, rax
lea rcx, [rsp + 0x50]
xor eax, eax
xorps xmm0, xmm0
mov r8, r14
mov rdx, rdi
mov bpl, 1
movups xmmword [r14], xmm0
lea r9d, [rax + 1]
mov qword [r14 + 0x10], rax
call sub.libcef.dll_cef_string_wide_set
test r14, r14
je 0x1400688cc
cmp qword [r14 + 8], rsi
je 0x1400688cc
mov r8, qword [r14 + 8]
lea rcx, [rsp + 0x30]
mov rdx, qword [r14]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.14000f940
movdqu xmm6, xmmword [rsp + 0x40]
jmp 0x1400688e7
movdqa xmm6, xmmword [0x140133460]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x30], si
movdqu xmmword [rsp + 0x40], xmm6
lea rax, [rsp + 0x30]
cmp rbx, rax
je 0x140068948
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140068930
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14006892b
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140068a5e
mov rcx, r8
call fcn.1400eef0c
movups xmm0, xmmword [rsp + 0x30]
mov edx, 7
mov word [rsp + 0x30], si
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm6
jmp 0x14006894d
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14006898a
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140068985
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140068a5e
call fcn.1400eef0c
test r14, r14
je 0x1400689a9
test bpl, bpl
je 0x1400689a9
mov rcx, r14
call sub.libcef.dll_cef_string_wide_clear
mov edx, 0x18
mov rcx, r14
call fcn.1400eef0c
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 0x1b
jb 0x1400689ea
lea rdi, [rcx + 0x1b]
mov qword [rbx + 0x10], rdi
cmp rdx, 8
jb 0x1400689ce
mov rbx, qword [rbx]
lea rcx, [rbx + rcx*2]
mov r8d, 0x36
lea rdx, str.Rockstar_GamesSocial_Club
call fcn.1400f01c0
mov word [rbx + rdi*2], si
jmp 0x140068a10
movzx r8d, byte [rsp + 0x2a0]
lea r9, str.Rockstar_GamesSocial_Club
mov edx, 0x1b
mov qword [rsp + 0x20], 0x1b
mov rcx, rbx
call fcn.140066e80
movaps xmm6, xmmword [rsp + 0x260]
mov al, 1
mov rdi, qword [rsp + 0x298]
mov rbp, qword [rsp + 0x290]
mov r14, qword [rsp + 0x270]
add rsp, 0x278
pop rsi
pop rbx
ret
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x140068a49
mov rax, qword [rbx]
xor esi, esi
mov qword [rbx + 0x10], rsi
mov word [rax], si
xor al, al
add rsp, 0x278
pop rsi
pop rbx
ret
call fcn.1400f5e30
int3
Function at 0x14006fe80
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
mov r14, rdx
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
mov ecx, 0x11
shr ebx, 0xf
and ebx, 1
add ebx, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov edi, ebx
or edi, 4
mov ecx, 0x12
test al, 1
cmove edi, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ebx, edi
or ebx, 8
mov ecx, 0x90
test al, 1
cmove ebx, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, ebx
mov ecx, 0x14
bts edi, 8
test al, 1
cmove edi, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebp, edi
or ebp, 1
test al, 1
cmove ebp, edi
add rsi, 0xfffffffffffffff4
mov ebx, ebp
cmp rsi, 0x84
ja case.0x14006ff39.14
lea rdx, [0x140000000]
movzx eax, byte [rdx + rsi + 0x70008]
mov ecx, dword [rdx + rax*4 + 0x6ffe4]
add rcx, rdx
jmp rcx
bts ebx, 9
and r14d, 0x1000000
test r14, r14
cmove ebx, ebp
jmp case.0x14006ff39.14
bts ebx, 9
and r14d, 0x1000000
test r14, r14
cmovne ebx, ebp
jmp case.0x14006ff39.14
bts ebx, 9
jmp case.0x14006ff39.14
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne case.0x14006ff39.91
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je case.0x14006ff39.14
bts ebx, 0xb
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne case.0x14006ff39.91
mov ecx, 0xa3
jmp 0x14006ff7e
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne case.0x14006ff39.91
mov ecx, 0xa5
jmp 0x14006ff7e
bts ebx, 0xa
jmp case.0x14006ff39.14

Function at 0x140070090
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, rcx
mov rdi, rcx
shr rdx, 1
and edx, 4
mov ebx, edx
or ebx, 2
test cl, 4
mov ecx, 0x12
cmove ebx, edx
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, ebx
shr eax, 0xf
or ecx, 8
test al, 1
cmove ecx, ebx
mov edx, ecx
or edx, 0x10
test dil, 1
cmove edx, ecx
mov ecx, edx
or ecx, 0x20
test dil, 0x10
cmove ecx, edx
mov ebx, ecx
or ebx, 0x40
test dil, 2
cmove ebx, ecx
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, ebx
mov ecx, 0x14
bts edi, 8
test al, 1
cmove edi, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
mov rbx, qword [rsp + 0x30]
mov ecx, edi
or ecx, 1
test al, 1
cmove ecx, edi
mov eax, ecx
add rsp, 0x20
pop rdi
ret

Function at 0x140070130
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x48
test ecx, ecx
je 0x14007014d
cmp ecx, 1
je 0x140070144
xor al, al
add rsp, 0x48
ret
mov rcx, 0xffffffff80000002
jmp 0x140070154
mov rcx, 0xffffffff80000001
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r9
mov r9d, 0x10
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
sete al
add rsp, 0x48
ret
Function at 0x140070200
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rdi
sub rsp, 0x250
mov edi, edx
mov rbx, rcx
test rcx, rcx
je 0x1400702ae
test edx, edx
je 0x1400702ae
mov qword [rax + 0x10], rsi
xor esi, esi
mov dword [rax + 8], 0x208
lea rax, [rax + 8]
mov qword [rsp + 0x30], rax
lea r8, str.InstallFolder
lea rax, [rsp + 0x40]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rax
lea r9d, [rsi + 2]
lea rdx, str.SOFTWAREWOW6432NodeRockstar_GamesLauncher
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400702a7
lea rax, [rsp + 0x40]
mov edx, edi
lea r9, str._lsLauncher.exe
mov qword [rsp + 0x20], rax
lea r8, [rsi - 1]
mov rcx, rbx
call fcn.140070e70
mov al, 1
mov rsi, qword [rsp + 0x268]
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
mov word [rbx], si
xor al, al
jmp 0x14007028e
mov rbx, qword [rsp + 0x270]
xor al, al
add rsp, 0x250
pop rdi
ret

Function at 0x140070960
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret

Function at 0x140070a70
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x90
xorps xmm0, xmm0
mov rdi, r9
movups xmmword [rax - 0x78], xmm0
mov dword [rax - 0x78], 0x70
lea r9, str.runas
mov dword [rax - 0x74], 0x40
test r8b, r8b
movups xmmword [rax - 0x68], xmm0
movups xmmword [rax - 0x58], xmm0
movups xmmword [rax - 0x48], xmm0
movups xmmword [rax - 0x38], xmm0
movups xmmword [rax - 0x28], xmm0
movups xmmword [rax - 0x18], xmm0
mov qword [rsp + 0x38], rcx
lea rax, str.open
cmovne rax, r9
mov qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x50], 5
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x140070aef
add rsp, 0x90
pop rdi
ret
test rdi, rdi
je 0x140070b7f
mov qword [rsp + 0xa0], rbx
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0xa8], rsi
mov rcx, rbx
mov esi, 0xffffffff
mov edx, esi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0xb0]
mov dword [rsp + 0xb0], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [rsp + 0xb0]
mov rcx, rbx
test eax, eax
cmove edx, esi
mov dword [rsp + 0xb0], edx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0xb0]
test eax, eax
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov dword [rdi], eax
sete al
add rsp, 0x90
pop rdi
ret
mov al, 1
add rsp, 0x90
pop rdi
ret
Function at 0x140071f20
Capabilities:
Get common file path
Get startup folder

Disassembly:
push rbx
sub rsp, 0x240
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
xor r9d, r9d
mov qword [rcx + 0x18], 7
mov rbx, rcx
mov word [rcx], ax
xor r8d, r8d
lea rax, [rsp + 0x30]
xor ecx, ecx
lea edx, [r9 + 5]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140071f85
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140071a20
mov r8d, 0x1c
lea rdx, str.Rockstar_GamesSocial_Club_
mov rcx, rbx
call fcn.14006b5f0
mov r8d, 7
lea rdx, [0x140146e68]
mov rcx, rbx
call fcn.14006b5f0
mov rax, rbx
add rsp, 0x240
pop rbx
ret

Function at 0x1400735a0
Capabilities:
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x1400735e8
cmp byte [rbx + 0x30], 0
mov r8d, 4
mov eax, edx
mov edx, 0xf001f
cmovne edx, r8d
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
mov qword [rbx + 0x28], rax
setne al
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x140075540
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x140075575
call fcn.1400766e0
cmp eax, 2
jl 0x140075575
mov edi, 0x10000
jmp 0x140075577
xor ebx, ebx
mov qword [rsp + 0x28], 0
lea r8, [0x1400756c0]
mov r9, rbp
mov dword [rsp + 0x20], edi
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x40]
test rax, rax
mov rbp, qword [rsp + 0x48]
mov qword [rsi], rax
setne al
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400766e0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x148
cmp byte [0x1401b8960], 0
jne 0x1400767df
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [rsp + 0x24]
cmp edx, 5
jne 0x14007676a
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x140076751
cmp eax, 1
je 0x140076737
mov eax, 3
mov byte [0x1401b8960], 1
mov dword [0x1401b8964], eax
add rsp, 0x148
ret
mov eax, 2
mov byte [0x1401b8960], 1
mov dword [0x1401b8964], eax
add rsp, 0x148
ret
mov eax, 1
mov dword [0x1401b8964], eax
mov byte [0x1401b8960], al
add rsp, 0x148
ret
cmp edx, 6
jne 0x1400767ba
cmp byte [rsp + 0x13a], 1
je 0x140076793
mov eax, 5
mov byte [0x1401b8960], 1
mov dword [0x1401b8964], eax
add rsp, 0x148
ret
cmp dword [rsp + 0x28], 0
mov eax, 6
mov ecx, 4
mov byte [0x1401b8960], 1
cmove eax, ecx
mov dword [0x1401b8964], eax
add rsp, 0x148
ret
mov ecx, dword [0x1401b8964]
mov eax, 6
cmova ecx, eax
mov byte [0x1401b8960], 1
mov eax, ecx
mov dword [0x1401b8964], ecx
add rsp, 0x148
ret
mov eax, dword [0x1401b8964]
add rsp, 0x148
ret
Function at 0x1400edfac
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x1400edfda
xor eax, eax
jmp 0x1400ee0c0
cmp qword [rcx + 0x68], 0
je 0x1400edfeb
call fcn.14000ca80
jmp 0x1400ee0c0
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400ee002
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400ee004
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400ee036
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400f01c0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x1400ee0ba
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x1400ee06d
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400ee096
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14010b224
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x1400ee0ba
cmp rsi, rbx
ja 0x1400ee074
test rsi, rsi
je 0x1400ee0ba
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14010b224
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400efb90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400efbda
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400efbda
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400efbda
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400efbda
cmp dword [rcx + 0x84], 0xe
jbe 0x1400efbda
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400efbdc
xor al, al
add rsp, 0x28
ret