joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4cac00
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4cb602
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f0108]
test eax, eax
je 0x2fc4cb69a
lea rax, [0x2fc4f00e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f0110]
mov qword [rbp - 8], rax
jmp 0x2fc4cb67e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4cb672
cmp qword [rbp - 0x10], 0
je 0x2fc4cb672
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4cb638
lea rax, [0x2fc4f00e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4cb69b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cb7a0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4cb7c8
mov eax, 0
jmp 0x2fc4cb816
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cb7f1
mov eax, 0
jmp 0x2fc4cb816
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cb811
mov eax, 0
jmp 0x2fc4cb816
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cb81c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4cb89a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4cb891
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4cb891
mov rax, qword [rbp - 8]
jmp 0x2fc4cb8af
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4cb864
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4ca220
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4cac22
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4ef108]
test eax, eax
je 0x2fc4cacba
lea rax, [0x2fc4ef0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4ef110]
mov qword [rbp - 8], rax
jmp 0x2fc4cac9e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4cac92
cmp qword [rbp - 0x10], 0
je 0x2fc4cac92
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4cac58
lea rax, [0x2fc4ef0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4cacbb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cadc0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4cade8
mov eax, 0
jmp 0x2fc4cae36
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cae11
mov eax, 0
jmp 0x2fc4cae36
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cae31
mov eax, 0
jmp 0x2fc4cae36
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cae3c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4caeba
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4caeb1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4caeb1
mov rax, qword [rbp - 8]
jmp 0x2fc4caecf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4cae84
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140002b48
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
movdqa xmm0, xmmword [0x1400713e0]
xor eax, eax
movdqa xmm1, xmmword [0x140071560]
xor edx, edx
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x30], 0xcdf1fceb
movdqa xmm0, xmmword [0x140071590]
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x2c], 0x90909090
movdqu xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x28], 0x90909090
mov word [rbp - 0x24], 0x9a90
mov byte [rbp - 0x22], al
movsxd rcx, edx
lea eax, [rdx + 0x6d]
inc edx
xor byte [rbp + rcx - 0x60], al
cmp edx, 0x3e
jb 0x140002bba
and qword [rbp - 0x20], 0
lea rax, [rbp - 0x60]
and qword [rbp - 0x10], 0
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rbp - 8], rsi
or r8, 0xffffffffffffffff
mov byte [rbp - 0x22], 0
inc r8
cmp byte [rax + r8], 0
jne 0x140002bea
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.140009b14
and qword [rbx], 0
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], rsi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r9, qword [rbp - 0x10]
xor edx, edx
and qword [rbp - 0x60], 0
and qword [rbp - 0x50], 0
cdqe
lea rcx, [r9 + 1]
mov qword [rbp - 0x48], rsi
div rcx
movsxd rcx, edx
cmp r9, rcx
jb 0x140002d19
sub r9, rcx
lea rdx, [rbp - 0x20]
mov r8d, 1
cmp r9, r8
cmovb r8, r9
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
add rdx, rcx
lea rcx, [rbp - 0x60]
call fcn.140009b14
cmp qword [rbp - 0x48], 0x10
lea rdx, [rbp - 0x60]
mov r8, qword [rbp - 0x50]
mov rcx, rbx
cmovae rdx, qword [rbp - 0x60]
call fcn.1400092b8
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140002cb8
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002cb3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002cf5
call fcn.1400608c8
cmp qword [rbx + 0x10], 0x20
jne 0x140002c0e
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140002d01
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002cfc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002cfc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400608c8
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.140009cc8
int3
Function at 0x140002d20
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
cmp qword [rdx + 0x18], 8
mov rdi, rdx
mov rbx, rcx
mov r9, rdx
jb 0x140002d3d
mov r9, qword [rdx]
cmp qword [rcx + 0x18], 8
mov r8, rbx
jb 0x140002d4a
mov r8, qword [rcx]
xor r11d, r11d
mov dword [rsp + 0x30], 0x2c1b2c1f
mov edx, r11d
mov dword [rsp + 0x34], 0x2c112c01
mov dword [rsp + 0x38], 0x2c02
movsxd rcx, edx
mov eax, 0x2c6d
add eax, edx
inc edx
xor word [rsp + rcx*2 + 0x30], ax
cmp edx, 5
jb 0x140002d68
mov dword [rsp + 0x28], r11d
lea rdx, [rsp + 0x30]
xor ecx, ecx
mov qword [rsp + 0x20], r11
mov word [rsp + 0x3a], r11w
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, rbx
call fcn.140009254
mov rcx, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp fcn.140009254

Function at 0x140002db8
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
xor edx, edx
mov dword [rsp + 0x20], 0x238
mov rsi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x140002e46
jmp 0x140002e33
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140002e33
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140002df8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140002e64
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x1a8]
sub rsp, 0x2a0
mov r14, rcx
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x64]
mov r8d, 0x234
mov rsi, rax
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x238
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140002fc3
mov qword [rsp + 0x40], rbx
or r8, 0xffffffffffffffff
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
inc r8
cmp word [r14 + r8*2], bx
jne 0x140002ee0
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.1400097e0
lea rax, [rbp - 0x74]
mov qword [rsp + 0x20], rbx
or r8, 0xffffffffffffffff
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 7
inc r8
cmp word [rax + r8*2], bx
jne 0x140002f12
lea rdx, [rbp - 0x74]
lea rcx, [rsp + 0x20]
call fcn.1400097e0
cmp qword [rsp + 0x58], 8
lea rax, [rsp + 0x40]
mov r8, qword [rsp + 0x30]
lea r9, [rsp + 0x20]
cmovae rax, qword [rsp + 0x40]
cmp qword [rsp + 0x38], 8
cmovae r9, qword [rsp + 0x20]
cmp r8, qword [rsp + 0x50]
jne 0x140002f8b
test r8, r8
je 0x140002fba
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x140002f8b
sub r9, rax
cmp cx, dx
ja 0x140002f8b
cmp r8, 1
je 0x140002fba
add rax, 2
dec r8
movzx ecx, word [r9 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x140002f6f
mov dil, bl
lea rcx, [rsp + 0x20]
call fcn.140009254
lea rcx, [rsp + 0x40]
call fcn.140009254
test dil, dil
jne 0x140002fbf
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140002ec1
mov dil, 1
jmp 0x140002f8e
mov ebx, dword [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x2a0]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140003498
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
xor eax, eax
mov dword [rbp - 0x20], 0x2c322c31
xor r9d, r9d
mov dword [rbp - 0x1c], 0x2c2c2c41
mov edx, r9d
mov dword [rbp - 0x18], 0x2c232c25
mov rbx, rcx
mov dword [rbp - 0x14], 0x2c2d2c2a
mov dword [rbp - 0x10], 0x2c2f2c20
mov word [rbp - 0xc], ax
movsxd rcx, edx
mov eax, 0x2c6d
add eax, edx
inc edx
xor word [rbp + rcx*2 - 0x20], ax
cmp edx, 0xa
jb 0x1400034d7
mov qword [rsp + 0x30], r9
lea rcx, [rbp - 0x20]
mov r8d, 3
mov dword [rsp + 0x28], r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], r8d
mov word [rbp - 0xc], r9w
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 0x20], rax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140004f10
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
lea rbx, [rcx + 8]
xor r12d, r12d
mov rsi, rcx
mov qword [rbx], r12
mov rcx, rbx
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
lea r13d, [r12 + 0x10]
mov edx, r13d
call fcn.14000a3d4
mov rax, qword gs:[0x58]
mov r15d, r13d
mov edi, reloc.WLDAP32.dll_Ordinal_32
mov qword [rbx + 0x10], r12
movabs r12, 0x4ec4ec4ec4ec4ec5
mov r13d, reloc.WS2_32.dll_sendto
mov r14, qword [rax]
add rdi, r14
mov eax, dword [r14 + r13]
test al, 1
jne 0x140004ff0
or eax, 1
mov dword [r14 + r13], eax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
mov edx, 1
mov qword [rdi + 8], rcx
lea r8, [rdi + 0x10]
movabs rax, 0x5555555555555555
mov qword [rdi + 0x1388], rax
mov rax, rcx
shr rax, 0x3e
xor rax, rcx
movabs rcx, 0x5851f42d4c957f2d
imul rcx, rax
add rcx, rdx
inc rdx
mov qword [r8], rcx
lea r8, [r8 + 8]
cmp rdx, 0x138
jb 0x140004fbc
mov dword [rdi], 0x138
or qword [rbp - 0x29], 0xffffffffffffffff
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], 0x40
lea rcx, [rbp - 0x39]
call fcn.14000aaa4
mov rcx, rax
mov rax, r12
mul rcx
movabs rax, 0x9d89d89d89d89d8
shr rdx, 3
cmp rdx, rax
jae 0x140005001
mov rax, r12
mul rcx
shr rdx, 3
imul rax, rdx, 0x1a
sub rcx, rax
lea edx, [rcx + 0x61]
mov rcx, rbx
call fcn.140009988
add r15d, 0xffffffff
jne 0x140004f87
xor r12d, r12d
lea rax, [0x14000515c]
xor ecx, ecx
mov dword [rbp - 0x19], r12d
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r13d, [r15 + 0x10]
xorps xmm0, xmm0
xorps xmm1, xmm1
mov qword [rbp - 1], rax
mov rax, rbx
movdqa xmmword [rbp + 7], xmm0
movdqa xmmword [rbp + 0x17], xmm1
cmp qword [rbx + 0x18], r13
jb 0x14000508e
mov rax, qword [rbx]
lea rcx, [rbp - 0x19]
mov qword [rbp + 0x27], rax
call qword [sym.imp.USER32.dll_RegisterClassA]
lea rcx, [rbp - 0x39]
call fcn.140002b48
mov r8, rax
cmp qword [rax + 0x18], r13
jb 0x1400050b1
mov r8, qword [rax]
cmp qword [rbx + 0x18], r13
jb 0x1400050ba
mov rbx, qword [rbx]
mov rax, qword [rbp - 1]
mov r9d, 0xcf0000
mov qword [rsp + 0x58], r12
mov rdx, rbx
mov qword [rsp + 0x50], rax
xor ecx, ecx
mov qword [rsp + 0x48], r12
mov eax, 0x80000000
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rdx, qword [rbp - 0x21]
mov qword [rsi], rax
cmp rdx, r13
jb 0x140005138
mov rcx, qword [rbp - 0x39]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005133
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005133
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400608c8
lea r11, [rsp + 0xd0]
mov rax, rsi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400051ec
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
lea r9, [rcx + 0x38]
xor ecx, ecx
lea rdx, [0x140071190]
xor r8d, r8d
call qword [sym.imp.d2d1.dll_Ordinal_1]
xor esi, esi
test eax, eax
js 0x1400052e2
lea r8, [rbx + 0x40]
xor ecx, ecx
lea rdx, [0x1400711d0]
call qword [sym.imp.DWrite.dll_DWriteCreateFactory]
test eax, eax
js 0x1400052e2
mov r10, qword [rbx + 0x40]
mov edx, esi
mov rax, qword [r10]
mov dword [rbp - 0x20], 0x2c1c2c2b
mov dword [rbp - 0x1c], 0x2c1e2c0e
mov dword [rbp - 0x18], 0x2c1e2c1a
mov r11, qword [rax + 0x78]
mov dword [rbp - 0x14], 0x2c1a2c1a
mov dword [rbp - 0x10], 0x2c312c55
mov dword [rbp - 0xc], 0x2c0c2c18
mov dword [rbp - 8], 0x2c132c11
mov dword [rbp - 4], 0x2c18
movsxd rcx, edx
mov eax, 0x2c6d
add eax, edx
inc edx
xor word [rbp + rcx*2 - 0x20], ax
cmp edx, 0xf
jb 0x140005286
movss xmm0, dword [0x140071350]
lea rax, [rbx + 0x48]
mov qword [rsp + 0x40], rax
lea rdx, [rbp - 0x20]
lea rax, [0x140071154]
mov word [rbp - 2], si
mov qword [rsp + 0x38], rax
mov r9d, 0x190
movss dword [rsp + 0x30], xmm0
xor r8d, r8d
mov dword [rsp + 0x28], 5
mov rcx, r10
mov dword [rsp + 0x20], esi
call r11
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14000620c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, ecx
lea rdi, [0x14007c160]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx rcx, ax
xor eax, eax
shr rcx, 0x10
test cx, cx
je 0x140006263
cmp byte [rdi + rbx*8], al
je 0x140006251
cmp dword [rdi + rbx*8 + 4], eax
je 0x140006266
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rdi + rbx*8 + 4]
add ecx, 0x32
cmp ecx, eax
ja 0x140006266
mov byte [rdi + rbx*8], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + rbx*8 + 4], eax
mov al, 1
jmp 0x140006268
mov byte [rdi + rbx*8], al
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140006274
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
movaps xmmword [rax - 0x28], xmm6
mov ecx, 0x76
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
call fcn.14000620c
xor r15d, r15d
test al, al
je 0x1400062cb
cmp dword [0x14007c970], r15d
je 0x1400062cb
mov eax, dword [0x14007c974]
cmp eax, 0xb4
jge 0x1400062cb
inc eax
mov dword [0x14007c974], eax
mov ecx, 0x77
call fcn.14000620c
test al, al
je 0x1400062f5
cmp dword [0x14007c970], r15d
je 0x1400062f5
mov eax, dword [0x14007c974]
cmp eax, 1
jle 0x1400062f5
dec eax
mov dword [0x14007c974], eax
mov dword [rbp - 0x19], 0x2c1c2c22
mov edx, r15d
mov dword [rbp - 0x15], 0x2c1f2c06
mov dword [rbp - 0x11], 0x2c522c1f
mov dword [rbp - 0xd], 0x2c1d2c32
mov dword [rbp - 9], 0x2c18
movsxd rcx, edx
mov eax, 0x2c6d
add eax, edx
inc edx
xor word [rbp + rcx*2 - 0x19], ax
cmp edx, 9
jb 0x14000631b
movss xmm1, dword [0x140071354]
lea rax, [rbp - 0x19]
movaps xmm0, xmmword [0x140071400]
lea r9, [rbp + 7]
mov rcx, qword [0x14007c9e0]
movaps xmm2, xmm1
mov qword [rsp + 0x28], rax
movd r8d, xmm2
movd edx, xmm1
mov word [rbp - 7], r15w
movdqa xmmword [rbp + 7], xmm0
mov byte [rsp + 0x20], r15b
call fcn.140005cf4
mov eax, dword [0x14007c974]
cmp eax, 1
jle 0x1400064cd
cmp dword [0x14007c970], r15d
je 0x1400064cd
movd xmm0, dword [0x14007c96c]
movabs r14, 0x14242f4a8
mov rdi, qword [0x14007c9e0]
mov rcx, r14
cvtdq2ps xmm0, xmm0
shl eax, 2
mov dword [rbp - 0x19], 0x3f800000
mov dword [rbp - 0xd], 0x3f800000
movd xmm8, eax
divss xmm0, dword [0x14007135c]
cvtdq2ps xmm8, xmm8
movss dword [rbp - 0x15], xmm0
movd xmm0, dword [0x14007c968]
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x14007135c]
movss dword [rbp - 0x11], xmm0
call fcn.140003528
mov rbx, rax
call fcn.1400031b8
lea rdx, [rbx + 0x48]
mov r9d, 8
lea r8, [rbp + 0x67]
mov rcx, rax
call fcn.1400030d0
mov rcx, qword [rbp + 0x67]
add rcx, 0x14b7fc
call fcn.14000a124
cdq
mov rcx, r14
sub eax, edx
sar eax, 1
movd xmm7, eax
cvtdq2ps xmm7, xmm7
call fcn.140003528
mov rbx, rax
call fcn.1400031b8
lea rdx, [rbx + 0x48]
mov r9d, 8
lea r8, [rbp + 0x67]
mov rcx, rax
call fcn.1400030d0
mov rcx, qword [rbp + 0x67]
add rcx, 0x14b7f8
call fcn.14000a124
mov rcx, qword [rdi + 0x28]
cdq
sub eax, edx
lea rdx, [rbp + 7]
sar eax, 1
movd xmm6, eax
mov rax, qword [rbp - 0x19]
mov qword [rbp + 7], rax
mov rax, qword [rbp - 0x11]
mov qword [rbp + 0xf], rax
mov rax, qword [rcx]
cvtdq2ps xmm6, xmm6
call qword [rax + 0x40]
mov rcx, qword [rdi + 8]
lea rdx, [rbp + 7]
movss xmm3, dword [0x14007134c]
mov r8, qword [rdi + 0x28]
movss dword [rbp - 0x19], xmm6
movss dword [rbp - 0x15], xmm7
movss dword [rbp - 0x11], xmm8
movss dword [rbp - 0xd], xmm8
movups xmm0, xmmword [rbp - 0x19]
mov qword [rsp + 0x20], r15
movups xmmword [rbp + 7], xmm0
mov rax, qword [rcx]
call qword [rax + 0xa0]
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret