joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404d80fa
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov ah, 0xae
movzx ax, r9b
movsx ax, bpl
mov qword [rsp + 0x18], rbp
push rsi
push rdi
movzx rax, dx
setp al
push r14
mov eax, 0x1450
jmp 0x1404d8127
call fcn.1404445ff
sub rsp, rax
mov di, 0x1940
cwde
mov rax, qword [0x1400b7288]
movsxd rsi, edi
xor rax, rsp
mov qword [rsp + 0x1440], rax
bts r10w, sp
btc r10w, ax
movsxd r10, edx
or dl, 0x4f
xadd bpl, dil
mov rdi, rcx
sbb r14b, 0x2b
rcr dx, cl
mov rax, r10
add cx, r12w
mov ebp, r9d
movsxd r14, esp
mov r14b, al
sar rax, 6
clc
adc dl, r8b
sar cx, cl
lea rcx, [0x1400ba940]
and r10d, 0x3f
mov r14b, r12b
sets dh
shl sil, 0xb4
add rbp, r8
mov rsi, r8
bsf r14, r14
movzx r14d, bp
ror dl, cl
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
setbe r14b
cmc
mov r14b, dil
mov r14, qword [rax + rdx*8 + 0x28]
test r13b, r8b
jmp 0x1404d81c4
sub eax, eax
cmp eax, esp
cmc
mov qword [rdi], rax
clc
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404d81d8
jae 0x1404d82d7
lea rbx, [rsp + 0x40]
cmc
cmp rsi, rbp
jmp 0x1404d81ec
jae 0x1404d824c
mov al, byte [rsi]
jmp 0x1404d81f9
inc rsi
cmp r10b, r13b
stc
cmp al, 0xa
jne 0x1404d821b
inc dword [rdi + 8]
mov byte [rbx], 0xd
jmp 0x1404d8213
inc rbx
jmp 0x1404d821b
mov byte [rbx], al
movsx ax, r11b
inc rbx
sub rax, rcx
sar ah, cl
movzx rax, bx
lea rax, [rsp + 0x143f]
cmp r9d, r12d
stc
test r10b, 0xaa
cmp rbx, rax
jmp 0x1404d8246
jb 0x1404d81e4
and qword [rsp + 0x20], 0
sbb r9b, 0xa5
xadd r8w, cx
bswap r8d
lea rax, [rsp + 0x40]
xchg dl, dh
movzx dx, r15b
sub ebx, eax
movsx ecx, r11w
lea r9, [rsp + 0x30]
mov r8d, ebx
jmp 0x1404d8284
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x1404d8291
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d829e
je 0x1404d82c8
mov eax, dword [rsp + 0x30]
cmc
add dword [rdi + 4], eax
cmc
cmp eax, ebx
jb 0x1404d82d7
cmp rsi, rbp
jmp 0x1404d82bd
jb 0x1404d81de
jmp 0x1404d82d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
sar rcx, 0x66
and al, spl
mov rax, rdi
movsxd rcx, r9d
ror cx, cl
bts cx, dx
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1404d82f4
call fcn.14049bac2
lea r11, [rsp + 0x1450]
movzx r14d, bx
mov rbx, qword [r11 + 0x20]
mov r14b, r15b
mov rbp, qword [r11 + 0x30]
movzx si, sil
mov rsp, r11
cmovbe rsi, rbx
not r14b
pop r14
movsx edi, bp
not si
pop rdi
pop rsi
ret
Function at 0x1404d832a
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
nop
mov qword [rsp + 0x18], rbp
movsx rax, di
push rsi
cdqe
push rdi
bswap ax
push r14
cbw
jmp 0x1404d8357
mov eax, 0x1450
jmp 0x1404d8361
call fcn.1404445ff
sub rsp, rax
xor rdi, 0x256067c0
ror bpl, cl
mov rax, qword [0x1400b7288]
movsx rsi, r8w
inc di
rol bpl, cl
xor rax, rsp
rcl r10w, cl
mov qword [rsp + 0x1440], rax
and dil, dl
sbb sil, r11b
movsxd r10, edx
shr r14w, cl
adc rsi, rdi
mov rdi, rcx
bts rax, rdx
mov rax, r10
rol rbp, cl
mov ebp, r9d
sal esi, cl
shr dh, 0x3f
sub cl, 0x3c
sar rax, 6
lea rcx, [0x1400ba940]
sub r14b, r13b
and r10d, 0x3f
shr r14d, 0x6e
add rbp, r8
rcr sil, cl
mov rsi, r8
mov rax, qword [rcx + rax*8]
movzx r14d, r15w
lea rdx, [r10 + r10*8]
or r14w, r11w
or r14b, 0xe5
test bx, r9w
mov r14, qword [rax + rdx*8 + 0x28]
test spl, 0xa2
stc
test r12, rdx
xor eax, eax
test dh, 0x7c
cmc
mov qword [rdi], rax
cmp cl, r11b
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404d8416
jae 0x1404d851b
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404d8429
jae 0x1404d8481
movzx eax, word [rsi]
add rsi, 2
cmp r11w, r9w
cmp ax, 0xa
jne 0x1404d845d
add dword [rdi + 8], 2
mov ecx, 0xd
mov word [rbx], cx
add rbx, 2
jmp 0x1404d845d
mov word [rbx], ax
dec ah
lahf
add rbx, 2
stc
sbb al, r10b
lea rax, [rsp + 0x143e]
cmp rbx, rax
jmp 0x1404d847b
jb 0x1404d8421
and qword [rsp + 0x20], 0
and r9d, 0x7434aca
sbb r9w, 0x5c0a
lea rax, [rsp + 0x40]
or r9b, dl
cmc
sub rbx, rax
or dx, 0x7037
or r8b, r9b
lea r9, [rsp + 0x30]
test r9w, r9w
sar rbx, 1
lea rdx, [rsp + 0x40]
ror cl, cl
sub cl, r9b
neg r8b
add ebx, ebx
movzx r8d, r10w
cmova r8w, di
mov rcx, r14
mov r8d, ebx
jmp 0x1404d84d7
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404d8513
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
test al, r12b
cmp bx, r14w
cmp eax, ebx
jmp 0x1404d84fa
jb 0x1404d851b
cmp rsi, rbp
jmp 0x1404d8508
jb 0x1404d841c
jmp 0x1404d851b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
cmp ebx, ebp
xor rcx, rsp
jmp 0x1404d8530
call fcn.14049bac2
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
cmovp si, bp
movzx r14w, r13b
xchg dil, dil
mov rbp, qword [r11 + 0x30]
mov si, ax
mov rsp, r11
setno dil
jmp 0x1404d8560
pop r14
movzx rsi, di
movsx edi, r15w
pop rdi
pop rsi
jmp 0x1404d8571
ret
Function at 0x1404d8572
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
movsx ax, spl
mov ah, 0x52
push rsi
movzx ax, spl
push rdi
cwde
lahf
jmp 0x1404d85a3
push r12
push r14
lahf
movzx eax, r8w
movsxd rax, esi
push r15
movzx rax, r9w
seta ah
bswap ax
mov eax, 0x1470
call fcn.1404445ff
sub rsp, rax
jmp 0x1404d85cd
mov rax, qword [0x1400b7288]
xor rax, rsp
sal bh, 0x48
adc r15b, 0x54
adc dil, spl
mov qword [rsp + 0x1460], rax
cmp r10w, sp
movsxd r10, edx
or r12b, dil
dec r15b
test r15w, si
mov rbx, rcx
movzx eax, bx
sbb r15b, 0x68
mov rax, r10
mov r14d, r9d
sar rax, 6
sar cl, cl
lea rcx, [0x1400ba940]
sar dl, 0xe
and r10d, 0x3f
sub dl, 0x38
add r14, r8
ror dx, cl
mov r15, r8
rcl dh, 0x4d
mov rdi, r8
clc
not r12b
shr dx, cl
mov rax, qword [rcx + rax*8]
test edx, 0x145b0894
lea rdx, [r10 + r10*8]
btr r12w, 0x40
movsxd r12, ecx
mov r12, qword [rax + rdx*8 + 0x28]
test r12b, 0x4d
cmp r9, 0x77366727
sub eax, eax
mov qword [rbx], rax
stc
cmp r8, r14
jmp 0x1404d866c
mov dword [rbx + 8], eax
jae 0x1404d8823
lea rax, [rsp + 0x50]
cmc
cmp rdi, r14
jae 0x1404d86da
movzx ecx, word [rdi]
stc
add rdi, 2
cmp r8b, 0xe3
cmp cx, 0xa
jmp 0x1404d8699
jne 0x1404d86b4
mov edx, 0xd
mov word [rax], dx
cmc
cmp spl, r13b
jmp 0x1404d86b0
add rax, 2
mov word [rax], cx
add rax, 2
rcr rcx, 0x86
cmc
lea rcx, [rsp + 0x6f8]
cmp bh, 0xa4
clc
cmp rax, rcx
jmp 0x1404d86d4
jb 0x1404d867b
and qword [rsp + 0x38], 0
rcl r9w, cl
lea rcx, [rsp + 0x50]
and qword [rsp + 0x30], 0
sbb r9w, 0x563b
lea r8, [rsp + 0x50]
movzx r9w, cl
sbb r9, 0x70cd3a73
sar r9d, cl
sub rax, rcx
shl r9b, cl
sbb ch, 0x90
mov dword [rsp + 0x28], 0xd55
lea rcx, [rsp + 0x700]
bt r9, 0x2e
add r9d, 0x7b104088
rcl r9, cl
sar rax, 1
movzx r9w, r8b
mov qword [rsp + 0x20], rcx
shr r9b, cl
mov r9d, eax
mov ecx, 0xfde9
cmp r8b, 0x4f
cmc
sub edx, edx
call fcn.1404c56bb
mov ebp, eax
clc
cmp r11d, ebx
test eax, eax
je 0x1404d8810
xor esi, esi
jmp 0x1404d8770
test eax, eax
jmp 0x1404d8777
je 0x1404d87e7
and qword [rsp + 0x20], 0
sbb r9b, dl
mov rdx, 0x47616f09
lea rdx, [rsp + 0x700]
sub cl, r13b
btc ecx, 0x4e
mov ecx, esi
lea r9, [rsp + 0x40]
bsf r8w, r12w
rcr r8, 0x96
ror r8b, 0x52
mov r8d, ebp
cmc
test r14b, 0xea
add rdx, rcx
mov rcx, r12
cmc
stc
sub r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404d8810
add esi, dword [rsp + 0x40]
jmp 0x1404d87da
cmp esi, ebp
jmp 0x1404d87e1
jb 0x1404d877d
mov eax, edi
sub eax, r15d
cmp r12, 0x65520372
cmp r12w, r13w
mov dword [rbx + 4], eax
clc
cmp r15, rbx
jmp 0x1404d8803
cmp rdi, r14
jmp 0x1404d880b
jmp 0x1404d866f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
bts ecx, edx
add eax, 0x1da709b5
xor al, r8b
mov rax, rbx
bsr ecx, eax
bswap rcx
mov rcx, qword [rsp + 0x1460]
xor rcx, rsp
call fcn.14049bac2
lea r11, [rsp + 0x1470]
jmp 0x1404d884c
mov rbx, qword [r11 + 0x30]
movzx r14, r10w
movsxd r15, edx
mov rbp, qword [r11 + 0x40]
mov rsp, r11
bswap edi
mov r14, r10
movsx r12, ax
pop r15
not si
mov rsi, 0xc00538e
pop r14
mov si, 0x3abd
pop r12
pop rdi
jmp 0x1404d8885
pop rsi
ret
Function at 0x1404dbf08
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
seto r8b
jmp 0x1404dbf1b
mov ebx, ecx
mov dx, di
jmp 0x1404dbf25
lea r9, [0x1400c8ea0]
movzx ecx, dx
setne ch
cwd
mov ecx, 2
mov r8b, 0xe5
lea r8, [0x1400c8e98]
cqo
lea rdx, [0x1400cf758]
jmp 0x1404dbf51
call fcn.1404dc0e5
mov ecx, ebx
test rax, rax
je 0x1404dbf74
add rsp, 0x20
xchg bl, bh
pop rbx
jmp 0x1404dbf6d
jmp qword [case.0x140162398.0]
add rsp, 0x20
movzx ebx, sp
movsx ebx, cx
pop rbx
jmp 0x1404dbf84
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404dbf8b
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
sbb r8, 0x363c3c41
push rdi
shld r9w, r14w, 0x70
rol dil, 0xb
sub rsp, 0x20
movzx r9w, r10b
mov bl, 3
mov rbx, rdx
mov r8, rbp
movsx r9d, r8w
lea r9, [0x1400c8ea8]
movsx rdi, r8w
mov edi, ecx
mov r8b, 0xbb
movsx cx, bl
lea rdx, [0x1400cf748]
movsx rcx, dx
mov r8b, 0x22
mov ecx, 3
mov r8b, sil
movsxd r8, r11d
movzx r8w, dl
lea r8, [0x1400c8ea0]
jmp 0x1404dbff5
call fcn.1404dc0e5
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x1404dc013
call qword [case.0x140162398.0]
jmp 0x1404dc019
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
btc di, sp
setg dil
add rsp, 0x20
pop rdi
jmp 0x1404dc030
ret
Function at 0x140002228
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rbx, qword [rdx]
mov rsi, rcx
lea rcx, [rbp + 0x20]
mov r14d, r8d
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rbp + 0x20]
lea rdx, [rbp + 0x20]
mov rcx, rbx
mov dword [rdi + 0x290], eax
mov eax, dword [rbp + 0x24]
mov dword [rdi + 0x294], eax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rbp + 0x20]
mov ecx, dword [rbp + 0x24]
cmp eax, dword [rdi + 0x298]
jne 0x1400022f8
cmp ecx, dword [rdi + 0x29c]
jne 0x1400022f8
mov ecx, dword [rsi + 0x18]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [rsi + 0x1c]
movzx r15d, ax
shr r15d, 0xf
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
shr ebx, 0xf
cmp r15d, dword [rdi + 0x2a0]
jne 0x14009580d
test r14d, r14d
je 0x1400022c8
mov dword [rdi + 0x2a0], r15d
cmp ebx, dword [rdi + 0x2a4]
jne 0x140095894
test r14d, r14d
je 0x1400022df
mov dword [rdi + 0x2a4], ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
mov dword [rdi + 0x298], eax
mov dword [rdi + 0x29c], ecx
cmp r14d, 1
jl 0x14000228f
jmp 0x1400957f0
mov dword [rsp + 0x20], ecx
mov r9d, eax
mov r8, rdi
mov rcx, rsi
mov edx, 0xfffffff5
call fcn.140079f54
nop
jmp 0x14000228f
cmp r14d, 1
jl 0x1400022bc
cmp byte [rdi + 0x2e0], 0
je 0x1400022bc
mov eax, dword [rbp + 0x24]
mov r9d, dword [rbp + 0x20]
mov r8, rdi
mov rcx, rsi
mov dword [rsp + 0x20], eax
test r15d, r15d
je 0x140095841
mov edx, 0xfffffff9
jmp 0x140095883
mov edx, 0xfffffff8
call fcn.140079f54
cmp byte [rdi + 0x2a8], 0
je 0x140095888
mov rcx, qword [rdi]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r9d, dword [rbp + 0x20]
mov r8, rdi
bt eax, 0x18
mov eax, dword [rbp + 0x24]
mov rcx, rsi
mov dword [rsp + 0x20], eax
mov edx, 0xfffffffa
jb 0x140095883
mov edx, 0xfffffff4
call fcn.140079f54
mov byte [rdi + 0x2a8], 0
jmp 0x1400022bc
cmp r14d, 1
jl 0x1400022d4
mov eax, dword [rbp + 0x24]
mov r9d, dword [rbp + 0x20]
mov r8, rdi
mov rcx, rsi
mov edx, 0xfffffff7
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x1400958bd
mov edx, 0xfffffff6
call fcn.140079f54
nop
jmp 0x1400022d4
Function at 0x140004650
Capabilities:
Hide graphical window

Disassembly:
mov r11, rsp
sub rsp, 0x68
and qword [r11 - 0x10], 0
mov rax, qword [0x1400dce68]
lea rdx, [0x1400b19a0]
mov qword [r11 - 0x18], rax
and qword [r11 - 0x20], 0
and qword [r11 - 0x28], 0
mov eax, 0x80000000
mov dword [rsp + 0x38], 0x64
mov dword [rsp + 0x30], 0x12c
mov dword [rsp + 0x28], eax
mov r9d, 0xcf0000
mov r8, rdx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
and qword [rsp + 0x58], 0
mov rcx, qword [0x1400dce68]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, str.edit
mov r9d, 0x50b008c4
xor r8d, r8d
xor ecx, ecx
mov qword [0x1400dcec0], rax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, qword [0x1400dcec0]
xor edx, edx
mov qword [0x1400dceb8], rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400dcec0]
xor edx, edx
add rsp, 0x68
jmp qword [sym.imp.USER32.dll_ShowWindow]

Function at 0x140004e98
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
mov word [rcx + 8], 1
mov eax, 5
mov rbx, rcx
mov dword [rcx], eax
mov dword [rcx + 4], eax
xor eax, eax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov dword [rcx + 0x20], eax
mov dword [rcx + 0xc], 4
lea ecx, [rax + 0x5b]
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
lea ecx, [rdx + 0x10]
mov byte [rbx + 0x35], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
mov ecx, QueryPathOfRegTypeLib
mov byte [rbx + 0x32], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
mov ecx, QueryPathOfRegTypeLib
mov byte [rbx + 0x33], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
lea ecx, [rdx + 0x11]
mov byte [rbx + 0x34], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
lea ecx, [rdx + 0x12]
mov byte [rbx + 0x30], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [rbx + 0x31], al
add rsp, 0x20
pop rbx
ret
Function at 0x140005324
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x1ff70]
mov eax, 0x20070
call fcn.140039ca0
sub rsp, rax
lea rcx, [rsp + 0x50]
mov rsi, rdx
call fcn.1400130b8
lea rdx, [rsp + 0x70]
xor bl, bl
mov ecx, 0x7fff
mov byte [rbp + 0x1ffa0], bl
xor dil, dil
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea r8, [rbp + 0x1ffb0]
mov rdx, rsi
call fcn.1400054c8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400859c8
mov eax, dword [0x1400dcf40]
test eax, eax
je 0x1400054b6
mov r15d, 1
lea rcx, [0x1400ded40]
cmp eax, r15d
je 0x1400859ea
lea rax, [rbp + 0x1ffa0]
lea r8, [0x1400dcf40]
lea rdx, [0x1400dcf68]
mov qword [rsp + 0x20], rax
call fcn.140005068
test al, al
je 0x1400054bf
mov al, byte [0x1400ded40]
mov rcx, qword [0x1400dcf68]
mov dil, byte [0x1400ded41]
lea r9, [rbp + 0x1ffb8]
lea r8, [rbp + 0xff70]
mov edx, 0x7fff
mov byte [0x1400dcf44], al
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov rdx, qword [rbp + 0x1ffb8]
lea rcx, [0x1400dcf20]
call fcn.1400084d0
mov bl, byte [rbp + 0x1ffa0]
mov r8d, dword [0x1400dcf40]
lea rdx, [0x1400dcf68]
call fcn.140006810
test eax, eax
jne 0x140085a0e
cmp dil, r15b
je 0x140085a31
call fcn.14000413c
call fcn.140004650
cmp byte [0x1400dcf44], 0
jne 0x140005463
lea rcx, [0x1400dd970]
call fcn.140006494
lea rcx, [0x1400dcf90]
mov edx, r15d
call fcn.14000bba0
cmp byte [0x1400dcf44], 0
jne 0x140005487
lea rcx, [0x1400dd970]
call fcn.140004974
lea rcx, [0x1400ded40]
call fcn.140004bf0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [rsp + 0x50]
call fcn.14000876c
add rsp, 0x20070
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
or dword [0x1400dce70], 0xffffffff
jmp 0x140005493
mov dword [0x1400dce70], r15d
jmp 0x140005493
lea r8, [0x1400c70cc]
lea rdx, str.This_is_a_third_party_compiled_AutoIt_script.
mov r9d, reloc.WSOCK32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
jmp 0x14000549e
mov r8, qword [0x1400dcf48]
or r9d, 0xffffffff
mov edx, r15d
call fcn.14004e348
mov al, byte [0x1400dce76]
mov byte [0x1400ded42], al
jmp 0x140005420
lea rcx, [0x1400ded40]
call fcn.140004bf0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x1400dce70], r15d
jmp 0x14000549e
call fcn.140054260
test al, al
jne 0x140005444
cmp byte [rbp + 0x1ffb0], al
jne 0x140005444
lea rcx, [rsp + 0x50]
call fcn.1400067bc
lea rdx, [0x1400b199c]
lea rcx, [rsp + 0x30]
call fcn.1400177c0
lea rcx, [rsp + 0x30]
test bl, bl
je 0x140085a99
lea rdx, [0x1400c7100]
call fcn.140004f98
lea rdx, [0x1400dcf68]
lea rcx, [rsp + 0x30]
call fcn.1400074a4
lea rdx, [0x1400c7100]
lea rcx, [rsp + 0x30]
jmp 0x140085a9c
mov rdx, rsi
call fcn.140004f98
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x70]
lea rdx, str.runas
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x30]
call fcn.14000876c
nop
jmp 0x140005487
Function at 0x140006284
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rcx, r9
mov rsi, r9
call fcn.140007b14
lea rax, [rbp + 0x28]
xor ebx, ebx
lea rdx, str.SoftwareAutoIt_v3AutoIt
lea r9d, [rbx + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140088ada
xor al, al
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x30]
lea rdx, str.Include
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140088b7e
mov ecx, dword [rbp + 0x30]
mov eax, 2
inc ecx
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140029168
lea rcx, [rbp - 0x10]
mov rdx, rax
call fcn.140003b30
mov rdi, qword [rbp - 0x10]
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x30]
lea rdx, str.Include
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140088b75
mov eax, dword [rbp + 0x30]
mov rdx, rdi
mov rcx, rsi
shr eax, 1
mov dword [rbp + 0x30], eax
mov word [rdi + rax*2], bx
call fcn.1400084d0
mov bl, 1
lea rcx, [rbp - 0x10]
call fcn.140003b04
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x1400062d8

Function at 0x140006db8
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x30], 0
cmp byte [rcx + 0x20], 0
mov r10, r9
mov r11, r8
mov rbx, rdx
jne 0x140089d7a
mov r9, qword [rsp + 0x50]
mov r8, r10
mov rdx, r11
mov rcx, rbx
call fcn.14002cc44
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx + 0x18]
imul r10d, r11d
lea r9, [rsp + 0x30]
mov rax, qword [rcx]
mov r8d, r10d
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rax, qword [rsp + 0x30]
jmp 0x140006dea

Function at 0x140006e18
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x10020
call fcn.140039ca0
sub rsp, rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400084d0
add rsp, 0x10020
pop rbx
ret
Function at 0x140008c40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x10], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x140008ce8
xor edi, edi
test rsi, rsi
je 0x140008c93
nop
mov eax, dword [rbx + 0x10]
cmp dword [rbx + 0x14], eax
je 0x140008caf
movsxd rdx, dword [rbx + 0x14]
mov rcx, qword [rbx + 8]
inc rdi
movzx edx, byte [rdx + rcx]
mov byte [rdi + rbp - 1], dl
inc dword [rbx + 0x14]
cmp rdi, rsi
jb 0x140008c70
add qword [rbx + 0x18], rdi
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx]
lea r9, [rsp + 0x40]
mov r8d, 0x10000
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140008c93
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140008c93
mov dword [rbx + 0x10], eax
mov dword [rbx + 0x14], 0
jmp 0x140008c78
mov qword [rcx + 0x10], 0
call fcn.1400079f4
jmp 0x140008c67
Function at 0x140022fc8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x270
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140088a52
add rsp, 0x270
pop rbx
ret
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x140088a6e
or eax, 0xffffffff
jmp 0x140022fe3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x20]
jmp 0x140022fe3

Function at 0x140023b4c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov esi, r9d
mov rbp, r8
test r8, r8
je 0x140088b90
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x140088b90
lea rax, [r11 - 0x18]
lea r9d, [rbx + 1]
xor r8d, r8d
mov qword [r11 - 0x28], rax
mov word [rdi], bx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140088b90
mov rcx, qword [rsp + 0x30]
lea eax, [rsi + rsi]
xor r9d, r9d
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140023be1
mov eax, dword [rsp + 0x60]
shr eax, 1
mov dword [rsp + 0x60], eax
cmp eax, esi
jae 0x140023c03
mov word [rdi + rax*2], bx
mov bl, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
lea eax, [rsi - 1]
jmp 0x140023bdb
xor al, al
jmp 0x140023bee
Function at 0x140024c14
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor ecx, ecx
mov r15, r9
mov r13, rdx
lea ebx, [rcx + 1]
mov edi, ecx
mov ebp, ecx
cmp qword [rdx + 8], rcx
je 0x1400881ea
mov rax, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xb0]
mov byte [rax], cl
mov byte [r12], cl
mov byte [r14], cl
mov byte [r9], cl
mov dword [r8], ecx
mov rsi, rax
movsxd rdx, edi
mov rcx, r13
call fcn.14000807c
movzx ecx, word [rax]
lea eax, [rcx - 0x21]
cmp ax, 0x3d
jbe 0x1400881f1
movsxd rdx, edi
add edi, ebx
mov rcx, r13
mov dword [rsp + 0x90], edi
call fcn.14000807c
mov rsi, qword [rsp + 0xa0]
movzx ecx, word [rax]
cmp cx, 0x7b
jne 0x14008827a
lea rcx, [rsp + 0x30]
mov edx, 0x40
call fcn.140018c40
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x30]
mov edx, 0x7d
mov r8, r13
mov qword [rsp + 0x20], rax
call fcn.140024d6c
test al, al
je 0x140024d66
lea rdi, [0x1400d6f60]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rdi]
call fcn.140029694
test eax, eax
je 0x140024d15
lea rax, str.align
add rdi, 8
add ebp, ebx
cmp rdi, rax
jl 0x140024cf2
cmp ebp, 0x62
je 0x140088236
lea rcx, [0x140000000]
movsxd rax, ebp
cmp byte [rax + rcx + 0xd6ef0], 0
jne 0x140024d66
movzx eax, byte [rax + rcx + 0xd6e80]
mov dword [rsi], eax
lea rcx, [rsp + 0x30]
call fcn.14000876c
and dword [rsi], 0xff
mov al, bl
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor bl, bl
jmp 0x140024d3c
lea rcx, [rsp + 0x30]
call fcn.14000876c
xor al, al
jmp 0x140024d4e
movabs rdx, 0x2000000000000405
bt rdx, rax
jae 0x140024c90
cmp cx, 0x2b
jne 0x140088210
mov byte [r15], bl
jmp 0x14008822f
cmp cx, 0x5e
jne 0x14008821b
mov byte [r14], bl
jmp 0x14008822f
cmp cx, 0x21
jne 0x140088227
mov byte [r12], bl
jmp 0x14008822f
cmp cx, 0x23
jne 0x14008822f
mov byte [rsi], bl
add edi, ebx
jmp 0x140024c75
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.1400187b4
movzx ecx, word [rax]
call qword [sym.imp.USER32.dll_VkKeyScanW]
movsx ecx, ax
mov dword [rsi], ecx
cmp ecx, 0xffffffff
je 0x1400881e0
bt ecx, 9
jae 0x14008825e
mov byte [r14], bl
bt ecx, 0xa
jae 0x140088268
mov byte [r12], bl
bt ecx, 8
jae 0x140024d3c
mov byte [r15], bl
jmp 0x140024d3c
call qword [sym.imp.USER32.dll_VkKeyScanW]
movsx ecx, ax
mov dword [rsi], ecx
cmp ecx, 0xffffffff
je 0x1400881ea
bt ecx, 9
jae 0x140088297
mov byte [r14], bl
bt ecx, 0xa
jae 0x1400882a1
mov byte [r12], bl
bt ecx, 8
jae 0x140024d46
mov byte [r15], bl
jmp 0x140024d46