joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44c777
movzx edx, byte [rax]
test edx, edx
jne 0x44c634
nop dword [rax]
test r8b, r8b
jne 0x44c634
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x44c647
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44c737
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x44c725
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x44c717
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44c69d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x44c6e0
mov eax, 1
cmp rax, rbx
ja 0x44c6cb
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.0045d8a0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44c70f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x44c6d3
mov rcx, r11
mov eax, r12d
jmp 0x44c6a2
mov rcx, rbx
call fcn.0045d7e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0045d7e0
mov eax, r8d
mov rcx, rbx
call fcn.0045d8a0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44c76d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x44c730
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44c64d
mov eax, edx
mov rcx, rbx
call fcn.0045d7e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0045d7e0
nop
int3
Function at 0x453b80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x453c2f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00453c80]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045b420
xorps xmm15, xmm15
mov r14, qword [0x00599690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045b560
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00453b80
Function at 0x45d340
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403183
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00408be0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045b560
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403160
cmp byte [0x0059946e], 0
je 0x45d355
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45a5a0
jmp 0x403160

Function at 0x45d360
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00599720]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0059946e], 0
je 0x45d395
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005999e0]
aesenc xmm0, xmmword [0x005999f0]
aesenc xmm0, xmmword [0x00599a00]
movq rax, xmm0
ret
jmp 0x408e00

Function at 0x45d3a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00599720]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0059946e], 0
je 0x45d3d6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005999e0]
aesenc xmm0, xmmword [0x005999f0]
aesenc xmm0, xmmword [0x00599a00]
movq rax, xmm0
ret
jmp 0x408e60

Function at 0x45f0a0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x45f0d4
mov rcx, 0x28
jmp 0x45f0df
shl rcx, 3
add rcx, 0x1480
mov qword [0x00599690], rcx
pop rbp
ret

Function at 0x4660a0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x46610b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x4660c4
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x4660e1
cmp rdx, 0
je 0x46612d
test rdx, 0xf
je 0x4660bd
test rdx, 7
jne 0x4660e1
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x4660bd
ret
Function at 0x477140
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x47717f
jb 0x477194
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x477200
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4772d4
jb 0x477333
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004770e0
aeskeygenassist xmm1, xmm0, 1
call fcn.00477100
aeskeygenassist xmm1, xmm2, 2
call fcn.004770e0
aeskeygenassist xmm1, xmm0, 2
call fcn.00477100
aeskeygenassist xmm1, xmm2, 4
call fcn.004770e0
aeskeygenassist xmm1, xmm0, 4
call fcn.00477100
aeskeygenassist xmm1, xmm2, 8
call fcn.004770e0
aeskeygenassist xmm1, xmm0, 8
call fcn.00477100
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004770e0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00477100
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004770e0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00477100
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004770e0
jmp 0x4773a1
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.00477040
aeskeygenassist xmm1, xmm2, 2
call fcn.004770a0
aeskeygenassist xmm1, xmm2, 4
call fcn.00477040
aeskeygenassist xmm1, xmm2, 8
call fcn.004770a0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00477040
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004770a0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00477040
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004770a0
jmp 0x4773a1
aeskeygenassist xmm1, xmm0, 1
call fcn.00477000
aeskeygenassist xmm1, xmm0, 2
call fcn.00477000
aeskeygenassist xmm1, xmm0, 4
call fcn.00477000
aeskeygenassist xmm1, xmm0, 8
call fcn.00477000
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00477000
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00477000
aeskeygenassist xmm1, xmm0, 0x40
call fcn.00477000
aeskeygenassist xmm1, xmm0, 0x80
call fcn.00477000
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.00477000
aeskeygenassist xmm1, xmm0, 0x36
call fcn.00477000
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4773ae
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x47b4a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47b56a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403100
xorps xmm15, xmm15
mov r14, qword [0x00599690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47b54f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00495dc0]
xor ebx, ebx
mov rcx, rdx
call fcn.004457c0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0047ba80
inc rbx
cmp rcx, rbx
jae 0x47b53e
mov edi, 1
lea rsi, [0x00495dc0]
call fcn.004458a0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004cc5c8]
lea rsi, [0x004cbd28]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045b560
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0047b4a0
Function at 0x1400111fe
Capabilities:
Terminate process

Disassembly:
jmp 0x1400135b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011285
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014900
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014920
xor al, al
jmp 0x1400149a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014933
xor al, al
jmp 0x1400149a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001495d
xor al, al
jmp 0x1400149a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014971
xor al, al
jmp 0x1400149a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014983
xor al, al
jmp 0x1400149a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001499f
xor al, al
jmp 0x1400149a1
mov al, 1
add rsp, 0x38
ret
Function at 0x14000c65c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140014cb8], rbx
je 0x14000c6c3
cmp rax, rbx
jne 0x14000c6b6
mov ebx, 1
mov esi, ebx
jmp 0x14000c6c8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000c69b
mov ebx, 1
mov eax, dword [0x140014cc0]
cmp eax, ebx
jne 0x14000c6e0
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000c74c
mov eax, dword [0x140014cc0]
test eax, eax
jne 0x14000c741
mov dword [0x140014cc0], ebx
lea r15, [0x14000eb70]
lea rdi, [0x14000eb58]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000c733
test eax, eax
jne 0x14000c737
cmp qword [rdi], r14
je 0x14000c728
mov rax, qword [rdi]
mov rcx, qword [0x14000eb00]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000c70a
test eax, eax
je 0x14000c747
mov eax, 0xff
jmp 0x14000c8a0
mov dword [0x140014400], ebx
mov edi, 0x1f
mov eax, dword [0x140014cc0]
cmp eax, ebx
jne 0x14000c773
lea rdx, [0x14000eb50]
lea rcx, [0x14000eb18]
call sub.msvcrt.dll__initterm
mov dword [0x140014cc0], 2
test esi, esi
jne 0x14000c781
mov rax, r14
xchg qword [0x140014cb8], rax
cmp qword [0x140014cd8], r14
je 0x14000c7b4
lea rcx, [0x140014cd8]
call fcn.14000cc80
test eax, eax
je 0x14000c7b4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140014cd8]
mov r9, qword [0x14000eb00]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000c7cd
mov eax, 0xff
jmp 0x14000c8a0
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14000c851
cmp word [rcx], r14w
je 0x14000c7e6
test edx, edx
jne 0x14000c851
movzx eax, word [rcx]
sub ax, bx
cmp ax, di
ja 0x14000c7fc
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c7e6
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400018e8
mov dword [0x1400143fc], eax
cmp dword [0x140014420], r14d
jne 0x14000c83a
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140014400], r14d
jne 0x14000c84f
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400143fc]
jmp 0x14000c8a0
cmp word [rcx], 0x22
jne 0x14000c865
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c7d6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14016a000
add rsp, 0x28
jmp 0x14000c65c
Function at 0x140001130
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rcx, qword [0x140005660]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ebx, ebx
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
jne 0x1400011d6
mov qword [rsp + 0xa0], rdi
nop dword [rax]
cmp dword [rsp + 0x40], 0x1000
jne 0x1400011af
test byte [rsp + 0x44], 4
je 0x1400011af
mov rdi, qword [rsp + 0x20]
xor eax, eax
mov rcx, qword [rsp + 0x38]
rep stosb byte [rdi], al
add rbx, qword [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
je 0x140001190
mov rdi, qword [rsp + 0xa0]
mov rcx, qword [0x140005660]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400020e0
add rsp, 0x90
pop rbx
ret
Function at 0x140001db0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x140005660], rax
test rax, rax
jne 0x140001df3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateMutex_failed_with_error:__d_n
call fcn.1400010d0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140001470
test eax, eax
je 0x140001e0c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___File_scheduled_for_deletion_successfully.
jmp 0x140001e1a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.____Failed_to_schedule_file_for_deletion.
call fcn.140001e50
lea rdx, [0x140002020]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [0x140005660]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400029a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400029ea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400029ea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], reloc.KERNEL32.dll_CreateMutexW
jne 0x1400029ea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400029ea
cmp dword [rcx + 0x84], 0xe
jbe 0x1400029ea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400029ec
xor al, al
add rsp, 0x28
ret
Function at 0x140013b50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x13e8
call fcn.1400887e0
sub rsp, rax
movaps xmmword [rsp + 0x13d0], xmm6
movaps xmmword [rsp + 0x13c0], xmm7
mov rax, qword [0x1400aa200]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
movaps xmm6, xmm1
movaps xmm7, xmm0
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x24], eax
mov r9d, 0x270
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, r9
jb 0x140013bb0
mov dword [rsp + 0x20], r9d
lea r8, [rsp + 0x28]
nop word [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140013be0
mov eax, dword [rsp + 0x20]
subss xmm6, xmm7
xorps xmm0, xmm0
mov ecx, dword [rsp + rax*4 + 0x24]
mov eax, ecx
shr eax, 0xb
and eax, dword [rsp + 0x13a4]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2ss xmm0, rax
mulss xmm0, xmm6
mulss xmm0, dword [0x14009a5c8]
addss xmm0, xmm7
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.140087740
movaps xmm6, xmmword [rsp + 0x13d0]
movaps xmm7, xmmword [rsp + 0x13c0]
add rsp, 0x13e8
ret
Function at 0x140017050
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
cmp byte [0x1401041c8], 0
je 0x14001723c
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14001723c
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14001723c
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400170a2
mov byte [0x140103ffa], 1
jmp 0x1400170f5
cmp byte [0x140103ffa], 0
je 0x1400170f5
xor edx, edx
lea ecx, [rdx + 0x44]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, 0x44
mov edx, eax
lea r8d, [r9 + 8]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea ecx, [rdx + 0x44]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, 0x44
mov edx, eax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov byte [0x140103ffa], 0
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001710e
mov byte [0x14010400c], 1
jmp 0x140017161
cmp byte [0x14010400c], 0
je 0x140017161
xor edx, edx
lea ecx, [rdx + 0x41]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, 0x41
mov edx, eax
lea r8d, [r9 + 8]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea ecx, [rdx + 0x41]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, 0x41
mov edx, eax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov byte [0x14010400c], 0
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001717a
mov byte [0x140103ffb], 1
jmp 0x1400171cd
cmp byte [0x140103ffb], 0
je 0x1400171cd
xor edx, edx
lea ecx, [rdx + 0x53]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, 0x53
mov edx, eax
lea r8d, [r9 + 8]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea ecx, [rdx + 0x53]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, 0x53
mov edx, eax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov byte [0x140103ffb], 0
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400171e9
mov byte [0x140103ff9], 1
add rsp, 0x28
ret
cmp byte [0x140103ff9], 0
je 0x14001723c
xor edx, edx
lea ecx, [rdx + 0x57]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, 0x57
mov edx, eax
lea r8d, [r9 + 8]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea ecx, [rdx + 0x57]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, 0x57
mov edx, eax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov byte [0x140103ff9], 0
add rsp, 0x28
ret