joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140041b10
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov ecx, 0x80
mov rsi, r9
mov rdi, r8
mov rbx, rdx
call fcn.1400562a8
lea r12, vtable.common::HttpFetch::SendTask.0
mov r14, rax
lea rdx, [rbx + 8]
mov qword [rax], r12
mov ecx, dword [rbx]
mov dword [rax + 8], ecx
lea rcx, [rax + 0x10]
call fcn.1400097f0
lea rdx, [rbx + 0x18]
lea rcx, [r14 + 0x20]
call fcn.1400097f0
movups xmm0, xmmword [rdi]
mov r9, r14
lea r8, [0x1400448f0]
mov edx, 0x20000
xor ecx, ecx
movups xmmword [r14 + 0x30], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [r14 + 0x40], xmm1
movups xmm0, xmmword [rdi + 0x20]
xor edi, edi
mov qword [r14 + 0x60], rsi
mov qword [rsp + 0x28], rdi
movups xmmword [r14 + 0x50], xmm0
mov qword [r14 + 0x70], rdi
mov qword [r14 + 0x78], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x140041bd3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadId]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140041c33
mov qword [r14], r12
mov rcx, qword [r14 + 0x70]
test rcx, rcx
je 0x140041bf0
mov dword [r14 + 0x78], edi
call fcn.14005aed0
mov qword [r14 + 0x70], rdi
mov dword [r14 + 0x7c], edi
mov rcx, qword [r14 + 0x20]
test rcx, rcx
je 0x140041c0a
mov dword [r14 + 0x28], edi
call fcn.14005aed0
mov qword [r14 + 0x20], rdi
mov dword [r14 + 0x2c], edi
mov rcx, qword [r14 + 0x10]
test rcx, rcx
je 0x140041c24
mov dword [r14 + 0x18], edi
call fcn.14005aed0
mov qword [r14 + 0x10], rdi
mov dword [r14 + 0x1c], edi
mov edx, 0x80
mov rcx, r14
call fcn.1400562a0
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x140042420
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1070
call fcn.140056b90
sub rsp, rax
mov rax, qword [0x140098020]
xor rax, rsp
mov qword [rsp + 0x1060], rax
xorps xmm0, xmm0
mov edi, edx
mov rdx, qword [rcx]
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
mov ebx, dword [rdx + 8]
mov rdx, qword [rdx]
lea r8d, [rbx + rbx]
call fcn.140057f80
xor edx, edx
mov dword [rsp + 0x28], 3
lea eax, [rbx + 1]
mov word [rsp + rbx*2 + 0x60], dx
and di, 1
lea rcx, [rsp + 0x20]
mov word [rsp + rax*2 + 0x60], dx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov eax, 0x614
shl di, 6
or di, ax
mov word [rsp + 0x40], di
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
and eax, 6
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.140056280
mov rbx, qword [rsp + 0x1088]
add rsp, 0x1070
pop rdi
ret
Function at 0x1400436f0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1000]
mov eax, 0x1100
call fcn.140056b90
sub rsp, rax
mov rax, qword [0x140098020]
xor rax, rsp
mov qword [rbp + 0xff0], rax
mov ebx, dword [rcx + 8]
xorps xmm0, xmm0
xor eax, eax
mov rsi, rdx
mov rdx, qword [rcx]
mov rdi, rcx
xor r14d, r14d
mov qword [rbp - 0x20], rax
lea r8d, [rbx + rbx]
mov qword [rsp + 0x78], rax
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x60], r14
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rsp + 0x68], xmm0
call fcn.140057f80
lea eax, [rbx + 1]
mov word [rbp + rbx*2 - 0x10], r14w
mov word [rbp + rax*2 - 0x10], r14w
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14004383d
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
lea rdx, [rbp - 0x10]
lea rax, [rbp - 0x80]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x2000000
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140043832
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rbp + 0xff0]
xor rcx, rsp
call fcn.140056280
lea r11, [rsp + 0x1100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rdi + 8]
lea rcx, [rbp - 0x10]
mov rdx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
lea r8d, [rbx + rbx]
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
call fcn.140057f80
lea eax, [rbx + 1]
mov word [rbp + rbx*2 - 0x10], r14w
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x80], 0x70
mov dword [rbp - 0x7c], 0x40
mov word [rbp + rax*2 - 0x10], r14w
lea rax, str.open
mov qword [rbp - 0x70], rax
mov rax, qword [rsi]
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x50], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, 1
je 0x140043809
xor al, al
jmp 0x14004380b
Function at 0x1400438d0
Capabilities:
Create process on windows

Disassembly:
push rbx
mov eax, 0x10a0
call fcn.140056b90
sub rsp, rax
mov rax, qword [0x140098020]
xor rax, rsp
mov qword [rsp + 0x1090], rax
mov ebx, dword [rcx + 8]
xorps xmm0, xmm0
mov rdx, qword [rcx]
lea rcx, [rsp + 0x90]
movups xmmword [rsp + 0x20], xmm0
lea r8d, [rbx + rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call fcn.140057f80
xor edx, edx
mov qword [rsp + 0x20], 0x70
lea eax, [rbx + 1]
mov word [rsp + rbx*2 + 0x90], dx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rdx
mov word [rsp + rax*2 + 0x90], dx
lea rax, str.open
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x50], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, 1
sete al
mov rcx, qword [rsp + 0x1090]
xor rcx, rsp
call fcn.140056280
add rsp, 0x10a0
pop rbx
ret

Function at 0x140043df0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rsi, rcx
xor bl, bl
mov ecx, 1
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x140043ed7
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140043ed7
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
test rax, rax
je 0x140043ec3
mov rcx, rax
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
test rax, rax
je 0x140043ebe
mov qword [rsp + 0x38], r14
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140043e60
mov r14d, ebx
cmp ebx, dword [rsi + 0xc]
jbe 0x140043e84
mov rcx, qword [rsi]
lea rdx, [r14 + r14]
call fcn.14005aec8
mov qword [rsi], rax
mov dword [rsi + 0xc], ebx
mov rdx, qword [rsi]
lea r8, [rdi + r14*2]
mov r14, qword [rsp + 0x38]
mov dword [rsi + 8], ebx
cmp rdi, r8
je 0x140043eb3
mov rcx, rdi
nop dword [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp rcx, r8
jne 0x140043ea0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov bl, 1
mov rdi, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_CloseClipboard]
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x20
pop rsi
ret
Function at 0x140044480
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x2050
call fcn.140056b90
sub rsp, rax
mov rax, qword [0x140098020]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbx, rdx
lea rax, [rsp + 0x1040]
mov rdi, rcx
mov qword [rsp + 0x20], rax
mov edx, 0x801c
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1400445de
mov qword [rsp + 0x2060], rsi
lea rax, [rsp + 0x1040]
xor esi, esi
mov qword [rsp + 0x38], rdi
mov r9d, 0x5c
mov dword [rdi + 0x200], esi
mov word [rsp + 0x30], r9w
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], si
jne 0x140044503
mov eax, ecx
lea r8, [rsp + 0x1040]
mov dword [rdi + 0x200], ecx
lea r8, [r8 + rax*2]
lea rax, [rsp + 0x1040]
cmp rax, r8
je 0x140044566
lea rcx, [rsp + 0x1040]
mov rdx, rdi
sub rdx, rcx
lea rax, [rsp + 0x1040]
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rax]
mov word [rdx + rax], cx
add rax, 2
cmp rax, r8
jne 0x140044550
mov ecx, dword [rdi + 0x200]
test ecx, ecx
je 0x140044583
mov r8d, ecx
cmp word [rdi + r8*2 - 2], r9w
je 0x140044583
lea eax, [rcx + 1]
mov dword [rdi + 0x200], eax
mov word [rdi + r8*2], r9w
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14000a010
mov ebx, dword [rdi + 0x200]
lea rcx, [rsp + 0x40]
mov rdx, rdi
lea r8d, [rbx + rbx]
call fcn.140057f80
lea eax, [rbx + 1]
mov word [rsp + rbx*2 + 0x40], si
xor edx, edx
lea rcx, [rsp + 0x40]
mov word [rsp + rax*2 + 0x40], si
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rsi, qword [rsp + 0x2060]
test eax, eax
jne 0x1400445da
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400445de
mov al, 1
jmp 0x1400445e0
xor al, al
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140056280
mov rbx, qword [rsp + 0x2070]
add rsp, 0x2050
pop rdi
ret
Function at 0x1400475b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
movss xmm2, dword [rcx + 0x4c]
mov rbx, rcx
movss xmm0, dword [rcx + 0x48]
ucomiss xmm0, xmm2
mov r9, qword [rdx]
mov qword [rcx + 0x1c], r9
jp 0x140047633
jne 0x140047633
mov edx, dword [rcx + 0x18]
mov rax, r9
mov r8d, dword [rcx + 0x14]
shr rax, 0x20
add eax, edx
movd xmm1, edx
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm1, xmm2
mulss xmm0, xmm2
cvttss2si eax, xmm1
cvttss2si ecx, xmm0
movd xmm1, r8d
sub ecx, eax
mov eax, ecx
lea ecx, [r8 + r9]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
shl rax, 0x20
cvtdq2ps xmm1, xmm1
mulss xmm0, xmm2
mulss xmm1, xmm2
cvttss2si edx, xmm0
cvttss2si ecx, xmm1
sub edx, ecx
mov ecx, edx
or rax, rcx
jmp 0x14004766a
xorps xmm0, xmm0
mov ecx, r9d
mov rax, r9
shr rax, 0x20
cvtsi2ss xmm0, rax
mulss xmm0, xmm2
cvttss2si rax, xmm0
xorps xmm0, xmm0
mov eax, eax
cvtsi2ss xmm0, rcx
shl rax, 0x20
mulss xmm0, xmm2
cvttss2si rdx, xmm0
mov edx, edx
or rax, rdx
mov r9, qword [rbx + 0x40]
movsxd r8, dword [0x1400a0594]
mov rcx, qword [r9 + 0x10]
movzx edx, word [rcx + r8*2]
mov qword [rdx + r9 + 0x20], rax
mov r9d, 0x80
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x28]
call fcn.14004c290
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140047c90
push rbx
sub rsp, 0x70
mov rax, qword [0x140098020]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp qword [rcx + 8], 0
mov rbx, rcx
je 0x140047da5
test dword [rcx + 0x10], 0xf0000
je 0x140047da5
mov eax, dword [rcx + 0x1c]
lea r8, [rsp + 0x28]
mov dword [rsp + 0x28], eax
lea rdx, [rcx + 0x14]
mov eax, dword [rcx + 0x20]
mov dword [rsp + 0x2c], eax
call fcn.140047dc0
mov r9d, 1
lea rdx, [rbx + 0x14]
mov rcx, rbx
xorps xmm2, xmm2
call fcn.1400476b0
movzx eax, byte [rsp + 0x20]
lea r9, [0x140047fe0]
mov rdx, qword [rbx + 0x40]
movsxd r10, dword [0x1400a0594]
mov byte [rsp + 0x28], al
movups xmm0, xmmword [rsp + 0x28]
mov qword [rsp + 0x60], r9
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rsp + 0x48], xmm1
movsd xmm0, qword [rsp + 0x48]
movsd qword [rsp + 0x58], xmm0
mov rax, qword [rdx + 0x10]
movzx ecx, word [rax + r10*2]
mov rax, qword [rcx + rdx + 0x80]
mov rax, qword [rax + 0x38]
test rax, rax
je 0x140047da5
mov qword [rsp + 0x88], rdi
xor edi, edi
nop word [rax + rax]
lea rbx, [rax + 0x20]
movsxd rcx, r10d
test rbx, rbx
cmove rax, rdi
mov r8, qword [rax + 0x10]
mov rax, qword [r8 + 0x10]
movzx edx, word [rax + rcx*2]
lea rcx, [rsp + 0x38]
mov rdx, qword [rdx + r8 + 0x10]
call r9
mov rax, qword [rbx]
test rax, rax
je 0x140047d9d
mov r9, qword [rsp + 0x60]
mov r10d, dword [0x1400a0594]
jmp 0x140047d60
mov rdi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140056280
add rsp, 0x70
pop rbx
ret
Function at 0x140047a80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rdx + 0x10]
mov rbx, rdx
movss xmm1, dword [0x140083c8c]
mov r11, rcx
movss xmm2, dword [rax]
mov rax, qword [rdx + 0x20]
mov qword [rcx + 8], rax
mov eax, dword [rdx + 0x2c]
mov dword [rcx + 0x10], eax
mov rax, qword [rdx + 0x30]
mov qword [rcx + 0x14], rax
mov rax, qword [rdx + 0x3c]
mov qword [rcx + 0x1c], rax
mov rax, qword [rdx]
mov qword [rcx + 0x28], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 0x30], rax
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x38], rax
mov rdx, qword [rdx + 0x18]
mov qword [rcx + 0x40], rdx
test byte [rbx + 0x2c], 0x40
je 0x140047aed
movaps xmm0, xmm1
jmp 0x140047af0
movaps xmm0, xmm2
movss dword [rcx + 0x48], xmm0
test byte [rbx + 0x2c], 0x80
jne 0x140047afe
movaps xmm1, xmm2
movss dword [rcx + 0x4c], xmm1
mov rax, qword [rdx + 0x10]
movsxd rcx, dword [0x1400a0594]
movzx edi, word [rax + rcx*2]
mov rax, qword [rbx + 0x20]
add rdi, rdx
test rax, rax
je 0x140047b4f
mov rax, qword [rax + 0x40]
mov qword [rdi], rax
test dword [rbx + 0x2c], 0xf0000
je 0x140047b4f
mov eax, dword [r11 + 0x1c]
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], eax
lea rdx, [r11 + 0x14]
mov eax, dword [r11 + 0x20]
mov rcx, r11
mov dword [rsp + 0x34], eax
call fcn.140047dc0
mov qword [rdi + 0x10], r11
mov eax, dword [rbx + 0x28]
mov dword [rdi + 8], eax
movd xmm0, dword [r11 + 0x14]
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [r11 + 0x48]
cvttss2si eax, xmm0
movd xmm0, dword [r11 + 0x18]
mov dword [rsp + 0x30], eax
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [r11 + 0x48]
cvttss2si eax, xmm0
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x30]
mov qword [rdi + 0x18], rax
mov eax, dword [rbx + 0x38]
mov dword [rdi + 0x28], eax
movss xmm2, dword [r11 + 0x4c]
movss xmm0, dword [r11 + 0x48]
ucomiss xmm0, xmm2
jp 0x140047c0c
jne 0x140047c0c
mov edx, dword [r11 + 0x18]
mov ecx, dword [r11 + 0x20]
mov r8d, dword [r11 + 0x14]
add ecx, edx
movd xmm1, edx
mov edx, dword [r11 + 0x1c]
movd xmm0, ecx
add edx, r8d
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
mulss xmm0, xmm2
mulss xmm1, xmm2
cvttss2si ecx, xmm0
cvttss2si eax, xmm1
movd xmm0, edx
sub ecx, eax
movd xmm1, r8d
mov eax, ecx
cvtdq2ps xmm0, xmm0
shl rax, 0x20
cvtdq2ps xmm1, xmm1
mulss xmm0, xmm2
mulss xmm1, xmm2
cvttss2si edx, xmm0
cvttss2si ecx, xmm1
sub edx, ecx
mov ecx, edx
or rax, rcx
jmp 0x140047c41
mov eax, dword [r11 + 0x20]
xorps xmm0, xmm0
mov ecx, dword [r11 + 0x1c]
cvtsi2ss xmm0, rax
mulss xmm0, xmm2
cvttss2si rax, xmm0
xorps xmm0, xmm0
mov eax, eax
cvtsi2ss xmm0, rcx
shl rax, 0x20
mulss xmm0, xmm2
cvttss2si rdx, xmm0
mov edx, edx
or rax, rdx
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x70], r11
mov eax, dword [rbx + 0x2c]
test al, 1
je 0x140047c57
mov byte [rdi + 0x2d], 1
mov eax, dword [rbx + 0x2c]
test al, 4
je 0x140047c62
mov byte [rdi + 0x2e], 1
mov eax, dword [rbx + 0x2c]
test al, 8
je 0x140047c6a
mov byte [rdi + 0x2f], 1
mov rdx, qword [r11 + 0x40]
mov rcx, qword [r11 + 0x28]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14004bec0
Function at 0x140049970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rdx]
cmp byte [rcx], 1
je 0x140049989
xor al, al
add rsp, 0x20
pop rbx
ret
cmp byte [rcx + 2], 0
mov qword [rsp + 0x30], rbp
jne 0x140049a5b
cmp byte [rcx + 8], 0
je 0x1400499b7
mov bpl, 1
mov byte [rbx + 0x91], 1
movzx eax, bpl
mov rbp, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
cmp byte [rbx + 0x91], 0
je 0x140049a5b
movzx edx, byte [rbx + 0x90]
mov r8b, 1
xor dl, 1
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov byte [rbx + 0x91], 0
call fcn.1400498d0
movzx eax, byte [rbx + 0x90]
lea rsi, [rbx + 0x68]
inc dword [rsi]
xor bpl, bpl
mov rbx, qword [rsi + 8]
mov byte [rsp + 0x38], al
test rbx, rbx
je 0x140049a3d
mov qword [rsp + 0x48], rdi
mov rdi, qword [rsi + 0x10]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140049a2b
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
mov r8, qword [rbx + 0x18]
call qword [rax]
test al, al
jne 0x140049a35
cmp rbx, rdi
je 0x140049a38
mov rbx, qword [rbx]
jmp 0x140049a10
mov bpl, 1
mov rdi, qword [rsp + 0x48]
dec dword [rsi]
mov rcx, rsi
call fcn.140001b00
mov rsi, qword [rsp + 0x40]
movzx eax, bpl
mov rbp, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
xor bpl, bpl
movzx eax, bpl
mov rbp, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x140049ae0
Capabilities:
Get keyboard layout
Log keystrokes via polling
Register raw input devices

Disassembly:
push rdi
sub rsp, 0x20
cmp byte [rdx], 0
mov rdi, rcx
je 0x140049b84
mov rax, qword [rcx + 0x28]
mov edx, 1
add rcx, 0xa0
mov r8, qword [rax + 0x70]
mov eax, 6
mov word [rcx], dx
mov qword [rdi + 0xa8], r8
mov qword [rdi + 0xb8], r8
lea edx, [rax - 4]
mov word [rdi + 0xa2], ax
lea r8d, [rax + 0xa]
mov dword [rdi + 0xa4], 0x100
mov dword [rdi + 0xb0], 0x20001
mov dword [rdi + 0xb4], 0x100
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
cmp eax, 1
je 0x140049b7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x17f
lea rdx, str.engine::input::WindowDriver::_InitializeRawInput
mov r9d, eax
lea rcx, str.FAIL:__s:_u_CODE:_x
call fcn.140043540
xor al, al
add rsp, 0x20
pop rdi
ret
mov byte [rdi + 0x9d], 1
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r14
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ebx, 0x20
mov ebp, 0x600
mov rsi, rax
mov r14d, 0xff
mov rdx, rsi
movzx ecx, bx
call qword [sym.imp.USER32.dll_VkKeyScanExW]
cmp ax, 0xffff
je 0x140049bd4
and ax, bp
cmp ax, bp
jne 0x140049bd4
mov byte [rdi + 0xc0], 1
inc bx
cmp bx, r14w
jbe 0x140049bb3
mov r14, qword [rsp + 0x48]
mov al, 1
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov byte [rdi + 0x30], 1
add rsp, 0x20
pop rdi
ret
Function at 0x14004a4b0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140098020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov eax, 0xe0
movzx r15d, r9b
movzx r14d, r8b
mov rsi, rcx
cmp dx, ax
jae 0x14004a647
movzx eax, dx
lea rcx, str.674I35GHFEJLKMCD
movzx edi, byte [rax + rcx]
cmp dil, 0x5e
je 0x14004a647
xor ebp, ebp
lea ecx, [rbp + 0x12]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 7
test al, 1
je 0x14004a532
cmp byte [rsi + 0xc0], bpl
je 0x14004a52d
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 7
test al, 1
jne 0x14004a647
mov ebp, 2
mov ecx, 0x11
mov qword [rsp + 0x48], rbx
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 7
mov ebx, ebp
or ebx, 1
mov ecx, 0x10
and al, 1
cmove ebx, ebp
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, ebx
mov byte [rdi + rsi + 0x3c], r14b
or ecx, 4
shr eax, 7
and al, 1
cmove ecx, ebx
cmp ecx, 1
jne 0x14004a5c7
cmp dil, 0x18
je 0x14004a5d2
inc dword [rsi + 8]
xor bpl, bpl
mov rbx, qword [rsi + 0x10]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x29], r15b
mov byte [rsp + 0x2a], dil
mov dword [rsp + 0x2c], ecx
mov byte [rsp + 0x30], r14b
test rbx, rbx
je 0x14004a619
mov rdi, qword [rsi + 0x18]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14004a5bd
mov rax, qword [rcx]
lea rdx, [rsp + 0x28]
mov r8, qword [rbx + 0x18]
call qword [rax]
test al, al
jne 0x14004a616
cmp rbx, rdi
je 0x14004a619
mov rbx, qword [rbx]
jmp 0x14004a5a2
cmp ecx, 4
jne 0x14004a577
cmp dil, 0x43
jne 0x14004a577
inc dword [rsi + 8]
xor bpl, bpl
mov rbx, qword [rsi + 0x10]
mov word [rsp + 0x20], 0x305
mov byte [rsp + 0x22], 0
test rbx, rbx
je 0x14004a619
mov rdi, qword [rsi + 0x18]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14004a60c
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
mov r8, qword [rbx + 0x18]
call qword [rax]
test al, al
jne 0x14004a616
cmp rbx, rdi
je 0x14004a619
mov rbx, qword [rbx]
jmp 0x14004a5f1
mov bpl, 1
dec dword [rsi + 8]
lea rcx, [rsi + 8]
call fcn.140001b00
mov rbx, qword [rsp + 0x48]
movzx eax, bpl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140056280
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xor al, al
jmp 0x14004a62e
Function at 0x14004a650
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
push r14
sub rsp, 0x48
mov rax, qword [0x140098020]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rcx
movzx ebp, dl
xor edi, edi
movzx r14d, r8b
lea ecx, [rdi + 0x12]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 7
test al, 1
je 0x14004a6ac
cmp byte [rsi + 0xc0], dil
je 0x14004a6a7
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 7
test al, 1
je 0x14004a6a7
xor al, al
jmp 0x14004a74d
mov edi, 2
mov ecx, 0x11
mov qword [rsp + 0x40], rbx
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 7
mov ebx, edi
or ebx, 1
mov ecx, 0x10
and al, 1
cmove ebx, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov byte [rbp + rsi + 0x3c], r14b
mov ecx, ebx
or ecx, 4
shr eax, 7
and al, 1
mov byte [rsp + 0x22], bpl
mov word [rsp + 0x20], 0x101
cmove ecx, ebx
mov byte [rsp + 0x28], r14b
inc dword [rsi + 8]
xor bpl, bpl
mov rbx, qword [rsi + 0x10]
mov dword [rsp + 0x24], ecx
test rbx, rbx
je 0x14004a738
mov rdi, qword [rsi + 0x18]
nop
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14004a72b
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
mov r8, qword [rbx + 0x18]
call qword [rax]
test al, al
jne 0x14004a735
cmp rbx, rdi
je 0x14004a738
mov rbx, qword [rbx]
jmp 0x14004a710
mov bpl, 1
dec dword [rsi + 8]
lea rcx, [rsi + 8]
call fcn.140001b00
mov rbx, qword [rsp + 0x40]
movzx eax, bpl
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140056280
add rsp, 0x48
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400520b0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
lea rcx, [0x1400cd014]
call fcn.140056ac0
mov rax, qword [rbp + 0x178]
sub rax, 0x10000
mov rcx, rax
call fcn.140052350
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x170]
cmp qword [rbp + 8], rax
jbe 0x1400521d7
mov rax, qword [section..data]
cmp qword [rbp + 8], rax
jb 0x140052141
mov rax, qword [0x140098008]
cmp qword [rbp + 8], rax
ja 0x140052141
mov rax, qword [rbp + 8]
sub rax, 0x8000000
mov qword [rbp + 8], rax
jmp 0x140052106
mov r8d, 0x30
xor edx, edx
lea rcx, [rbp + 0x28]
call fcn.140058630
mov r8d, 0x30
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x14005216d
jmp 0x1400521d7
cmp dword [rbp + 0x48], 0x10000
jne 0x1400521bc
cmp qword [rbp + 0x40], 0x10000
jb 0x1400521bc
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
je 0x1400521ac
mov rax, qword [rbp + 0x78]
jmp 0x1400521d9
mov rax, qword [rbp + 8]
sub rax, 0x10000
mov qword [rbp + 8], rax
jmp 0x1400521d2
mov rax, qword [rbp + 0x30]
sub rax, 0x10000
mov rcx, rax
call fcn.140052350
mov qword [rbp + 8], rax
jmp 0x140052106
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.d2d1.dll_Ordinal_1
call fcn.140056a4c
mov rax, rdi
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret