joyce8/EMBER2024-capa huggingface dataset:
Function at 0x631220
Capabilities:
Get file attributes

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x60], rcx
nop
mov dword [rbp + 0x48], 0xffffffff
cmp qword [rbp + 0x60], 0
je 0x631323
mov ecx, 1
call sub.kernel32.dll_SetErrorMode
mov dword [rbp + 0x4c], eax
nop
mov dword [rbp + 0x3c], 0
mov rax, qword [rbp + 0x60]
test rax, rax
je 0x631277
mov eax, dword [rax - 4]
mov dword [rbp + 0x3c], eax
cmp dword [rbp + 0x3c], 0x104
jl 0x6312f8
mov rcx, qword [rbp + 0x60]
lea rdx, [0x00631394]
mov r8b, 1
call fcn.0063b780
test al, al
je 0x6312a6
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x60]
call fcn.00410470
jmp 0x631305
mov rcx, qword [rbp + 0x60]
call fcn.0062fc60
test al, al
je 0x6312e2
lea rcx, [rbp + 0x20]
mov rdx, qword [rbp + 0x60]
mov r8d, 3
mov r9d, 0x7fffffff
call fcn.00411760
lea rcx, [rbp + 0x40]
lea rdx, [0x006313ac]
mov r8, qword [rbp + 0x20]
call fcn.004115a0
jmp 0x631305
lea rcx, [rbp + 0x40]
lea rdx, [0x00631394]
mov r8, qword [rbp + 0x60]
call fcn.004115a0
jmp 0x631305
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x60]
call fcn.00410470
nop
mov rcx, qword [rbp + 0x40]
call fcn.00411170
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x48], eax
nop
mov ecx, dword [rbp + 0x4c]
call sub.kernel32.dll_SetErrorMode
nop
lea rcx, [rbp + 0x20]
call fcn.0040fd70
lea rcx, [rbp + 0x40]
call fcn.0040fd70
mov eax, dword [rbp + 0x48]
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x6313e0
Capabilities:
Set file attributes

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov dword [rbp + 0x30], edx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x48], 0
nop
xor eax, eax
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x63140e
mov eax, dword [rcx - 4]
cmp eax, 0x104
jl 0x63148e
mov rcx, qword [rbp + 0x28]
lea rdx, [0x00631514]
mov r8b, 1
call fcn.0063b780
test al, al
je 0x63143c
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x28]
call fcn.00410470
jmp 0x63149b
mov rcx, qword [rbp + 0x28]
call fcn.0062fc60
test al, al
je 0x631478
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x28]
mov r8d, 3
mov r9d, 0x7fffffff
call fcn.00411760
lea rcx, [rbp + 0x48]
lea rdx, [0x0063152c]
mov r8, qword [rbp + 0x38]
call fcn.004115a0
jmp 0x63149b
lea rcx, [rbp + 0x48]
lea rdx, [0x00631514]
mov r8, qword [rbp + 0x28]
call fcn.004115a0
jmp 0x63149b
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x28]
call fcn.00410470
nop
mov rcx, qword [rbp + 0x48]
call fcn.00411170
mov rcx, rax
mov edx, dword [rbp + 0x30]
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
setne al
mov byte [rbp + 0x37], al
nop
lea rcx, [rbp + 0x38]
call fcn.0040fd70
lea rcx, [rbp + 0x48]
call fcn.0040fd70
movzx rax, byte [rbp + 0x37]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x631980
Capabilities:
Copy file

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], rdx
mov byte [rbp + 0x3e], r8b
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
nop
xor eax, eax
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x6319c4
mov eax, dword [rcx - 4]
cmp eax, 0x104
jl 0x631a44
mov rcx, qword [rbp + 0x28]
lea rdx, [0x00631b78]
mov r8b, 1
call fcn.0063b780
test al, al
je 0x6319f2
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x28]
call fcn.00410470
jmp 0x631a51
mov rcx, qword [rbp + 0x28]
call fcn.0062fc60
test al, al
je 0x631a2e
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x28]
mov r8d, 3
mov r9d, 0x7fffffff
call fcn.00411760
lea rcx, [rbp + 0x58]
lea rdx, [0x00631b90]
mov r8, qword [rbp + 0x48]
call fcn.004115a0
jmp 0x631a51
lea rcx, [rbp + 0x58]
lea rdx, [0x00631b78]
mov r8, qword [rbp + 0x28]
call fcn.004115a0
jmp 0x631a51
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x28]
call fcn.00410470
nop
xor eax, eax
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x631a60
mov eax, dword [rcx - 4]
cmp eax, 0x104
jl 0x631ae0
mov rcx, qword [rbp + 0x30]
lea rdx, [0x00631b78]
mov r8b, 1
call fcn.0063b780
test al, al
je 0x631a8e
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x30]
call fcn.00410470
jmp 0x631aed
mov rcx, qword [rbp + 0x30]
call fcn.0062fc60
test al, al
je 0x631aca
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x30]
mov r8d, 3
mov r9d, 0x7fffffff
call fcn.00411760
lea rcx, [rbp + 0x50]
lea rdx, [0x00631b90]
mov r8, qword [rbp + 0x40]
call fcn.004115a0
jmp 0x631aed
lea rcx, [rbp + 0x50]
lea rdx, [0x00631b78]
mov r8, qword [rbp + 0x30]
call fcn.004115a0
jmp 0x631aed
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x30]
call fcn.00410470
nop
mov rcx, qword [rbp + 0x58]
call fcn.00411170
mov rbx, rax
mov rcx, qword [rbp + 0x50]
call fcn.00411170
mov rcx, rbx
mov rdx, rax
movzx rax, byte [rbp + 0x3e]
test al, al
setne al
movzx rax, al
neg eax
mov r8d, eax
call sub.kernel32.dll_CopyFileW
test eax, eax
setne al
mov byte [rbp + 0x3f], al
nop
lea rcx, [rbp + 0x40]
mov edx, 4
call fcn.0040fe50
movzx rax, byte [rbp + 0x3f]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret
Function at 0x634930
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xe0
mov rbp, rsp
mov qword [rbp + 0x38], rcx
mov dword [rbp + 0x44], edx
mov byte [rbp + 0x4b], r8b
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
nop
movzx rax, byte [rbp + 0x4b]
test al, al
je 0x6349c8
mov eax, dword [rbp + 0x44]
cmp eax, 0x40
jle 0x634999
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x38]
mov r8d, dword [rbp + 0x44]
call fcn.0063ad90
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
call fcn.0063b750
mov rcx, qword [rbp + 0x58]
xor edx, edx
call fcn.00634a60
mov dword [rbp + 0x4c], eax
jmp 0x634a21
xor ecx, ecx
mov edx, 0x200
mov r8, qword [rbp + 0x38]
mov r9d, dword [rbp + 0x44]
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov eax, dword [rbp + 0x44]
mov dword [rsp + 0x28], eax
call sub.kernel32.dll_LCMapStringW
mov dword [rbp + 0x44], eax
lea rax, [rbp + 0x60]
mov qword [rbp + 0x38], rax
xor eax, eax
mov dword [rbp + 0x4c], eax
mov eax, dword [rbp + 0x44]
test eax, eax
jle 0x634a1f
mov eax, dword [rbp + 0x4c]
shl eax, 4
mov rcx, qword [rbp + 0x38]
movzx ecx, word [rcx]
add eax, ecx
mov dword [rbp + 0x4c], eax
and eax, 0xf0000000
mov ecx, eax
shr ecx, 0x18
mov edx, dword [rbp + 0x4c]
xor edx, ecx
mov dword [rbp + 0x4c], edx
not eax
mov ecx, dword [rbp + 0x4c]
and ecx, eax
mov dword [rbp + 0x4c], ecx
mov eax, dword [rbp + 0x44]
sub eax, 1
mov dword [rbp + 0x44], eax
mov rax, qword [rbp + 0x38]
add rax, 2
mov qword [rbp + 0x38], rax
mov eax, dword [rbp + 0x44]
test eax, eax
jg 0x6349d4
nop
nop
lea rcx, [rbp + 0x50]
mov edx, 2
call fcn.0040fe50
mov eax, dword [rbp + 0x4c]
lea rsp, [rbp + 0xe0]
pop rbp
ret

Function at 0x634f50
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
test r9d, r9d
jbe 0x634f8a
mov eax, dword [rdx]
shl eax, 8
mov rcx, qword [rsp + 0x28]
mov r10d, dword [rdx]
shr r10d, 0x18
and r10d, 0xff
movzx r11, byte [r8]
xor r10d, r11d
mov r10d, r10d
xor eax, dword [rcx + r10*4]
mov dword [rdx], eax
add r8, 1
sub r9d, 1
test r9d, r9d
ja 0x634f55
nop
ret

Function at 0x63fe40
Capabilities:
Create process on windows

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], rdx
mov qword [rbp + 0x60], r8
mov qword [rbp + 0x78], 0
nop
lea rcx, [rbp + 0x78]
mov rax, qword [rbp + 0x50]
mov rdx, qword [rax + 0x138]
call fcn.00411300
mov rcx, qword [rbp + 0x78]
call fcn.00410e30
xor ecx, ecx
mov rdx, rax
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0xffffffff
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x63fedb
mov rax, qword [rbp + 0x58]
mov rcx, qword [rax]
mov edx, 0x1388
call sub.user32.dll_WaitForInputIdle
cmp eax, 0x102
jne 0x63fedf
xor eax, eax
jmp 0x63fee1
mov al, 1
test al, al
setne al
movzx rax, al
neg eax
mov dword [rbp + 0x6c], eax
nop
lea rcx, [rbp + 0x78]
call fcn.0040fe10
mov eax, dword [rbp + 0x6c]
lea rsp, [rbp + 0x80]
pop rbp
ret
Function at 0x6851c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rsi, r8
mov rdi, r9
mov rcx, rdx
call fcn.00411170
mov rcx, rbx
mov rdx, rax
xor r8, r8
mov r9, rsi
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], rdi
call sub.advapi32.dll_RegQueryValueExW
mov ecx, eax
call fcn.006851b0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret

Function at 0x685260
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rdx
call fcn.00411170
mov rcx, rbx
mov rdx, rax
call sub.advapi32.dll_RegDeleteKeyW
mov ecx, eax
call fcn.006851b0
add rsp, 0x20
pop rbx
ret

Function at 0x685290
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
sub rsp, 0x110
mov rbp, rsp
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0x120], rcx
mov qword [rbp + 0x128], rdx
nop
cmp qword [rbp + 0x128], 0
je 0x6852ca
cmp qword [rbp + 0x120], 0
jne 0x6852ce
xor eax, eax
jmp 0x6852d0
mov al, 1
mov byte [rbp + 0x107], al
cmp byte [rbp + 0x107], 0
je 0x685448
mov rcx, qword [rbp + 0x120]
mov rdx, qword [rbp + 0x128]
lea r8, [rbp + 0x108]
call fcn.00685980
test al, al
je 0x685447
nop
mov rcx, qword [rbp + 0x108]
xor edx, edx
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
call sub.advapi32.dll_RegQueryInfoKeyW
mov ecx, eax
call fcn.006851b0
test al, al
je 0x685421
mov eax, dword [rbp + 0x80]
sub eax, 1
mov dword [rbp + 0x74], eax
cmp dword [rbp + 0x74], 0
jl 0x685420
mov dword [rbp + 0x7c], 0x40
lea rcx, [rbp + 0x86]
mov edx, 0x80
xor r8, r8
call fcn.0040bbc0
mov rcx, qword [rbp + 0x108]
mov edx, dword [rbp + 0x74]
lea r8, [rbp + 0x86]
lea r9, [rbp + 0x7c]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumKeyExW
mov dword [rbp + 0x78], eax
cmp dword [rbp + 0x78], 0
jne 0x685412
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x86]
mov r8d, 0x40
call fcn.00411260
mov rcx, qword [rbp + 0x108]
mov rdx, qword [rbp + 0x60]
call fcn.00685290
sub dword [rbp + 0x74], 1
cmp dword [rbp + 0x74], 0xffffffff
jne 0x68538a
nop
nop
mov rcx, qword [rbp + 0x108]
call fcn.00685750
mov rcx, qword [rbp + 0x120]
mov rdx, qword [rbp + 0x128]
call fcn.00685260
mov byte [rbp + 0x107], al
nop
lea rcx, [rbp + 0x60]
call fcn.0040fd70
movzx rax, byte [rbp + 0x107]
lea rsp, [rbp + 0x110]
pop rbp
ret

Function at 0x6854b0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x50], r8d
test rbx, rbx
setne al
test al, al
je 0x6854fc
mov rcx, rdx
call fcn.00411170
mov rcx, rbx
mov rdx, rax
xor r8, r8
mov r9d, 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
call sub.advapi32.dll_RegSetValueExW
mov ecx, eax
call fcn.006851b0
add rsp, 0x30
pop rbx
ret
Function at 0x685510
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x2a0
mov rbp, rsp
mov qword [rbp + 0x68], rcx
mov qword [rbp + 0x70], rdx
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x2e0], r8
mov rcx, qword [rbp + 0x2e0]
call fcn.00416910
nop
mov rcx, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x70]
call fcn.00685960
mov rbx, rax
test rbx, rbx
setne al
mov byte [rbp + 0x67], al
movzx rax, byte [rbp + 0x67]
test al, al
je 0x68567f
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x68567f
xor eax, eax
mov edi, dword [rbp + 0x90]
sub edi, 1
mov esi, eax
cmp esi, edi
jg 0x685676
sub edi, eax
add edi, 1
mov dword [rbp + 0x8c], 0x104
lea rcx, [rbp + 0x96]
call fcn.0062fc20
mov rcx, rbx
mov edx, esi
lea r8, [rbp + 0x96]
lea r9, [rbp + 0x8c]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumKeyExW
lea rcx, [rbp + 0x78]
lea rdx, [rbp + 0x96]
mov r8d, 0x105
call fcn.00411260
mov rcx, qword [rbp + 0x2e0]
mov rdx, qword [rbp + 0x78]
mov rax, qword [rbp + 0x2e0]
mov r13, qword [rax]
call qword [r13 + 0x18]
add esi, 1
sub edi, 1
test edi, edi
jne 0x6855e7
nop
mov rcx, rbx
call fcn.00685750
nop
lea rcx, [rbp + 0x78]
call fcn.0040fd70
lea rcx, [rbp + 0x2e0]
call fcn.00416800
movzx rax, byte [rbp + 0x67]
lea rsp, [rbp + 0x2a0]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret

Function at 0x685770
Capabilities:
Set registry value

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rsi, r8
test rbx, rbx
setne al
test al, al
je 0x6857d2
xor edi, edi
mov rax, rsi
test rax, rax
je 0x685796
mov edi, dword [rax - 4]
mov rcx, rdx
call fcn.00411170
mov r13, rax
mov rcx, rsi
call fcn.00411170
mov rcx, rbx
mov rdx, r13
xor r8, r8
mov r9d, 1
mov qword [rsp + 0x20], rax
add edi, 1
add edi, edi
mov dword [rsp + 0x28], edi
call sub.advapi32.dll_RegSetValueExW
mov ecx, eax
call fcn.006851b0
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x719d50
Capabilities:
Create process on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rsi, rdx
test rbx, rbx
jne 0x719d68
xor eax, eax
jmp 0x719de9
mov rax, qword [0x008abdc8]
cmp byte [rax], 0
je 0x719da7
mov rcx, rbx
call fcn.0062fc90
test al, al
jne 0x719d96
mov rcx, rbx
lea rdx, [0x00719dfc]
mov r8b, 1
call fcn.0063b780
test al, al
je 0x719da7
lea rcx, [0x00719e18]
mov rdx, rbx
call fcn.00719d50
jmp 0x719de9
mov rcx, rbx
call fcn.00411170
mov rbx, rax
mov rcx, rsi
call fcn.00411170
xor ecx, ecx
lea rdx, [0x00719e30]
mov r8, rbx
mov r9, rax
lea rax, [0x00719e3a]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 5
call sub.shell32.dll_ShellExecuteW
cmp rax, 0x20
setae al
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x71aa40
Capabilities:
Get file system object information

Disassembly:
sub rsp, 0x2f8
lea rcx, [rsp + 0x38]
mov edx, 0x2b8
xor r8, r8
call fcn.0040bbc0
lea rcx, [0x0071aa84]
xor edx, edx
lea r8, [rsp + 0x38]
mov r9d, 0x2b8
mov dword [rsp + 0x20], 0x4011
call sub.shell32.dll_SHGetFileInfoW
add rsp, 0x2f8
ret

Function at 0x71b190
Capabilities:
Get file system object information

Disassembly:
push rbp
sub rsp, 0x2f0
mov rbp, rsp
mov rcx, qword [rcx + 8]
xor edx, edx
lea r8, [rbp + 0x38]
mov r9d, 0x2b8
mov dword [rsp + 0x20], 0x4009
call sub.shell32.dll_SHGetFileInfoW
mov eax, dword [rbp + 0x40]
lea rsp, [rbp + 0x2f0]
pop rbp
ret

Function at 0x74be40
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, word [0x0074bec8]
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x74be60
or bx, 1
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x74be73
or bx, 4
mov ecx, 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x74be86
or bx, 2
mov ecx, 1
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x74be99
or bx, 8
mov ecx, 4
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x74beac
or bx, 0x20
mov ecx, 2
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x74bebf
or bx, 0x10
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x759140
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rbx
call fcn.00759900
mov qword [rbx + 0x40], rax
call sub.kernel32.dll_GetCurrentThreadId
mov eax, eax
mov qword [rbx + 0x48], rax
mov rax, qword [rbx + 0x40]
cmp rax, qword [rbx + 0x48]
je 0x759178
mov ecx, dword [rbx + 0x40]
mov edx, dword [rbx + 0x48]
or r8d, 0xffffffff
call sub.user32.dll_AttachThreadInput
add rsp, 0x20
pop rbx
ret

Function at 0x759180
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rax, qword [rbx + 0x40]
test rax, rax
je 0x7591ad
cmp rax, qword [rbx + 0x48]
je 0x7591ad
mov ecx, dword [rbx + 0x40]
mov edx, dword [rbx + 0x48]
xor r8, r8
call sub.user32.dll_AttachThreadInput
mov qword [rbx + 0x40], 0
add rsp, 0x20
pop rbx
ret
Function at 0x7c32e0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xa0], rcx
nop
mov rcx, qword [0x00627a60]
mov dl, 1
lea r8, [0x007c3498]
lea r9, [0x007c34ac]
lea rax, [0x007c34c0]
mov qword [rsp + 0x20], rax
call fcn.00627d50
mov qword [rbp + 0x88], rax
nop
mov rax, qword [rbp + 0x88]
mov byte [rax + 0x66], 0
mov rax, qword [rbp + 0x88]
mov byte [rax + 0x64], 1
mov rax, qword [rbp + 0x88]
mov byte [rax + 0x65], 1
call sub.kernel32.dll_GetCommandLineW
lea rcx, [rbp + 0x38]
mov rdx, rax
call fcn.00411200
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x38]
call fcn.0063c2c0
mov rcx, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x40]
call fcn.00627f80
mov rcx, qword [rbp + 0x88]
lea rdx, [rbp + 0x70]
call fcn.00627fc0
test al, al
je 0x7c33f2
mov rax, qword [rbp + 0x88]
mov rax, qword [rax + 0x50]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x88]
mov eax, dword [rax + 0x60]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jle 0x7c33d7
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x68]
mov r8d, dword [rbp + 0x64]
call fcn.00410070
jmp 0x7c33e0
lea rcx, [rbp + 0x58]
call fcn.0040fd70
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0x58]
call fcn.0063c2c0
jmp 0x7c3408
mov rcx, qword [rbp + 0xa0]
mov rax, qword [0x008ac560]
mov rdx, qword [rax]
call fcn.004103e0
nop
mov rcx, qword [rbp + 0x88]
call fcn.0040ccc0
nop
lea rcx, [rbp + 0x38]
mov edx, 2
call fcn.0040fe50
lea rcx, [rbp + 0x58]
call fcn.0040fd70
mov rax, qword [rbp + 0xa0]
lea rsp, [rbp + 0x90]
pop rbp
ret

Function at 0x7da0b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor r10, r10
sub r9d, 1
mov ecx, r10d
cmp ecx, r9d
jg 0x7da0f5
sub r9d, r10d
add r9d, 1
mov r10d, eax
add r10d, r10d
add r10d, r10d
shr eax, 0x1e
or r10d, eax
mov eax, r8d
add eax, ecx
movsxd rax, eax
movzx eax, word [rdx + rax*2]
xor r10d, eax
mov eax, r10d
add ecx, 1
sub r9d, 1
test r9d, r9d
jne 0x7da0c8
nop
ret

Function at 0x7e68c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov ecx, dword [rdx + 0x100]
mov r10d, dword [rdx + 0x104]
cmp dword [rsp + 0x38], 0
jle 0x7e692d
add cl, 1
movzx rcx, cl
movsxd r11, ecx
movzx rax, byte [rdx + r11]
add r10b, al
movzx r10, r10b
movzx rax, al
movsxd rbx, r10d
movzx rsi, byte [rdx + rbx]
mov byte [rdx + r11], sil
mov byte [rdx + rbx], al
movzx rax, byte [rdx + r11]
add al, byte [rdx + rbx]
movzx rax, al
movsxd rax, eax
movzx r11, byte [r8]
xor r11b, byte [rdx + rax]
mov byte [r9], r11b
sub dword [rsp + 0x38], 1
add r9, 1
add r8, 1
cmp dword [rsp + 0x38], 0
jg 0x7e68d6
nop
mov dword [rdx + 0x100], ecx
mov dword [rdx + 0x104], r10d
pop rbx
pop rsi
ret
Function at 0x7e6940
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbp
push rbx
sub rsp, 0x118
mov rbp, rsp
mov rcx, rdx
mov dword [rcx + 0x100], 0
mov dword [rcx + 0x104], 0
xor r10, r10
lea r11, [rbp + 8]
mov rbx, rcx
mov eax, r10d
cdq
idiv r9d
movsxd rdx, edx
movzx rax, byte [r8 + rdx]
mov byte [r11], al
mov byte [rbx], r10b
add r10d, 1
add rbx, 1
add r11, 1
cmp r10d, 0x100
jne 0x7e696d
nop
xor eax, eax
mov r11d, pe_nt_image_headers64
mov r8, rcx
lea r9, [rbp + 8]
movzx rdx, byte [r8]
add eax, edx
movzx r10, byte [r9]
add eax, r10d
and eax, 0xff
movsxd r10, eax
movzx rbx, byte [rcx + r10]
mov byte [r8], bl
mov byte [rcx + r10], dl
add r9, 1
add r8, 1
sub r11d, 1
test r11d, r11d
jne 0x7e69a7
nop
lea rsp, [rbp + 0x118]
pop rbx
pop rbp
ret

Function at 0x7eb1c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rsi, rcx
cmp dword [rsi + 0x3d2e8], 0
jne 0x7eb2b3
mov rcx, rsi
call fcn.007eb350
movzx r8d, word [rsi + 0x34236]
xor edi, edi
nop word cs:[rax + rax]
mov ebx, edi
and ebx, 1
mov edx, edi
shr edx, 1
lea r9d, [rbx + 2]
and edx, 1
lea r10d, [rdx + rbx*2 + 4]
neg ebx
and ebx, 0x7f0
xor ebx, r8d
shr ebx, 4
mov ecx, edi
shr ecx, 2
movzx eax, word [rsi + r9*2 + 0x34234]
neg edx
and edx, 0x7f0
xor edx, eax
shr edx, 4
mov eax, dword [rsi + rdx*4 + 0x324dc]
add eax, dword [rsi + rbx*4 + 0x324dc]
and ecx, 1
mov edx, edi
shr edx, 3
movzx r9d, word [rsi + r10*2 + 0x34234]
lea ebx, [rcx + r10*2]
neg ecx
and ecx, 0x7f0
xor ecx, r9d
shr ecx, 4
add eax, dword [rsi + rcx*4 + 0x324dc]
and edx, 1
movzx ecx, word [rsi + rbx*2 + 0x34234]
neg edx
and edx, 0x7f0
xor edx, ecx
shr edx, 4
add eax, dword [rsi + rdx*4 + 0x324dc]
mov dword [rsi + rdi*4 + 0x33b8c], eax
inc rdi
cmp rdi, 0x10
jne 0x7eb200
mov dword [rsi + 0x33bcc], 0
mov eax, dword [rsi + 0x32f70]
dec eax
mov dword [rsi + 0x3d2a0], eax
lea r14, [rsi + 0x34254]
mov dword [rsi + 0x38a58], eax
mov cl, byte [rsi + 0x33bdc]
mov r15d, 1
shl r15d, cl
lea rdi, [rsi + 0x324dc]
xor ebx, ebx
nop word cs:[rax + rax]
mov rcx, r14
mov edx, ebx
mov r8, rdi
call fcn.007ef8e0
inc ebx
cmp r15d, ebx
jne 0x7eb2f0
mov cl, byte [rsi + 0x33bdc]
add rsi, 0x38a9c
mov r14d, 1
shl r14d, cl
xor ebx, ebx
nop dword [rax]
mov rcx, rsi
mov edx, ebx
mov r8, rdi
call fcn.007ef8e0
inc ebx
cmp r14d, ebx
jne 0x7eb320
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x7eb350
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x208
lea rbp, [rsp + 0x80]
mov rax, rcx
mov r8d, 4
movzx esi, byte [rax + r8 + 0x304dc]
mov edi, esi
shr edi, 1
lea ecx, [rdi - 1]
mov edx, esi
and edx, 1
or edx, 2
shl edx, cl
test ecx, ecx
je 0x7eb3d0
lea r9, [rax + rdx*2 + 0x34150]
add rsi, rsi
sub r9, rsi
add r9, 0xfffffffffffffffe
mov r10d, r8d
sub r10d, edx
and ecx, 1
cmp edi, 2
jne 0x7eb3e0
xor edx, edx
mov r14d, 1
test ecx, ecx
jne 0x7eb44a
jmp 0x7eb46d
xor edx, edx
jmp 0x7eb46d
lea r11d, [rcx + 1]
sub r11d, edi
xor edx, edx
mov r14d, 1
nop
mov ebx, r10d
and ebx, 1
mov edi, r10d
shr edi, 1
mov esi, r14d
movzx r15d, word [r9 + rsi*2]
lea esi, [rbx + r14*2]
neg ebx
and ebx, 0x7f0
xor ebx, r15d
shr ebx, 4
add edx, dword [rax + rbx*4 + 0x324dc]
and edi, 1
shr r10d, 2
movzx ebx, word [r9 + rsi*2]
lea r14d, [rdi + rsi*2]
neg edi
and edi, 0x7f0
xor edi, ebx
shr edi, 4
add edx, dword [rax + rdi*4 + 0x324dc]
add r11d, 2
jne 0x7eb3f0
test ecx, ecx
je 0x7eb46d
and r10d, 1
neg r10d
and r10d, 0x7f0
mov ecx, r14d
movzx ecx, word [r9 + rcx*2]
xor ecx, r10d
shr ecx, 4
add edx, dword [rax + rcx*4 + 0x324dc]
mov dword [rbp + r8*4 - 0x80], edx
inc r8
cmp r8, 0x80
jne 0x7eb370
lea r8, [rax + 0x333a0]
xor r10d, r10d
nop dword [rax]
cmp dword [rax + 0x33bd0], 0
je 0x7eb546
xor r9d, r9d
mov edx, r9d
or edx, 0x40
xor ecx, ecx
mov esi, edx
nop word [rax + rax]
shr esi, 1
lea ebx, [rsi + rsi]
mov rdi, r10
shl rdi, 7
add rdi, rax
movzx ebx, word [rbx + rdi + 0x33f50]
and edx, 1
neg edx
and edx, 0x7f0
xor edx, ebx
shr edx, 4
add ecx, dword [rax + rdx*4 + 0x324dc]
cmp esi, 1
mov edx, esi
jne 0x7eb4b0
mov ebx, r9d
mov rdx, r10
shl rdx, 8
add rdx, rax
mov dword [rdx + rbx*4 + 0x32f8c], ecx
inc r9d
mov ecx, dword [rax + 0x33bd0]
cmp r9d, ecx
jb 0x7eb4a0
cmp ecx, 0xf
jb 0x7eb546
mov ecx, 0xe
nop word cs:[rax + rax]
mov ebx, ecx
and ebx, 0x1ffffffe
mov edi, ecx
mov esi, dword [rdx + rdi*4 + 0x32f8c]
lea ebx, [rsi + rbx*8 - 0x50]
mov dword [rdx + rdi*4 + 0x32f8c], ebx
inc ecx
cmp ecx, dword [rax + 0x33bd0]
jb 0x7eb520
mov rcx, r10
shl rcx, 8
mov rdx, r10
shl rdx, 9
movups xmm0, xmmword [rax + rcx + 0x32f8c]
movups xmmword [rax + rdx + 0x3338c], xmm0
xor edx, edx
nop word cs:[rax + rax]
movzx ebx, byte [rax + rdx + 0x304e0]
lea rdi, [rax + rcx]
mov esi, dword [rbp + rdx*4 - 0x70]
add esi, dword [rdi + rbx*4 + 0x32f8c]
mov dword [r8 + rdx*4 - 4], esi
movzx ebx, byte [rax + rdx + 0x304e1]
mov esi, dword [rbp + rdx*4 - 0x6c]
add esi, dword [rdi + rbx*4 + 0x32f8c]
mov dword [r8 + rdx*4], esi
add rdx, 2
cmp rdx, 0x7c
jne 0x7eb570
inc r10
add r8, 0x200
cmp r10, 4
jne 0x7eb490
mov dword [rax + 0x3d350], 0
add rsp, 0x208
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret