joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025662
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
jmp 0x1400406a0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x758
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x13a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x778]
mov rax, qword [0x14008a048]
xor rax, rbp
mov qword [rbp + 0x718], rax
mov dword [rbp + 0x704], 0
lea rcx, [0x14009810d]
call fcn.140025bf3
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.MyApp
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140040751
lea rdx, [0x1400793fc]
mov rcx, qword [rbp + 0x740]
call fcn.140024c71
mov eax, dword [rbp + 0x704]
or eax, 1
mov dword [rbp + 0x704], eax
mov rax, qword [rbp + 0x740]
jmp 0x140040857
mov rcx, qword [rbp + 0x748]
call fcn.140024258
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1400407c4
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [0x1400793fc]
mov rcx, qword [rbp + 0x740]
call fcn.140024c71
mov eax, dword [rbp + 0x704]
or eax, 1
mov dword [rbp + 0x704], eax
mov rax, qword [rbp + 0x740]
jmp 0x140040857
lea rcx, [rbp + 0x48]
call fcn.140025bbc
nop
lea r9, [rbp + 0x4a4]
mov r8d, 0x400
lea rdx, [rbp + 0x90]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140040814
cmp dword [rbp + 0x4a4], 0
jbe 0x140040814
mov eax, dword [rbp + 0x4a4]
mov r8d, eax
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x48]
call fcn.140025d79
jmp 0x1400407ce
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [rbp + 0x48]
mov rcx, qword [rbp + 0x740]
call fcn.140025a13
mov eax, dword [rbp + 0x704]
or eax, 1
mov dword [rbp + 0x704], eax
lea rcx, [rbp + 0x48]
call fcn.14002450a
mov rax, qword [rbp + 0x740]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400761f0]
call fcn.1400256ee
mov rax, rdi
mov rcx, qword [rbp + 0x718]
xor rcx, rbp
call fcn.140024d2f
lea rsp, [rbp + 0x728]
pop rdi
pop rbp
ret
Function at 0x140025b6c
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400425f0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x14008a048]
xor rax, rbp
mov qword [rbp + 0x1a8], rax
lea rcx, [0x140098108]
call fcn.140025bf3
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x140042656
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14004265d
mov al, 1
jmp 0x1400427cf
mov rax, qword [rbp + 0x1d0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x198], rax
call fcn.1400247a3
mov dword [rbp + 0x1a0], eax
mov edx, dword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x1d0]
call qword [rbp + 0x198]
mov dword [rbp + 0x164], eax
call fcn.1400247a3
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.14002572a
movzx eax, al
test eax, eax
je 0x1400426c2
xor al, al
jmp 0x1400427cf
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1d0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x198], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x1a0], eax
cmp dword [rbp + 0x1a0], 0
je 0x140042735
cmp dword [rbp + 0x1a0], 1
je 0x140042740
cmp dword [rbp + 0x1a0], 3
je 0x1400427be
jmp 0x1400427cd
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140042790
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140042790
xor al, al
jmp 0x1400427cf
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400427ab
mov dword [rbp + 0x194], 1
jmp 0x1400427b5
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x1400427cf
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400427cf
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140076f00]
call fcn.1400256ee
mov rax, rdi
mov rcx, qword [rbp + 0x1a8]
xor rcx, rbp
call fcn.140024d2f
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x18000e97c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000e9ac
xor eax, eax
jmp 0x18000ea6f
mov rbp, rbx
cmp word [rax], si
je 0x18000e9d1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000e9b8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000e9b4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000e89c
movsxd r14, eax
test eax, eax
jne 0x18000ea0f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000e9a5
mov rcx, r14
call fcn.18000cfc8
mov rdi, rax
test rax, rax
jne 0x18000ea28
xor ecx, ecx
call fcn.18000d028
jmp 0x18000ea04
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000e89c
test eax, eax
jne 0x18000ea59
mov rcx, rdi
call fcn.18000d028
jmp 0x18000ea63
xor ecx, ecx
call fcn.18000d028
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180015478
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x18001548e
mov al, 1
jmp 0x1800154ee
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x18001549f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1800154ec
mov ecx, dword [rcx + 0x18]
nop
call fcn.180013570
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800154ec
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1800154ec
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800154ec
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1800154ee
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1800178d4
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x18000003c]
lea rsi, [0x180000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x18001794c
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x18001794c
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x18001794c
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x180017940
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x18001795e
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x18001792e
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x18001794e

Function at 0x180017e10
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180017e38
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180017e38
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400053f4
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x1400054ba
lea rcx, [0x1400a03c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14009fa78]
jmp 0x14000547e
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000547b
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x14009fa78]
mov rdx, rsi
call fcn.1400335e8
jmp 0x14000547e
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000544b
mov rdx, qword [reloc.WS2_32.dll_accept]
lea rcx, [0x14009fa78]
mov rdi, rdx
inc rdx
mov qword [reloc.WS2_32.dll_accept], rdx
lea edx, [rbx + 0x20]
call fcn.140033630
lea rcx, [0x1400a03c0]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x14000569c
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x140005713
movsxd rdx, ecx
lea rcx, [0x1400055f8]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [0x14009fa80]
test rbx, rbx
je 0x140005786
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140005709
cmp byte [rbx + 0x20], 0
je 0x140005709
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x1400056cf
jmp 0x140005786
mov rbx, qword [0x14009fa80]
test rbx, rbx
je 0x140005786
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x14000577e
cmp byte [rbx + 0x21], 0
je 0x140005742
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x14000576e
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x14009fa80]
call fcn.1400335e8
mov rbx, rdi
test rdi, rdi
jne 0x14000571f
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140025cc8
Capabilities:
Create thread
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13d, ecx
mov rcx, qword [0x1400a0560]
mov rsi, r9
mov r14, r8
mov r15, rdx
xor ebx, ebx
call fcn.140032c28
mov r12, rax
test r15, r15
je 0x140025e0a
mov rcx, qword [0x14009f9d8]
lea edx, [rbx + 8]
mov r8d, 0x98
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ebp, [rbx + 1]
mov rcx, r15
or dword [rax + 4], 0xffffffff
mov dword [rax], ebp
mov rdi, rax
call sub.msvcrt.dll__wcsdup
lea rcx, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
mov qword [rdi + 8], rax
call sub.msvcrt.dll__wcsdup
mov ecx, dword [rsp + 0x80]
mov qword [rdi + 0x60], rax
mov dword [rdi + 0x40], ecx
mov eax, dword [r12]
mov dword [rdi + 0x44], eax
mov eax, dword [r12 + 4]
mov dword [rdi + 0x80], r13d
mov dword [rdi + 0x48], eax
mov rax, qword [rsp + 0x88]
mov qword [rdi + 0x88], rsi
mov qword [rdi + 0x78], rax
test bpl, cl
je 0x140025dfb
test rsi, rsi
je 0x140025db4
mov rcx, qword [0x14009f9d8]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0x70], rax
test rax, rax
je 0x140025dae
mov r8, rsi
mov rdx, r14
mov rcx, rax
call sub.msvcrt.dll_memcpy
cmp qword [rdi + 0x70], rbx
je 0x140025df1
lea rax, [rsp + 0x68]
lea r8, [0x140025e2c]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov edx, 0x10000
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140025de9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140025ded
mov ebp, dword [rsp + 0x68]
test ebp, ebp
jne 0x140025e07
mov rcx, rdi
call fcn.140025754
jmp 0x140025e0a
mov rcx, rdi
mov qword [rdi + 0x70], r14
call fcn.1400257f0
mov rbx, rdi
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140026040
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1c0
mov ebx, reloc.WS2_32.dll_recv
lea r8, [0x140025f54]
lea ecx, [rbx + 0x28]
mov edx, ebx
call fcn.140032dac
xor r8d, r8d
xor edx, edx
mov ecx, ebx
mov qword [0x14009fc88], rax
call fcn.140032c2c
xor ebx, ebx
cmp word [0x14009fc80], bx
mov qword [0x1400a05a0], rax
jne 0x140026163
lea rdx, [rsp + 0x20]
mov ecx, 0x101
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea edi, [rbx + 1]
mov word [0x14009fc80], di
test eax, eax
je 0x1400260b1
mov word [0x14009fc80], bx
lea rcx, str.ws2_32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x14009fcb0], rax
test rax, rax
je 0x140026163
lea rdx, [0x14008be90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14009fcb0]
lea rdx, [0x14008bea0]
mov qword [0x14009fc90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14009fcb0]
lea rdx, str.getnameinfo
mov qword [0x14009fc98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14009fcb0]
lea rdx, str.WSAStringToAddressA
mov qword [0x14009fca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x14009fc90], rbx
mov qword [0x14009fca8], rax
je 0x140026163
cmp qword [0x14009fc98], rbx
je 0x140026163
cmp qword [0x14009fca0], rbx
je 0x140026163
mov ecx, dword [0x14009fc84]
test rax, rax
cmovne ecx, edi
mov dword [0x14009fc84], ecx
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1c0
pop rdi
ret
Function at 0x140026998
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x38
cmp dword [rcx], 1
mov r10d, r8d
mov r11, rdx
jne 0x1400269b6
mov rcx, qword [rcx + 8]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
jmp 0x1400269f4
cmp byte [rcx + 0x20], 0
lea r8, [rcx + 4]
mov edx, 0x1c
jne 0x1400269ca
mov edx, reloc.WS2_32.dll_recv
mov rax, qword [rcx + 0x28]
test rax, rax
je 0x1400269d8
mov rcx, qword [rax]
jmp 0x1400269dc
mov rcx, qword [rcx + 0x30]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r8
xor r9d, r9d
mov r8d, r10d
mov rdx, r11
call qword [sym.imp.WS2_32.dll_sendto]
cdqe
add rsp, 0x38
ret

Function at 0x140026e70
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
cmp qword [0x14009fcc0], 0
jne 0x140026ed6
lea rcx, [0x14009fcc0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x140026ec2
movabs rax, 0x20c49ba5e353f7cf
lea rcx, [0x14009fcc8]
imul qword [0x14009fcc0]
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [0x14009fcc0], rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp qword [0x14009fcc0], 0
jne 0x140026ed6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
jmp 0x140026efc
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
sub rax, qword [0x14009fcc8]
cqo
idiv qword [0x14009fcc0]
add rsp, 0x28
ret
Function at 0x1400278fc
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rcx
xor ebx, ebx
call qword [sym.imp.USER32.dll_GetFocus]
lea rdx, str.PB_WindowID
mov rcx, r14
xor ebp, ebp
mov rdi, rax
call qword [sym.imp.USER32.dll_GetPropW]
mov rsi, rax
lea eax, [rbx + 9]
test rsi, rsi
je 0x1400279be
lea rdx, [rsp + 0x68]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x140027aff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x68], eax
jne 0x140027aff
mov rcx, qword [0x1400a06c0]
lea rdx, [rsi - 1]
call fcn.140032ce0
mov ebp, 1
cmp dword [rax + 0x20], 0
mov rbx, rax
jle 0x140027aff
mov rax, qword [rax + 8]
movsxd r8, dword [rbx + 0x20]
xor edx, edx
xor ecx, ecx
lea r10d, [rbp + 8]
cmp word [rcx + rax + 2], r10w
jne 0x1400279af
mov r9d, 0xfa01
cmp word [rcx + rax + 4], r9w
je 0x140027af8
inc rdx
add rcx, 6
cmp rdx, r8
jl 0x140027995
mov eax, r10d
mov sil, pe_nt_image_headers64
test rdi, rdi
je 0x140027a91
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
je 0x140027a91
mov ecx, sendto
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x140027a91
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x140027a91
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x140027a91
lea rdx, [rsp + 0x20]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
test ebp, ebp
jne 0x140027a91
lea r8d, [rbp + 5]
lea rdx, str.RichE
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x140027a5d
lea r8d, [rbp + 4]
lea rdx, str.RICHE
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x140027a7c
xor r9d, r9d
xor r8d, r8d
mov edx, 0x44e
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xb
jae 0x140027b09
lea rdx, str.Scintilla
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x140027b09
test r14, r14
je 0x140027ad3
mov ecx, sendto
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x140027ac6
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x140027ac6
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
je 0x140027ad3
mov edx, 1
mov rcx, r14
call fcn.140027b20
test rdi, rdi
je 0x140027aed
lea rdx, str.PB_Hotkey
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetPropW]
test rax, rax
jne 0x140027b09
test rbx, rbx
je 0x140027b09
mov rax, qword [rbx + 0x10]
jmp 0x140027b0b
xor ebp, ebp
jmp 0x1400279bb
mov eax, 9
jmp 0x1400279be
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14002f6d0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400a0a40], eax
add rsp, 0x28
ret

Function at 0x14002f858
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x380]
sub rsp, 0x480
or rbx, 0xffffffffffffffff
xor edi, edi
test rcx, rcx
je 0x14002f9ba
cmp word [rcx], di
je 0x14002f9ba
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1400051ec
lea rcx, [rsp + 0x20]
mov word [rbp + 0x128], di
call sub.msvcrt.dll_wcslen
mov rdx, rax
cdqe
lea rcx, [rsp + rax*2 + 0x1e]
lea eax, [rdx - 2]
cmp eax, 1
ja 0x14002f8f7
cmp word [rsp + 0x22], 0x3a
jne 0x14002f8f7
cmp edx, 2
jne 0x14002f8de
lea rdx, [0x14008c1d0]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcscat
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x14002f9ba
jmp 0x14002f992
cmp word [rcx], 0x5c
je 0x14002f903
cmp word [rcx], 0x2f
jne 0x14002f90c
mov word [rcx], di
sub rcx, 2
jmp 0x14002f8f7
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, rax
cmp rax, rbx
je 0x14002f953
test byte [rbp + 0x130], 0x10
je 0x14002f938
mov rbx, 0xfffffffffffffffe
jmp 0x14002f94b
mov ebx, dword [rbp + 0x14c]
mov eax, dword [rbp + 0x150]
shl rbx, 0x20
or rbx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x14002f9ba
movzx ecx, word [rsp + 0x20]
movzx eax, word [rsp + 0x22]
cmp cx, 0x5c
jne 0x14002f968
cmp ax, cx
je 0x14002f97e
cmp cx, 0x2f
jne 0x14002f973
cmp ax, cx
je 0x14002f97e
cmp cx, 0x2e
jne 0x14002f9ba
cmp ax, cx
jne 0x14002f9ba
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14002f99b
test al, 0x10
je 0x14002f9ba
mov rbx, 0xfffffffffffffffe
jmp 0x14002f9ba
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rcx, rbx
mov rbx, 0xfffffffffffffffe
cmp eax, 1
cmova rcx, rbx
mov rbx, rcx
lea r11, [rsp + 0x480]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x14002f9d4
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x230
xor ebx, ebx
test rcx, rcx
je 0x14002fa5e
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1400051ec
lea rcx, [rsp + 0x20]
mov word [rsp + 0x228], bx
call sub.msvcrt.dll_wcslen
lea rcx, [rsp + 0x20]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x14002fa4a
lea rdx, [rcx - 2]
movzx eax, word [rdx]
sub ax, 0x20
cmp ax, 0x3c
ja 0x14002fa4a
movabs r8, 0x1000000000008001
bt r8, rax
jae 0x14002fa4a
lea rax, [rsp + 0x20]
mov rcx, rdx
cmp rdx, rax
ja 0x14002fa1c
mov word [rcx], bx
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cdqe
jmp 0x14002fa60
xor eax, eax
add rsp, 0x230
pop rbx
ret