joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001300
Capabilities:
Allocate or change rwx memory
Enumerate process modules
Terminate process

Disassembly:
push rsi
push rdi
push r12
push r15
sub rsp, 0x58
mov r12, rdx
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x90]
xor r8d, r8d
mov rcx, rax
xor edx, edx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x14000151b
mov edx, dword [rsp + 0x90]
test edx, edx
je 0x14000151b
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x140001372
lea rcx, str.____Error_allocating_memory_to_store_process_modules_handles_n
call fcn.140001020
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8d, dword [rsp + 0x90]
lea r9, [rsp + 0x90]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x14000151b
mov qword [rsp + 0x80], rbx
mov rcx, rdi
mov rbx, qword [rdi]
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x50], r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r9d, 0x18
lea r8, [rsp + 0x38]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov r14, qword [rsp + 0x38]
lea r9, [rsp + 0x98]
mov ebp, dword [rsp + 0x40]
mov rcx, r14
mov edx, ebp
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test rbp, rbp
jne 0x14000140d
lea rcx, str.____Error_detecting_main_module_size
call fcn.140001020
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 0x40
xor edi, edi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, r14
lea rcx, str.Starting_search_from:_0x_llu_n
mov rsi, rax
call fcn.140001020
add rbp, 0xfffffffffffffff8
je 0x1400014ca
mov rbx, r14
nop dword [rax]
lea rax, [rsp + 0x30]
inc rbx
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov r9d, 8
mov r8, rsi
mov rcx, 0xffffffffffffffff
inc rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140001503
cmp qword [rsp + 0x30], 8
je 0x140001487
lea rcx, str.____Error_reading_from_memory_n
call fcn.140001020
jmp 0x1400014c1
mov rax, qword [r15]
cmp rax, qword [rsi]
jne 0x1400014c1
mov rdx, rbx
lea rcx, str.Found_at__llu_n
call fcn.140001020
lea rax, [rsp + 0x30]
mov r9d, 8
mov r8, r12
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp rdi, rbp
jb 0x140001440
lea rdx, [rdi + r14]
lea rcx, str.Ended_search_at:___0x_llu_n
call fcn.140001020
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x50]
add rsp, 0x58
pop r15
pop r12
pop rdi
pop rsi
ret
lea rcx, str.____Error_reading_from_memory_n
call fcn.140001020
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.____Error_enumerating_process_modules_n
call fcn.140001020
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140001cd0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140001cf1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140001d1e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001d20
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140001d79
test ecx, ecx
jle 0x140001d59
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140001d79
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140001d79
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x140001da0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140001dd1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140001de8
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140001e0b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140001e0d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140001e49
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140001ede
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140001e84
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140001ebe
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140001ede
cmp rbx, rax
ja 0x140001e90
test rbx, rbx
je 0x140001ede
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140002340
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000236d
xor eax, eax
jmp 0x1400024d9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400023a7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400023a7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400024d9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400024cc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400023ea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002415
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400024d1
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002484
sub eax, 1
je 0x140002484
cmp eax, 2
jne 0x1400024cc
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400024d1
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400024b2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400024cc
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400024d1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140002b30
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002760
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002833
cmp byte [rcx + 0x71], 0
je 0x140002833
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000282f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400027f4
sub eax, 1
je 0x1400027f8
cmp eax, 2
jne 0x14000282f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002b30
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002826
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000282f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400027dc
xor al, al
jmp 0x1400027dc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002b30
add rsp, 0x60
pop rbx
ret

Function at 0x1400034b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400034fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400034fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400034fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400034fa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400034fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400034fc
xor al, al
add rsp, 0x28
ret
Function at 0x14001ca7e
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push rbp
push r15
mov rax, 0x8c
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14001ca92
sub rsp, 0x28
call fcn.140040160
mov rdx, qword [rsp + 0x4a8]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400401d0
add rsp, 0x10
mov dword [0x1400f7001], 0x4000096
mov dword [0x1400f7001], 0x400009a
push qword [rsp + 0x4a0]
push 0x18
pop rcx
pop rdx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x468], rax
mov dword [0x1400f7001], 0x400009b
cmp qword [rsp + 0x468], 0
je 0x14001cc84
mov dword [0x1400f7001], 0x400009c
lea rbp, [rsp + 0x30]
mov dword [rbp], 0x438
mov dword [0x1400f7001], 0x400009d
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push qword [rsp + 0x470]
pop rcx
pop rdx
call sub.KERNEL32.dll_Module32FirstW
mov qword [rsp + 0x470], rax
mov dword [0x1400f7001], 0x400009e
cmp qword [rsp + 0x470], 0
je 0x14001cc6d
mov dword [0x1400f7001], 0x400009f
push rcx
sub rsp, 0x28
call fcn.14003fd40
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 1
push 1
push qword [rsp + 0x48]
push rcx
sub rsp, 0x20
call fcn.14003fd40
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14003fd40
add rsp, 0x28
pop rcx
push rax
lea rbp, [rsp + 0x68]
lea rax, [rbp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003e870
add rsp, 0x20
push rax
call fcn.14003ff70
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003d620
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400222cc
add rsp, 0x28
pop rax
and rax, rax
je 0x14001cc2b
mov dword [0x1400f7001], 0x40000a0
lea rbp, [rsp + 0x30]
push qword [rbp + 0x18]
pop rax
mov qword [rsp + 0x478], rax
mov dword [0x1400f7001], 0x40000a1
jmp 0x14001cc6d
mov dword [0x1400f7001], 0x40000a2
mov dword [0x1400f7001], 0x40000a3
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push qword [rsp + 0x470]
pop rcx
pop rdx
call sub.KERNEL32.dll_Module32NextW
mov qword [rsp + 0x470], rax
mov dword [0x1400f7001], 0x40000a4
jmp 0x14001cb4d
mov dword [0x1400f7001], 0x40000a5
push qword [rsp + 0x468]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov dword [0x1400f7001], 0x40000a6
mov dword [0x1400f7001], 0x40000a8
mov rax, qword [rsp + 0x478]
jmp 0x14001ccaf
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140040240
add rsp, 0x28
pop rax
add rsp, 0x488
pop r15
pop rbp
ret
Function at 0x14001dfb4
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push r15
mov rax, 0xa
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14001dfc3
sub rsp, 0x28
call fcn.140040160
mov dword [0x1400f7001], 0x400007f
mov dword [0x1400f7001], 0x4000081
mov qword [rsp + 0x70], 0
mov dword [0x1400f7001], 0x4000083
lea rax, [rsp + 0x40]
mov rax, rax
push rax
pop rcx
call sub.KERNEL32.dll_GetNativeSystemInfo
mov dword [0x1400f7001], 0x4000084
lea rbp, [rsp + 0x40]
movsx r15, word [rbp]
cmp r15, 9
jne 0x14001e12b
mov dword [0x1400f7001], 0x4000085
movabs rax, str.IsWow64Process
push rax
movabs rax, str.kernel32.dll
push rax
pop rcx
pop rdx
call fcn.14001de53
mov qword [rsp + 0x28], rax
mov dword [0x1400f7001], 0x4000086
cmp qword [rsp + 0x28], 0
je 0x14001e121
mov dword [0x1400f7001], 0x4000087
push qword [rsp + 0x90]
push 0
push 0x400
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_OpenProcess
mov qword [rsp + 0x38], rax
mov dword [0x1400f7001], 0x4000088
cmp qword [rsp + 0x38], 0
je 0x14001e117
mov dword [0x1400f7001], 0x4000089
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push qword [rsp + 0x40]
push qword [rsp + 0x38]
pop rcx
pop rdx
pop r8
call fcn.1400275bc
mov dword [0x1400f7001], 0x400008a
push qword [rsp + 0x38]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov dword [0x1400f7001], 0x400008b
mov r15, qword [rsp + 0x30]
and r15, r15
jne 0x14001e10d
mov dword [0x1400f7001], 0x400008c
mov qword [rsp + 0x70], 1
mov dword [0x1400f7001], 0x400008d
mov dword [0x1400f7001], 0x400008e
mov dword [0x1400f7001], 0x400008f
mov dword [0x1400f7001], 0x4000090
mov dword [0x1400f7001], 0x4000092
mov rax, qword [rsp + 0x70]
jmp 0x14001e153
add rsp, 0x78
pop r15
pop rbp
ret
Function at 0x14001e409
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
push r15
mov rax, 8
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14001e413
sub rsp, 0x28
call fcn.140040160
mov dword [0x1400f7001], 0x15d
mov dword [0x1400f7001], 0x15e
mov byte [rsp + 0x28], 0
mov dword [0x1400f7001], 0x160
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push 0x28
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
add rsp, 0x20
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.DLL_OpenProcessToken
and rax, rax
je 0x14001e5a8
mov dword [0x1400f7001], 0x161
lea rax, [rsp + 0x38]
mov dword [0x1400f7001], 0x163
lea rax, [rsp + 0x38]
mov rax, rax
push rax
movabs rax, str.SeDebugPrivilege
push rax
push 0
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.DLL_LookupPrivilegeValueW
and rax, rax
je 0x14001e58a
mov dword [0x1400f7001], 0x164
lea rax, [rsp + 0x40]
mov dword [0x1400f7001], 0x167
lea rbp, [rsp + 0x40]
mov dword [rbp], 1
mov dword [0x1400f7001], 0x168
lea rbp, [rsp + 0x38]
movsxd rax, dword [rbp]
push rax
lea rbp, [rsp + 0x48]
push rbp
pop rbp
pop rax
mov dword [rbp + 4], eax
mov dword [0x1400f7001], 0x169
lea rbp, [rsp + 0x38]
movsxd rax, dword [rbp + 4]
push rax
lea rbp, [rsp + 0x48]
push rbp
pop rbp
pop rax
mov dword [rbp + 8], eax
mov dword [0x1400f7001], 0x16a
push rbp
pop rbp
mov dword [rbp + 0xc], 2
mov dword [0x1400f7001], 0x16c
lea rax, [rsp + 0x60]
mov rax, rax
push rax
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push 0x10
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push 0
push qword [rsp + 0x58]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
add rsp, 0x30
mov rax, rax
push rax
pop rax
mov byte [rsp + 0x28], al
mov dword [0x1400f7001], 0x16d
mov dword [0x1400f7001], 0x16e
push qword [rsp + 0x30]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov dword [0x1400f7001], 0x16f
mov dword [0x1400f7001], 0x170
movsx rax, byte [rsp + 0x28]
movsx rax, al
jmp 0x14001e5d5
add rsp, 0x68
pop r15
pop rbp
ret

Function at 0x14001f55e
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
sub rsp, 0x28
call fcn.140040160
mov dword [0x1400f7001], 0x100002b
mov dword [0x1400f7001], 0x100002c
push qword [rsp + 0x40]
pop rcx
call sub.USER32.DLL_GetAsyncKeyState
mov r15, rax
and r15, 0x8000
and r15, r15
je 0x14001f5b2
mov dword [0x1400f7001], 0x100002d
mov rax, 1
jmp 0x14001f5c9
mov dword [0x1400f7001], 0x100002e
mov dword [0x1400f7001], 0x100002f
xor rax, rax
add rsp, 0x30
pop r15
ret
Function at 0x14001f897
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.140040160
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400401d0
add rsp, 0x10
mov dword [0x1400f7001], 0x3a2
mov dword [0x1400f7001], 0x3a4
push 5
sub rsp, 8
sub rsp, 0x20
call sub.USER32.DLL_GetDesktopWindow
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
call sub.USER32.DLL_GetWindow
mov qword [rsp + 0x30], rax
mov dword [0x1400f7001], 0x3a5
cmp qword [rsp + 0x30], 0
je 0x14001fabf
mov dword [0x1400f7001], 0x3a6
push rcx
sub rsp, 0x28
call fcn.14003fd40
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003fd40
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push qword [rsp + 0x50]
pop rcx
sub rsp, 0x20
call sub.USER32.DLL_GetWindowTextLengthW
add rsp, 0x28
mov r15, rax
add r15, 2
mov rax, r15
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003e0f0
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.14003fe00
mov dword [0x1400f7001], 0x3a7
push qword [rsp + 0x38]
pop rcx
call fcn.14003d6b0
mov rax, rax
push rax
push qword [rsp + 0x40]
push qword [rsp + 0x40]
pop rcx
pop rdx
pop r8
call sub.USER32.DLL_GetWindowTextW
mov dword [0x1400f7001], 0x3a8
push rcx
sub rsp, 0x28
call fcn.14003fd40
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003fd40
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003fd40
add rsp, 0x28
pop rcx
push rax
push qword [rsp + 0x50]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003e240
add rsp, 0x28
call fcn.140040090
push rcx
sub rsp, 0x20
call fcn.14003fd40
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14003fd40
add rsp, 0x28
pop rcx
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003e240
add rsp, 0x20
push rax
call fcn.14003ff70
mov rdx, rax
pop rax
add qword [rsp], rdx
push rax
call fcn.14003ff70
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003d520
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400222cc
add rsp, 0x28
pop rax
and rax, rax
je 0x14001fa87
mov dword [0x1400f7001], 0x3a9
mov rax, 1
jmp 0x14001fadb
mov dword [0x1400f7001], 0x3aa
mov dword [0x1400f7001], 0x3ab
push 2
push qword [rsp + 0x38]
pop rcx
pop rdx
call sub.USER32.DLL_GetWindow
mov qword [rsp + 0x30], rax
mov dword [0x1400f7001], 0x3ac
jmp 0x14001f8fe
mov dword [0x1400f7001], 0x3ad
xor rax, rax
jmp 0x14001fadb
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140040240
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.140040240
add rsp, 0x28
pop rax
add rsp, 0x40
pop r15
ret
Function at 0x14002093c
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
push rbp
mov rax, 0x4b
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140020949
sub rsp, 0x28
call fcn.140040160
mov rdx, qword [rsp + 0x290]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400401d0
add rsp, 0x10
mov dword [0x1400f7001], 0x200006b
mov dword [0x1400f7001], 0x200006f
lea rbp, [rsp + 0x38]
mov dword [rbp], 0x238
mov dword [0x1400f7001], 0x2000071
push 0
push 2
pop rcx
pop rdx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x30], rax
mov dword [0x1400f7001], 0x2000072
cmp qword [rsp + 0x30], 0
je 0x140020bae
mov dword [0x1400f7001], 0x2000073
lea rbp, [rsp + 0x38]
mov dword [rbp], 0x238
mov dword [0x1400f7001], 0x2000074
lea rax, [rsp + 0x38]
mov rax, rax
push rax
push qword [rsp + 0x38]
pop rcx
pop rdx
call sub.KERNEL32.dll_Process32FirstW
and rax, rax
je 0x140020b90
mov dword [0x1400f7001], 0x2000075
mov dword [0x1400f7001], 0x2000076
push rcx
sub rsp, 0x28
call fcn.14003fd40
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003fd40
add rsp, 0x28
pop rcx
push rax
lea rbp, [rsp + 0x50]
lea rax, [rbp + 0x2c]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003e870
add rsp, 0x28
lea rcx, [rsp + 0x278]
pop rdx
call fcn.14003fe00
mov dword [0x1400f7001], 0x2000078
push rcx
sub rsp, 0x28
call fcn.14003fd40
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003fd40
add rsp, 0x28
pop rcx
push rax
push qword [rsp + 0x288]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003d9a0
add rsp, 0x28
call fcn.140040090
push rcx
sub rsp, 0x20
call fcn.14003fd40
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14003fd40
add rsp, 0x28
pop rcx
push rax
push qword [rsp + 0x40]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003d9a0
add rsp, 0x20
pop rcx
sub rsp, 8
call fcn.1400400c0
add rsp, 8
mov rcx, rax
pop rdx
push rcx
mov rcx, rdx
sub rsp, 0x20
call fcn.1400400c0
add rsp, 0x20
pop rcx
mov rdx, rax
call fcn.14003fee0
or rax, rax
je 0x140020b4e
mov dword [0x1400f7001], 0x2000079
push qword [rsp + 0x30]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov dword [0x1400f7001], 0x200007a
lea rbp, [rsp + 0x38]
movsxd rax, dword [rbp + 8]
movsxd rax, eax
jmp 0x140020bd7
mov dword [0x1400f7001], 0x200007b
mov dword [0x1400f7001], 0x200007c
lea rax, [rsp + 0x38]
mov rax, rax
push rax
push qword [rsp + 0x38]
pop rcx
pop rdx
call sub.KERNEL32.dll_Process32NextW
and rax, rax
je 0x140020b80
xor rax, rax
jmp 0x140020b87
mov rax, 1
and rax, rax
je 0x140020a10
mov dword [0x1400f7001], 0x200007d
mov dword [0x1400f7001], 0x200007e
push qword [rsp + 0x30]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov dword [0x1400f7001], 0x200007f
mov dword [0x1400f7001], 0x2000081
xor rax, rax
movsxd rax, eax
jmp 0x140020bd7
push rax
mov rcx, qword [rsp + 0x278]
sub rsp, 0x28
call fcn.140040240
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140040240
add rsp, 0x28
pop rax
add rsp, 0x280
pop rbp
ret