joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140093430
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [str.P_t_]
mov rdi, rax
test rax, rax
jne 0x140093472
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400934b9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140093512
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400934d0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140093553
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400ec9aa]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400ec9ab]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140093520
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x14009356c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400935a6
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400935ab
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400935f4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1400935f4
dec r8
sub rdx, 1
jne 0x1400935da
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140094c8c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140094cd6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140094cd6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140094cd6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140094cd6
cmp dword [rcx + 0x84], 0xe
jbe 0x140094cd6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140094cd8
xor al, al
add rsp, 0x28
ret
Function at 0x14001a0c4
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
cmp rdi, rax
jne 0x14004eb84
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
xor ebx, ebx
test rax, rax
jne 0x14004eb9d
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x14004ebb8
mov edx, 9
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x14004ece2
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
xor edx, edx
mov rcx, rdi
mov r14d, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, 1
mov ecx, r14d
mov edx, eax
mov r8d, esi
mov r15d, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r8d, esi
mov edx, ebp
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r8d, esi
mov edx, r15d
mov ecx, ebp
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x14004ecb0
lea esi, [rax + 0x12]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea r8d, [rsi - 0x10]
xor r9d, r9d
mov edx, eax
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea r8d, [rsi - 0x10]
xor r9d, r9d
mov edx, eax
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x14004ecb5
lea ebx, [rsi - 0xe]
jmp 0x14004ecb5
mov ebx, 3
xor r8d, r8d
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor r8d, r8d
mov edx, ebp
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor r8d, r8d
mov edx, r15d
mov ecx, ebp
call qword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x14004ece7
mov ebx, 2
mov eax, ebx
jmp 0x14001a0f6
Function at 0x14001ab60
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x1ff70]
mov eax, 0x20070
call fcn.140038c40
sub rsp, rax
lea rcx, [rsp + 0x50]
mov rsi, rdx
call fcn.14001e640
lea rdx, [rsp + 0x70]
xor bl, bl
mov ecx, 0x7fff
mov byte [rbp + 0x1ffa0], bl
xor dil, dil
call qword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
lea r8, [rbp + 0x1ffb0]
mov rdx, rsi
call fcn.14001a624
call qword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
test eax, eax
jne 0x14004f0da
mov eax, dword [0x1400e4570]
test eax, eax
je 0x14001acf2
mov r15d, 1
lea rcx, [0x1400e6320]
cmp eax, r15d
je 0x14004f0fc
lea rax, [rbp + 0x1ffa0]
lea r8, [0x1400e4570]
lea rdx, [0x1400e4598]
mov qword [rsp + 0x20], rax
call fcn.14001cb64
test al, al
je 0x14001acfb
mov al, byte [0x1400e6320]
mov rcx, qword [0x1400e4598]
mov dil, byte [0x1400e6321]
lea r9, [rbp + 0x1ffb8]
lea r8, [rbp + 0xff70]
mov edx, 0x7fff
mov byte [0x1400e4574], al
call qword [sym.imp.KERNEL32.DLL_GetFullPathNameW]
mov rdx, qword [rbp + 0x1ffb8]
lea rcx, [0x1400e4550]
call fcn.14001edf8
mov bl, byte [rbp + 0x1ffa0]
mov r8d, dword [0x1400e4570]
lea rdx, [0x1400e4598]
call fcn.14000bdc0
test eax, eax
jne 0x14004f120
cmp dil, r15b
je 0x14004f143
call fcn.14001aa30
call fcn.14001a95c
cmp byte [0x1400e4574], 0
jne 0x14001ac9f
lea rcx, [0x1400e4f50]
call fcn.14000175c
lea rcx, [0x1400e45c0]
mov edx, r15d
call fcn.14000bea0
cmp byte [0x1400e4574], 0
jne 0x14001acc3
lea rcx, [0x1400e4f50]
call fcn.1400018ac
lea rcx, [0x1400e6320]
call fcn.14001cbfc
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
lea rcx, [rsp + 0x50]
call fcn.14001c29c
add rsp, 0x20070
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
or dword [0x1400e44c0], 0xffffffff
jmp 0x14001accf
mov dword [0x1400e44c0], r15d
jmp 0x14001accf
lea r8, [0x1400cf2a4]
lea rdx, str.This_is_a_third_party_compiled_AutoIt_script.
mov r9d, reloc.WSOCK32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
jmp 0x14001acda
mov r8, qword [0x1400e4578]
or r9d, 0xffffffff
mov edx, r15d
call fcn.14001cab8
mov al, byte [0x1400e44c8]
mov byte [0x1400e6322], al
jmp 0x14001ac5c
lea rcx, [0x1400e6320]
call fcn.14001cbfc
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov dword [0x1400e44c0], r15d
jmp 0x14001acda
call fcn.1400749b0
test al, al
jne 0x14001ac80
cmp byte [rbp + 0x1ffb0], al
jne 0x14001ac80
lea rcx, [rsp + 0x50]
call fcn.14001a3c8
lea rdx, [0x1400cb8a0]
lea rcx, [rsp + 0x30]
call fcn.14001f0bc
lea rcx, [rsp + 0x30]
test bl, bl
je 0x14004f1ab
lea rdx, [0x1400cf2d8]
call fcn.14001ef20
lea rdx, [0x1400e4598]
lea rcx, [rsp + 0x30]
call fcn.14001ec60
lea rdx, [0x1400cf2d8]
lea rcx, [rsp + 0x30]
jmp 0x14004f1ae
mov rdx, rsi
call fcn.14001ef20
mov rbx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x70]
lea rdx, str.runas
mov r9, rbx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x30]
call fcn.14001c29c
nop
jmp 0x14001acc3
Function at 0x140025a98
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
mov word [rcx + 8], 1
mov eax, 5
mov rbx, rcx
mov dword [rcx], eax
mov dword [rcx + 4], eax
xor eax, eax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov dword [rcx + 0x20], eax
mov dword [rcx + 0xc], 4
lea ecx, [rax + 0x5b]
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
lea ecx, [rdx + 0x10]
mov byte [rbx + 0x35], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
mov ecx, QueryPathOfRegTypeLib
mov byte [rbx + 0x32], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
mov ecx, QueryPathOfRegTypeLib
mov byte [rbx + 0x33], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
lea ecx, [rdx + 0x11]
mov byte [rbx + 0x34], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
lea ecx, [rdx + 0x12]
mov byte [rbx + 0x30], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [rbx + 0x31], al
add rsp, 0x20
pop rbx
ret

Function at 0x140025e98
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x10020
call fcn.140038c40
sub rsp, rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14001edf8
add rsp, 0x10020
pop rbx
ret

Function at 0x140025ed0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14b, byte [0x1400e44c7]
mov rsi, rdx
mov rdi, rcx
call fcn.140028bf8
mov edx, 0x8000
mov ecx, eax
call fcn.140028a20
cmp dword [rsi + 0x10], 0xb
mov ebp, eax
je 0x14006293e
lea rcx, [rsp + 0x20]
call fcn.14001c51c
mov rcx, rsi
call fcn.1400067e4
mov rdx, qword [rsi + 8]
lea r8, [rsp + 0x20]
call fcn.14001c400
mov r8, qword [rsp + 0x20]
lea rdx, [0x1400ab540]
mov rcx, rdi
call fcn.140028e40
movsxd rbx, eax
test r14b, r14b
jne 0x14006296c
lea rcx, [rsp + 0x20]
call fcn.14001c29c
mov rcx, rdi
call fcn.14002903c
mov rcx, rdi
call fcn.140028bf8
mov edx, 0x4000
mov ecx, eax
cmp ebp, 0xffffffff
je 0x140025f7b
mov edx, ebp
call fcn.140028a20
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r14
ret
mov rcx, rsi
call fcn.1400794e0
mov rcx, rsi
movsxd rbx, eax
call fcn.140079458
mov r9, rdi
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.140028db0
mov rbx, rax
jmp 0x140025f5d
mov rcx, rsi
call fcn.140006dd4
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
nop
jmp 0x140025f53

Function at 0x140027690
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400274f8
Function at 0x14006561c
Capabilities:
Get token privileges

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, qword [rsp + 0x60]
xor r9d, r9d
mov r14, r8
mov r8, qword [r8]
lea edx, [r9 + 3]
mov rbp, rcx
mov qword [rax - 0x18], rsi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
xor edi, edi
test eax, eax
jne 0x14006569f
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x1400656a4
mov ebx, dword [rsi]
call qword [sym.imp.KERNEL32.DLL_GetProcessHeap]
lea edx, [rdi + 8]
mov rcx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov qword [r14], rax
test rax, rax
je 0x1400656a4
mov r9d, dword [rsi]
lea edx, [rdi + 3]
mov r8, rax
mov rcx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400656a4
mov edi, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov al, dil
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140065d84
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x60
xor r10d, r10d
mov rbp, r9
mov r14, r8
mov qword [rax + 0x30], r10
mov eax, dword [rsp + 0xa0]
lea ebx, [r10 + 1]
mov r15, rdx
test bl, al
je 0x140065dc3
mov edi, ebx
jmp 0x140065dd0
mov ecx, 2
mov edi, r10d
test cl, al
cmovne edi, ecx
xor sil, sil
test al, 4
je 0x140065e30
and qword [rsp + 0x80], r10
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea r8, [rsp + 0x80]
mov rcx, rax
mov edx, 0xa
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0xa8]
mov r8d, ebx
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov rcx, qword [rsp + 0x80]
mov ebx, eax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test ebx, ebx
je 0x140065e96
mov r10, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xd0]
mov ecx, dword [rsp + 0xb8]
mov r9d, edi
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc8]
bts ecx, 0xa
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov r8, rbp
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov rdx, r14
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
setne sil
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x140065ea9
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
lea r11, [rsp + 0x60]
mov al, sil
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x140066008
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
lea rax, [rbp + 0x20]
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
lea r8d, [rbx + 0x20]
mov r9d, 0x220
mov dl, 2
mov dword [rsp + 0x28], ebx
mov dword [rbp + 0x18], ebx
mov word [rbp + 0x1c], 0x500
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rbp + 0x10], eax
test eax, eax
je 0x140066087
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
neg eax
sbb ecx, ecx
and dword [rbp + 0x10], ecx
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rbp + 0x10]
mov rbx, qword [rsp + 0x88]
cmp eax, 1
sete al
add rsp, 0x60
pop rbp
ret
Function at 0x140066258
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x40
mov r14, r9
mov r15, r8
mov rdi, rdx
call qword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov edx, 8
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov rsi, rax
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rdx, qword [rdi]
mov dword [rsp + 0x30], 2
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov rcx, rax
mov r9, rsi
mov r8, rbx
call qword [sym.imp.KERNEL32.DLL_DuplicateHandle]
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rdx, qword [r14]
mov dword [rsp + 0x30], 2
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r9, [rsi + 0x10]
mov rcx, rax
mov r8, rbx
call qword [sym.imp.KERNEL32.DLL_DuplicateHandle]
mov rax, qword [r15]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x140066340]
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov qword [rsi + 8], rax
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret

Function at 0x14006668c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, rcx
mov rcx, qword [rcx]
mov rbp, rdx
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
mov edx, 0xb0
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x68], eax
jae 0x140066752
mov rcx, qword [r15]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SendMessageW]
xor esi, esi
mov rdi, rax
test eax, eax
je 0x140066752
cmp eax, dword [rsp + 0x68]
jb 0x140066752
cmp eax, dword [rsp + 0x60]
jb 0x140066752
lea ebx, [rax + 1]
lea rcx, [rsi - 1]
lea eax, [rsi + 2]
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.14002652c
mov rcx, qword [r15]
lea edx, [rsi + 0xd]
mov r9, rax
mov r8d, ebx
mov r14, rax
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x140066745
cmp dword [rsp + 0x60], edi
je 0x140066732
mov ecx, dword [rsp + 0x60]
mov word [r14 + rcx*2], si
mov eax, dword [rsp + 0x68]
mov rcx, rbp
lea rdx, [r14 + rax*2]
call fcn.14001edf8
mov sil, 1
mov rcx, r14
call fcn.140024cec
mov al, sil
jmp 0x140066754
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006737c
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdx, qword [rcx]
mov r8b, 1
mov rdi, rcx
call fcn.140068ab8
xor edx, edx
test ebx, ebx
lea ebx, [rdx + 0x25]
mov ecx, ebx
jns 0x1400673d9
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi]
mov r8d, ebx
shl eax, 0x10
mov edx, 0x100
mov r9d, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, ebx
jmp 0x140067415
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi]
mov edx, 0x100
shl eax, 0x10
mov r8d, reloc.OLEAUT32.dll_SafeArrayRedim
mov r9d, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, reloc.OLEAUT32.dll_SafeArrayRedim
mov rcx, qword [rdi]
shl eax, 0x10
mov edx, 0x101
mov r9d, eax
mov eax, 0xc0000001
or r9, rax
call qword [sym.imp.USER32.dll_PostMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov rdx, qword [rdi]
xor r8d, r8d
call fcn.140068ab8
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret

Function at 0x140067dec
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov rbx, rdx
mov rcx, rdx
cmp r8b, 1
jne 0x140067e4a
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor edx, edx
mov dword [rsp + 0x28], 0x1388
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x140067e67
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov r8d, 1
jmp 0x140067e5d
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
xor r8d, r8d
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
add rsp, 0x40
pop rbx
ret

Function at 0x140068ab8
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
cmp r8b, 1
jne 0x140068aeb
call fcn.140025818
test al, al
jne 0x140068b0b
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov r8d, 1
jmp 0x140068b01
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
xor r8d, r8d
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
add rsp, 0x20
pop rbx
ret
Function at 0x14006e960
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rcx, qword [r8]
mov rdi, rdx
mov rsi, r8
mov r14d, dword [rcx + rdx]
lea rax, [rcx + 4]
mov qword [r8], rax
lea eax, [r14 + 1]
movsxd rcx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14002652c
mov rdx, qword [rsi]
lea ecx, [r14 + r14]
movsxd rbx, ecx
add rdx, rdi
mov rcx, rax
mov r8, rbx
mov r15, rax
call fcn.1400265f0
add qword [rsi], rbx
xor eax, eax
movsxd rcx, r14d
mov word [r15 + rcx*2], ax
test r14d, r14d
jle 0x14006e9ef
mov rax, r15
mov ecx, r14d
xor word [rax], r14w
lea rax, [rax + 2]
dec rcx
jne 0x14006e9e2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rax, r15
add rsp, 0x20
pop r15
ret

Function at 0x14006f070
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
xor eax, eax
cmp qword [rcx + 0x28], rax
lea edx, [rax + 2]
cmovne eax, edx
mov edx, dword [rcx]
cmp edx, eax
jge 0x14006f084
mov edx, eax
jmp 0x1400707c4
test edx, edx
js 0x140070853
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov ebx, edx
movaps xmmword [rsp + 0x20], xmm7
test edx, edx
jne 0x1400707ea
xor ecx, ecx
jmp 0x14007083e
cmp ebx, 0xf
jae 0x14007083c
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
test eax, eax
je 0x14007083c
xorps xmm7, xmm7
cvtsi2sd xmm7, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_Sleep]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
mov rax, qword [rsp + 0x50]
xorps xmm6, xmm6
sub rax, qword [rsp + 0x60]
cvtsi2sd xmm6, rax
call fcn.140025c84
divsd xmm6, xmm0
comisd xmm7, xmm6
ja 0x140070806
jmp 0x140070844
mov ecx, ebx
call qword [sym.imp.KERNEL32.DLL_Sleep]
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x40
pop rbx
ret

Function at 0x14006f08c
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
xor eax, eax
cmp qword [rcx + 0x28], rax
lea edx, [rax + 2]
cmovne eax, edx
mov edx, dword [rcx + 4]
cmp edx, eax
jge 0x14006f0a1
mov edx, eax
jmp 0x1400707c4