joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006f6e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x1e0]
cmp dword [rax + 0x10], 0
je 0x14006f718
mov r8d, reloc.WS2_32.dll_listen
mov dword [rbx + 0xab8], 0xd
mov dl, 1
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14006f830
cmp byte [rcx + 0xf0e], 0
je 0x14006f730
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140070220
cmp byte [rcx + 0xf11], 0
je 0x14006f7d1
mov r8, qword [rbx + 0xa88]
test r8, r8
jne 0x14006f78b
mov r8, qword [rcx + 0xc08]
test r8, r8
jne 0x14006f76e
cmp byte [rcx + 0xf0d], 0
lea rax, str.NLST
lea r8, str.LIST
cmovne r8, rax
lea rcx, [rbx + 0xa00]
lea rdx, str.PRET__s
call fcn.140085f20
test eax, eax
je 0x14006f7c1
add rsp, 0x20
pop rbx
ret
cmp byte [rcx + 0xf1d], 0
lea rcx, [rbx + 0xa00]
je 0x14006f7b1
lea rdx, str.PRET_STOR__s
call fcn.140085f20
test eax, eax
je 0x14006f7c1
add rsp, 0x20
pop rbx
ret
lea rdx, str.PRET_RETR__s
call fcn.140085f20
test eax, eax
jne 0x14006f7de
mov dword [rbx + 0xab8], 0x1d
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140070190
add rsp, 0x20
pop rbx
ret

Function at 0x14006fb20
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
mov rdx, qword [rax + 0x1e0]
cmp dword [rdx + 0x10], 0
je 0x14006fb6d
cmp qword [rcx + 0xa88], 0
je 0x14006fb6d
add rcx, 0xa00
lea rdx, str.REST__d
xor r8d, r8d
call fcn.140085f20
test eax, eax
jne 0x14006fb77
mov dword [rbx + 0xab8], 0x1a
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp fcn.14006f6e0
add rsp, 0x20
pop rbx
ret

Function at 0x14006fd00
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0xa00
mov rax, qword [rbx]
mov rdx, qword [rax + 0x1e0]
cmp dword [rdx + 0x10], 1
jne 0x14006fd4c
mov r8, qword [rcx + 0x88]
test r8, r8
je 0x14006fd4c
lea rdx, str.SIZE__s
call fcn.140085f20
test eax, eax
jne 0x14006fd59
mov dword [rbx + 0xab8], 0x17
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14006fb20
add rsp, 0x20
pop rbx
ret

Function at 0x14006fd60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov r9, qword [rcx]
cmp byte [r9 + 0xf1c], 0
je 0x14006fdb8
cmp qword [rcx + 0xa88], 0
je 0x14006fdb8
cmp byte [r9 + 0xf0b], 0
mov eax, 0x41
mov edx, 0x49
cmovne edx, eax
movsx eax, byte [rcx + 0xaa8]
cmp eax, edx
je 0x14006fdb8
mov rax, qword [r9 + 0x1e0]
mov r8d, reloc.WS2_32.dll_send
mov dword [rax + 0x10], 1
movzx edx, byte [r9 + 0xf0b]
jmp fcn.14006e600
jmp fcn.14006fd00
Function at 0x14006fdc0
Capabilities:
Check http status code

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
lea eax, [rdx - 0xc8]
mov rdi, rcx
mov rcx, qword [rcx]
mov esi, r8d
cmp eax, 0x64
jb 0x14006fdf5
lea rdx, str.Couldnt_set_desired_mode
call fcn.140051f10
lea eax, [rbx + 0x11]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
cmp edx, 0xc8
je 0x14006fe0c
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.140052090
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r14
cmp esi, 0x13
jne 0x14006fe28
mov rcx, rdi
call fcn.14006fd00
jmp 0x14006ff5f
cmp esi, 0x14
jne 0x14006ff41
mov rsi, qword [rdi]
mov rbp, rbx
cmp dword [rsi + 0xba0], 2
jne 0x14006fea9
mov rax, qword [rsi + 0x1e0]
mov rdx, qword [rax]
test rdx, rdx
je 0x14006fea9
mov byte [rsp + 0x28], 1
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov qword [rsp + 0x50], rbx
call fcn.14003ac00
test eax, eax
jne 0x14006ff5f
mov rcx, qword [rsp + 0x50]
lea edx, [rax + 0x2f]
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x14006fe9e
mov rbp, qword [rsp + 0x50]
mov ecx, 1
sub rax, rbp
cmovne rcx, rax
mov byte [rcx + rbp], bl
jmp 0x14006fea9
mov rcx, qword [rsp + 0x50]
call qword [fcn.14008c69a]
mov rdx, qword [rsi + 0xc08]
test rdx, rdx
jne 0x14006fecd
cmp byte [rsi + 0xf0d], bl
lea rax, str.NLST
lea rdx, str.LIST
cmovne rdx, rax
lea r8, [0x1400906e8]
test rbp, rbp
mov r9, r8
lea rax, [0x14009ccac]
cmovne r9, rbp
lea rcx, [0x1400a14f8]
cmovne r8, rax
call fcn.14003fe40
mov rcx, rbp
mov r14, rax
call qword [fcn.14008c69a]
test r14, r14
jne 0x14006ff0c
lea ebx, [r14 + 0x1b]
jmp 0x14006ff61
lea rcx, [rdi + 0xa00]
mov r8, r14
lea rdx, [0x1400a5d00]
call fcn.140085f20
mov rcx, r14
mov esi, eax
call qword [fcn.14008c69a]
test esi, esi
je 0x14006ff35
mov ebx, esi
jmp 0x14006ff61
mov dword [rdi + 0xab8], 0x1f
jmp 0x14006ff61
cmp esi, 0x15
jne 0x14006ff4c
lea r8d, [rsi - 8]
jmp 0x14006ff55
cmp esi, 0x16
jne 0x14006ff61
lea r8d, [rsi - 8]
mov dl, 1
mov rcx, rdi
call fcn.14006f830
mov ebx, eax
mov r14, qword [rsp + 0x60]
mov eax, ebx
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x140075850
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
cmp byte [rcx + 0xf1e], 0
movsxd r10, r9d
je 0x140075974
cmp r8d, 0xff
jne 0x1400758b1
lea eax, [r10 - 0xec]
cmp eax, 0x13
ja 0x14007589b
lea r8, [0x140000000]
mov r9, qword [r8 + r10*8 + 0xa7880]
mov r8, rdx
lea rdx, str._s_IAC__s_n
add rsp, 0x38
jmp fcn.140052090
mov r8, rdx
mov r9d, r10d
lea rdx, str._s_IAC__d_n
add rsp, 0x38
jmp fcn.140052090
cmp r8d, 0xfb
jne 0x1400758c3
lea r9, str.WILL
jmp 0x140075901
cmp r8d, 0xfc
jne 0x1400758d5
lea r9, str.WONT
jmp 0x140075901
cmp r8d, 0xfd
jne 0x1400758e7
lea r9, [0x1400a82a4]
jmp 0x140075901
xor r9d, r9d
lea rax, str.DONT
cmp r8d, 0xfe
cmove r9, rax
test r9, r9
je 0x14007595d
cmp r10d, 0x27
jg 0x140075934
lea r8, [0x140000000]
mov r8, qword [r8 + r10*8 + 0xa7ea0]
test r8, r8
jne 0x140075944
mov r8, rdx
mov dword [rsp + 0x20], r10d
lea rdx, str._s__s__d_n
call fcn.140052090
add rsp, 0x38
ret
cmp r10d, 0xff
jne 0x14007591b
lea r8, str.EXOPL
mov qword [rsp + 0x20], r8
mov r8, rdx
lea rdx, str._s__s__s_n
call fcn.140052090
add rsp, 0x38
ret
mov r9d, r8d
mov dword [rsp + 0x20], r10d
mov r8, rdx
lea rdx, str._s__d__d_n
call fcn.140052090
add rsp, 0x38
ret

Function at 0x140075cc0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
mov edi, r8d
mov esi, edx
mov byte [rax + 0x10], 0xff
xor r9d, r9d
mov byte [rax + 0x11], sil
mov rbx, rcx
mov byte [rax + 0x12], dil
mov rcx, qword [rcx + 0x4c0]
lea rdx, [rax + 0x10]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140075d1f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.140051f10
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.140075850
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140075ed0
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x140076078
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x140075f35
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x140075f35
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x140075f35
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x140075f6c
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x140075fc2
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140075fc2
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140075fc2
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140075fc2
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140075fc2
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.140075980
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x140076024
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.140051f10
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.140075d50
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140076070
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.140051f10
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400777e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1401c4400]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x140077875
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x1400778d6
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.140051f10
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14008b1b0
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x140077991
sub ecx, 1
je 0x140077a04
sub ecx, 1
je 0x140077940
cmp ecx, 1
je 0x140077923
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x1400a5d00]
call fcn.140051f10
jmp 0x140077a04
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.140077510
test eax, eax
je 0x140077a04
jmp 0x1400778aa
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140077a04
sub rax, rsi
cmp rax, rbp
jae 0x140077a04
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.140052090
jmp 0x140077a04
cmp r8d, 4
jle 0x140077a04
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x140077a04
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.140051e30
mov esi, eax
test eax, eax
je 0x1400779e3
mov edx, 5
mov rcx, rbx
call fcn.1400784d0
mov eax, esi
jmp 0x1400778aa
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.140060900
mov rcx, r14
call fcn.140060be0
test eax, eax
je 0x1400778a8
mov edx, 5
mov rcx, rbx
call fcn.1400784d0
mov eax, Ordinal_46
jmp 0x1400778aa
Function at 0x14008a7a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14008a7e2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x14008a829
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x14008a882
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x14008a840
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x14008a8c3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400ab47a]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400ab47b]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x14008a890
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x14008a9ac
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14008a9e6
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14008a9eb
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14008aa34
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x14008aa34
dec r8
sub rdx, 1
jne 0x14008aa1a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14008c188
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14008c1d2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14008c1d2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14008c1d2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008c1d2
cmp dword [rcx + 0x84], 0xe
jbe 0x14008c1d2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14008c1d4
xor al, al
add rsp, 0x28
ret
Function at 0x14001e58b
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3a
syscall
ret

Function at 0x14001fd7c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140063090]
test rax, rax
je 0x14001fdc6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001fdc6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001fdc6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001fdc6
cmp dword [rcx + 0x84], 0xe
jbe 0x14001fdc6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001fdc8
xor al, al
add rsp, 0x28
ret

Function at 0x1400261f4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140026263
xor ecx, ecx
call qword [0x140063090]
test rax, rax
je 0x140026263
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140026263
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140026263
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140026263
cmp dword [rcx + 0x84], 0xe
jbe 0x140026263
cmp dword [rcx + 0xf8], 0
je 0x140026263
mov ecx, ebx
call fcn.140026308
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400260fc
nop
cmp dword [rbp + 0x20], 0
jne 0x1400262c4
call fcn.140027bc8
cmp eax, 1
jne 0x1400262b4
xor dl, dl
jmp 0x1400262be
call fcn.14002a1dc
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x1400262cf
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400262d8
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400261f4

Function at 0x1400263dc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400261f4

Function at 0x14002db80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002dba8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002dba8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140025800
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14004e900]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.14000b020
mov rcx, qword [0x14004eeb8]
lea rdx, [rsp + 0x28]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rsp + 0x30]
sub ecx, dword [rsp + 0x28]
movd xmm1, ecx
mov ecx, dword [rsp + 0x34]
sub ecx, dword [rsp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rsp + 0x40]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x40]
xorps xmm1, xmm1
sub rax, qword [0x14004eec0]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x14004eec8]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rsp + 0x40]
mov qword [0x14004eec0], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rdi + 0x128], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rdi + 0x129], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x12b], 0
mov byte [rdi + 0x12a], al
call fcn.14000b020
cmp byte [rax + 0x3a7], 0
lea rbx, [rax + 0x110]
je 0x14002592d
cvttss2si ecx, dword [rbx]
lea rdx, [rsp + 0x38]
cvttss2si eax, dword [rax + 0x114]
mov dword [rsp + 0x38], ecx
mov rcx, qword [0x14004eeb8]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx], 0xff7fffff
mov dword [rbx + 4], 0xff7fffff
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x14004eeb8]
jne 0x140025989
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140025989
mov rcx, qword [0x14004eeb8]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x140025989
movd xmm0, dword [rsp + 0x20]
movd xmm1, dword [rsp + 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x140025999
mov eax, 0xffffffff
jmp 0x14002599e
call fcn.14000b0d0
cmp dword [0x14004e13c], eax
je 0x1400259b1
mov dword [0x14004e13c], eax
call fcn.1400259e0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14003f0a0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140025e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14004e900]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [rcx]
mov ebx, edx
test al, al
je 0x140025e78
cmp al, 0x25
jne 0x140025e6d
cmp byte [rcx + 1], al
jne 0x140025e78
inc rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140025e61
cmp byte [rcx], 0x25
jne 0x140025f49
cmp byte [rcx + 1], 0x25
je 0x140025f49
xorps xmm3, xmm3
mov r8, rcx
cvtss2sd xmm3, xmm2
mov edx, 0x40
lea rcx, [rsp + 0x30]
movq r9, xmm3
call fcn.14000ba50
cmp byte [rsp + 0x30], 0x20
lea rcx, [rsp + 0x30]
jne 0x140025ebd
inc rcx
cmp byte [rcx], 0x20
je 0x140025eb5
lea eax, [rbx - 4]
cmp eax, 1
jbe 0x140025f37
movzx edx, byte [rcx]
movzx r8d, dl
cmp dl, 0x2d
jne 0x140025ed6
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
xorps xmm1, xmm1
cmovne rax, rcx
cmp r8b, 0x2b
lea rcx, [rax + 1]
cmovne rcx, rax
movzx eax, byte [rcx]
cmp al, 0x30
jl 0x140025f26
movss xmm2, dword [0x1400419f8]
nop dword [rax]
cmp al, 0x39
ja 0x140025f26
movsx eax, byte [rcx]
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x140025f00
cmp dl, 0x2d
jne 0x140025f44
xorps xmm1, xmmword [0x140041a80]
movaps xmm0, xmm1
jmp 0x140025f4c
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x140025f4c
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14003f0a0
add rsp, 0x80
pop rbx
ret

Function at 0x140025f70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14004e900]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [rcx]
mov ebx, edx
test al, al
je 0x140025fa8
cmp al, 0x25
jne 0x140025f9d
cmp byte [rcx + 1], al
jne 0x140025fa8
inc rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140025f91
cmp byte [rcx], 0x25
jne 0x14002606b
cmp byte [rcx + 1], 0x25
je 0x14002606b
mov r8, rcx
movaps xmm3, xmm2
lea rcx, [rsp + 0x30]
movq r9, xmm2
mov edx, 0x40
call fcn.14000ba50
cmp byte [rsp + 0x30], 0x20
lea rcx, [rsp + 0x30]
jne 0x140025fe9
inc rcx
cmp byte [rcx], 0x20
je 0x140025fe1
lea eax, [rbx - 4]
cmp eax, 1
jbe 0x14002605d
movzx edx, byte [rcx]
movzx r8d, dl
cmp dl, 0x2d
jne 0x140026002
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
xorps xmm1, xmm1
cmovne rax, rcx
cmp r8b, 0x2b
lea rcx, [rax + 1]
cmovne rcx, rax
movzx eax, byte [rcx]
cmp al, 0x30
jl 0x14002604c
movsd xmm2, qword [0x140045a40]
cmp al, 0x39
ja 0x14002604c
movsx eax, byte [rcx]
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x140026028
cmp dl, 0x2d
jne 0x140026066
xorps xmm1, xmmword [0x140045a80]
movaps xmm0, xmm1
jmp 0x14002606e
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14002606e
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14003f0a0
add rsp, 0x80
pop rbx
ret