joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140071e50
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp byte [rcx], 0
je 0x140071f25
mov rax, qword [0x140256f08]
test rax, rax
jne 0x140071f22
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140071f03
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140071f03
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
mov edx, 0xf2ef4349
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140071efe
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x140071ee0
cmp edx, 0x14504be
je 0x140071f35
test r8d, r8d
jne 0x140071ec0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x140071f19
cmp qword [rax + 0x30], 0
jne 0x140071e90
xor eax, eax
mov qword [0x140256f08], rax
call rax
nop
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140071f1b
Function at 0x1400746c0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov rax, qword [0x140256fa0]
test rax, rax
jne 0x140074792
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140074773
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140074773
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
mov edx, 0x8a7642f5
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x14007476e
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x140074750
cmp edx, 0x6455d8b2
je 0x1400747ae
test r8d, r8d
jne 0x140074730
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x140074789
cmp qword [rax + 0x30], 0
jne 0x140074700
xor eax, eax
mov qword [0x140256fa0], rax
mov rcx, qword [r14]
call rax
nop
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x14007478b
Function at 0x14007df00
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 7
mov rbx, rcx
jbe 0x14007df13
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmkdir]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400f5ce0
Function at 0x14007f680
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140152040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdx
movsd xmm0, qword [str.FSCLPTO]
movsd qword [rsp + 0x30], xmm0
mov edx, dword [0x140136338]
mov dword [rsp + 0x38], edx
movzx eax, byte [0x14013633c]
mov byte [rsp + 0x3c], al
xor ebp, ebp
mov ecx, ebp
cmp dword [0x140152090], 2
jl 0x14007f829
movdqa xmm5, xmmword [0x140138ff0]
movdqa xmm2, xmmword [0x140138f00]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.7777]
psubd xmm2, xmm0
movdqa xmm4, xmmword [0x140138fb0]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140139010]
movd xmm0, dword [str.FSCLPTO]
xorps xmm2, xmm0
movd dword [rsp + 0x30], xmm2
movdqa xmm2, xmmword [0x140138f30]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.7777]
psubd xmm2, xmm0
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140139010]
movd xmm0, dword [rsp + 0x34]
xorps xmm2, xmm0
movd dword [rsp + 0x34], xmm2
movdqa xmm3, xmmword [0x140138f60]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.7777]
psubd xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x140139010]
movd xmm0, edx
xorps xmm3, xmm0
movd dword [rsp + 0x38], xmm3
mov ecx, recv
mov eax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x37
movzx eax, cl
sub al, dl
add al, 0x35
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0xd
jl 0x14007f840
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], rbp
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bpl
jne 0x14007f885
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140079f10
nop
lea rbx, [rdi + 0x20]
mov qword [rsp + 0x30], rbx
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov ecx, 0x60
call fcn.140110588
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
cmp rdi, rsi
je 0x14007f8e9
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x14007f8dc
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
mov rcx, rdi
call fcn.1400f5f80
nop
mov rcx, rsi
call fcn.1400955d0
mov rax, rdi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010fe20
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140081940
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140152040]
xor rax, rsp
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [0x140137418]
mov eax, dword [0x140137440]
xor r9d, r9d
cmp dword [0x140152090], 2
mov ecx, r9d
movups xmm1, xmmword [0x140137428]
mov dword [0x140251128], 1
movups xmmword [rsp + 0x10], xmm0
mov word [0x14025112c], 0x100
movsd xmm0, qword [0x140137438]
movsd qword [rsp + 0x30], xmm0
mov byte [0x14025112e], 0
mov dword [0x140251130], 2
movups xmmword [rsp + 0x20], xmm1
mov dword [rsp + 0x38], eax
jl 0x140081aeb
movdqa xmm0, xmmword [0x140139010]
lea rdx, [rsp + 0x14]
movdqa xmm4, xmmword [0x140138f00]
movdqa xmm3, xmmword [0x140138ff0]
movdqa xmm5, xmmword [str.7777]
movdqa xmmword [rsp], xmm0
mov r8d, dword [rsp]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x140138fb0]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm4
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movd dword [rdx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x28
jl 0x140081a00
movaps xmm6, xmmword [rsp + 0x50]
cmp ecx, 0x2c
jge 0x140081b2c
movsxd rax, ecx
lea r8, [rsp + 0x10]
add r8, rax
nop word [rax + rax]
mov eax, 0x94f2095
lea r8, [r8 + 1]
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x37
movzx eax, cl
inc ecx
sub al, dl
add al, 0x35
xor byte [r8 - 1], al
cmp ecx, 0x2c
jl 0x140081b00
movups xmm0, xmmword [rsp + 0x10]
mov eax, dword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0x20]
mov dword [0x14025115c], eax
movups xmmword [0x140251134], xmm0
mov word [0x140251238], 0x100
movsd xmm0, qword [rsp + 0x30]
movsd qword [0x140251154], xmm0
movups xmmword [0x140251144], xmm1
mov qword [0x140251120], r9
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010fe20
add rsp, 0x68
ret
Function at 0x140084380
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push r14
sub rsp, 0x28
mov rax, qword [0x140256f40]
mov ebp, edx
mov r14d, ecx
test rax, rax
jne 0x140084472
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x20], rdi
mov r8, qword [rax + 0x18]
mov rax, qword [r8 + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140084444
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140084444
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x56ee3eb5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x14008443f
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140084420
cmp edx, 0xc13a5b59
je 0x140084496
test r8d, r8d
jne 0x140084400
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x14008445a
cmp qword [rax + 0x30], 0
jne 0x1400843d0
xor eax, eax
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x140256f40], rax
lea rcx, [rsp + 0x50]
call rax
mov edx, dword [rsp + 0x54]
xor r8d, r8d
mov ecx, dword [rsp + 0x50]
add edx, ebp
add ecx, r14d
call fcn.140083d30
add rsp, 0x28
pop r14
pop rbp
ret
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x14008445c

Function at 0x140088840
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140152040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov rbx, qword [0x140256d68]
mov rsi, qword [0x140256d70]
cmp rbx, rsi
je 0x1400888a3
nop dword [rax]
mov ecx, dword [rbx + 4]
cmp ecx, 0xffffffff
jne 0x14008888c
xor eax, eax
jmp 0x140088893
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0xf
test al, 1
jne 0x140088916
add rbx, 0x28
cmp rbx, rsi
jne 0x140088880
mov byte [rdi], 0
mov dword [rdi + 4], 0
xorps xmm0, xmm0
movups xmmword [rdi + 8], xmm0
mov qword [rdi + 0x18], 0
mov qword [rdi + 0x20], select
mov byte [rdi + 8], 0
mov dword [rdi + 4], 0xffffffff
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400844b0
mov rdx, rax
lea rcx, [rdi + 8]
call fcn.1400f4460
lea rcx, [rsp + 0x30]
call fcn.1400955d0
nop
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14010fe20
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
movzx ecx, byte [rbx]
mov byte [rdi], cl
mov ecx, dword [rbx + 4]
mov dword [rdi + 4], ecx
lea rdx, [rbx + 8]
lea rcx, [rdi + 8]
call fcn.140083b90
jmp 0x1400888f3
Function at 0x14008a110
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov rdi, rcx
add rcx, 0x18
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x14008a137
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [rdi + 0x64], 0x7fffffff
jne 0x14008a153
mov ecx, 6
mov dword [rdi + 0x64], 0x7ffffffe
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov qword [rsp + 0x30], rbx
mov rbx, qword [rdi + 0x70]
mov qword [rsp + 0x38], rsi
mov rsi, qword [rdi + 0x78]
cmp rbx, rsi
je 0x14008a18f
nop word [rax + rax]
mov ecx, dword [rbx + 4]
cmp ecx, 0xffffffff
jne 0x14008a17c
xor al, al
jmp 0x14008a182
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 1
mov byte [rbx], al
add rbx, 0x28
cmp rbx, rsi
jne 0x14008a170
mov rax, qword [rdi]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
cmp rax, qword [rdi + 8]
je case.default.0x14008a1b8
mov qword [rdi + 8], rax
lea rcx, [rdi + 0x18]
mov byte [rdi + 0x68], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.MSVCP140.dll__Mtx_unlock]

Function at 0x14008a1c0
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
push r14
sub rsp, 0x28
cmp byte [rcx + 0x98], 0
mov rdi, rcx
jne 0x14008a1e0
call fcn.14008a110
mov byte [rdi + 0x98], 1
lea rcx, [rdi + 0x18]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x14008a1fa
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [rdi + 0x64], 0x7fffffff
jne 0x14008a216
mov ecx, 6
mov dword [rdi + 0x64], 0x7ffffffe
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x20], r15
xor r15b, r15b
mov qword [rsp + 0x40], rdi
cmp byte [rdi + 0x94], r15b
je 0x14008a242
call fcn.14007df30
test al, al
je 0x14008a242
mov r15b, 1
xor sil, sil
jmp 0x14008a24f
lea rcx, [rsp + 0x40]
call fcn.14008a2f0
movzx esi, al
cmp dword [rdi + 0x90], 1
jne 0x14008a2b9
test sil, sil
jne 0x14008a2b9
mov qword [rsp + 0x48], rbx
mov rbx, qword [rdi + 0x70]
mov qword [rsp + 0x50], rbp
mov rbp, qword [rdi + 0x78]
mov rcx, rbp
sub rcx, rbx
sub rcx, 0x28
cmp rcx, 0x28
jb 0x14008a284
test r15b, r15b
je 0x14008a2af
cmp rbx, rbp
je 0x14008a2af
nop dword [rax]
mov ecx, dword [rbx + 4]
cmp ecx, 0xffffffff
jne 0x14008a29c
xor al, al
jmp 0x14008a2a2
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 1
mov byte [rbx], al
add rbx, 0x28
cmp rbx, rbp
jne 0x14008a290
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
cmp byte [rdi + 0x97], 0
mov r15, qword [rsp + 0x20]
je 0x14008a2cb
xor sil, 1
lea rcx, [rdi + 0x18]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
movzx eax, sil
mov rsi, qword [rsp + 0x58]
add rsp, 0x28
pop r14
pop rdi
ret
Function at 0x14008a570
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0x6666666666666667
mov rcx, qword [rcx]
mov rdi, qword [rcx + 0x78]
mov rbx, qword [rcx + 0x70]
mov rdx, rdi
sub rdx, rbx
imul rdx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x14008a699
mov ecx, dword [rcx + 0x90]
test ecx, ecx
je 0x14008a6ab
cmp ecx, 1
jne 0x14008a699
cmp rbx, rdi
je 0x14008a609
cmp byte [rbx], 0
mov ecx, dword [rbx + 4]
je 0x14008a5ed
cmp ecx, 0xffffffff
jne 0x14008a5e3
xor al, al
not al
jmp 0x14008a5fc
call qword [sym.imp.USER32.dll_GetKeyState]
not al
jmp 0x14008a5fc
cmp ecx, 0xffffffff
jne 0x14008a5f6
xor al, al
jmp 0x14008a5fc
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x14008a61b
add rbx, 0x28
cmp rbx, rdi
jne 0x14008a5d0
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rsi]
mov rdi, qword [rax + 0x78]
mov rbx, qword [rax + 0x70]
cmp rbx, rdi
je 0x14008a699
nop dword [rax + rax]
mov ecx, dword [rbx + 4]
cmp ecx, 0xffffffff
jne 0x14008a63c
xor eax, eax
jmp 0x14008a643
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0xf
test al, 1
jne 0x14008a690
cmp byte [rbx], 0
mov ecx, dword [rbx + 4]
je 0x14008a667
cmp ecx, 0xffffffff
jne 0x14008a65d
xor al, al
not al
jmp 0x14008a676
call qword [sym.imp.USER32.dll_GetKeyState]
not al
jmp 0x14008a676
cmp ecx, 0xffffffff
jne 0x14008a670
xor al, al
jmp 0x14008a676
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x14008a690
mov ecx, dword [rbx + 4]
cmp ecx, 0xffffffff
jne 0x14008a686
xor al, al
jmp 0x14008a68c
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 1
mov byte [rbx], al
add rbx, 0x28
cmp rbx, rdi
jne 0x14008a630
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rsi + 8]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x70]
mov rdi, qword [rcx + 0x78]
cmp rbx, rdi
je 0x14008a609
mov ecx, dword [rbx + 4]
cmp ecx, 0xffffffff
jne 0x14008a6cf
xor eax, eax
jmp 0x14008a6d6
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0xf
test al, 1
je 0x14008a699
add rbx, 0x28
cmp rbx, rdi
jne 0x14008a6c3
mov rbx, qword [rsp + 0x30]
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14009bf80
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 8], 0
mov rbx, rcx
jne 0x14009c0b7
mov rax, qword [rcx]
mov byte [rcx + 8], 1
call qword [rax + 0x18]
movzx r8d, byte [rbx + 0xa]
xor edx, edx
movzx eax, byte [rbx + 0xb]
test r8b, r8b
sete dl
cmp eax, edx
jne 0x14009bfd5
movzx ecx, byte [rbx + 0xc]
test r8b, r8b
setne al
add al, cl
cmp al, byte [rbx + 0xd]
jne 0x14009bfd5
sub cl, 0x56
cmp cl, byte [rbx + 0xe]
jne 0x14009bfd5
cmp byte [rbx + 0xf], r8b
je 0x14009c0b7
mov rax, qword [0x140257090]
test rax, rax
jne 0x14009c0ad
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x14009c084
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14009c084
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x6f02038f
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x14009c07f
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x14009c060
cmp edx, 0x31a0290f
je 0x14009c0bd
test r8d, r8d
jne 0x14009c040
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x14009c09a
cmp qword [rax + 0x30], 0
jne 0x14009c010
xor eax, eax
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov qword [0x140257090], rax
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp rax
add rsp, 0x20
pop rbx
ret
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x14009c09c
Function at 0x1400b9870
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rdi
sub rsp, 0x108
mov rax, qword [0x140152040]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbp, rcx
add rcx, 0x38
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x1400b98a9
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [rbp + 0x84], 0x7fffffff
jne 0x1400b98cb
mov ecx, 6
mov dword [rbp + 0x84], 0x7ffffffe
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov qword [rsp + 0x128], rbx
lea rcx, [rbp + 0x88]
mov qword [rsp + 0x130], rsi
mov qword [rsp + 0x100], r14
call fcn.14008e050
test al, al
je 0x1400b9a27
lea rcx, [0x140250df0]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
jne 0x1400b9a79
cmp dword [0x140250e3c], 0x7fffffff
jne 0x1400b9927
mov dword [0x140250e3c], 0x7ffffffe
jmp 0x1400b9a6d
mov rsi, qword [0x1402512e0]
lea rcx, [0x140250df0]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
cmp rsi, qword [0x140255490]
je 0x1400b9a27
mov r8d, 0xc8
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rcx, [rsp + 0x20]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400b9970
cmp qword [0x140256ac8], 0xf
lea rcx, [0x140256ab0]
mov r8, qword [0x140256ac0]
cmova rcx, qword [0x140256ab0]
cmp r8, rax
jne 0x1400b99aa
lea rdx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400b9a27
lea rcx, [rbp + 0x88]
call fcn.14008e050
test al, al
je 0x1400b9a27
nop word [rax + rax]
cmp byte [rbp + 8], 0
je 0x1400b9a27
lea rcx, [rbp + 0x38]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov ebx, 0xc8
nop word [rax + rax]
xor r9d, r9d
mov edx, 0x112
mov r8d, 0xf012
mov rcx, rsi
call qword [sym.imp.USER32.dll_PostMessageA]
sub rbx, 1
jne 0x1400b99e0
lea rcx, [rbp + 0x38]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
jne 0x1400b9a79
cmp dword [rbp + 0x84], 0x7fffffff
je 0x1400b9a63
lea rcx, [rbp + 0x88]
call fcn.14008e050
test al, al
jne 0x1400b99c0
lea rcx, [rbp + 0x38]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rsi, qword [rsp + 0x130]
mov rbx, qword [rsp + 0x128]
mov r14, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14010fe20
add rsp, 0x108
pop rdi
pop rbp
ret
mov dword [rbp + 0x84], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400d3f90
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140152040]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor esi, esi
lea rcx, [rsp + 0x68]
call fcn.14007c7f0
nop
mov r8d, 8
lea rdx, str._scripts
mov rcx, rax
call fcn.1400f40e0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, [rsp + 0x48]
movq rcx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 7
cmova rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.14007b450
mov rbx, rax
mov rcx, rax
cmp qword [rax + 0x18], 7
jbe 0x1400d402c
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmkdir]
mov rcx, rbx
call fcn.1400f5ce0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x1400d4081
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d407b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d407b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401101a0
nop
lea rcx, [rsp + 0x68]
call fcn.1400f5ce0
mov rbx, qword [0x140251d18]
mov rdi, qword [0x140251d20]
cmp rbx, rdi
je 0x1400d40f2
nop
mov rcx, rbx
call fcn.1400c1a30
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
lea rdx, [rbx + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1400d40c5
lea rcx, [rsp + 0x48]
call fcn.140079f10
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.1400d1d30
add rbx, 0x1d8
cmp rbx, rdi
jne 0x1400d40a0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14010fe20
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret