joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180017ed0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, rdx
mov edi, r8d
lea rdx, [0x1800435d0]
mov rbx, rcx
call fcn.180017b4c
mov rdx, qword [rbx + 0x208]
mov rcx, rbx
call fcn.180017b4c
lea rdx, [0x180042528]
mov rcx, rbx
call fcn.180017b4c
mov rdx, rbx
mov rcx, rbx
call fcn.180017b4c
lea rdx, [0x1800435d8]
mov rcx, rbx
call fcn.180017b4c
mov rdx, rsi
mov rcx, rbx
call fcn.180017cb8
lea rdx, [0x180041994]
mov rcx, rbx
call fcn.180017b4c
lea r12d, [rdi + 1]
cmp r12d, 0x104
jae 0x18001806e
mov eax, 0x5c
mov qword [rsp + 0x98], rdi
mov word [rbx + rdi*2], ax
lea r13, [rbx + 0xd3c]
xor eax, eax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rax
lea r15, [rbx + 0xa30]
mov qword [rsp + 0x28], rax
mov ebp, edi
lea rdi, [rbx + 0xc38]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov dword [rdi], 0x104
mov r8, r15
xor edx, edx
mov rcx, rsi
mov r14d, eax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x180018068
mov ebp, r12d
test eax, eax
jne 0x180018024
mov edx, 0x104
lea rcx, [rbx + r12*2]
sub rdx, rbp
mov r8, r15
call fcn.180029998
lea rax, [rsp + 0x80]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180018024
mov r8d, dword [rdi]
mov rcx, rbx
mov rdx, qword [rsp + 0x80]
add r8d, r12d
call fcn.180017ed0
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rax
inc r14d
mov qword [rsp + 0x28], rax
mov r9, rdi
mov r8, r15
mov qword [rsp + 0x20], rax
mov edx, r14d
mov dword [rdi], 0x104
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x180017fc2
mov rbp, qword [rsp + 0x98]
xor eax, eax
mov word [rbx + rbp*2], ax
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180019b1c
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x18004a010]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor ebp, ebp
mov rsi, rcx
cmp word [0x1801769b0], bp
jne 0x180019b5a
xor eax, eax
jmp 0x180019d09
mov eax, dword [0x180178e18]
mov ecx, dword [0x180176dc8]
test eax, eax
je 0x180019b9f
test cl, 2
je 0x180019b9f
mov rcx, qword [0x1801769a0]
lea r9, [0x180006924]
mov r8, rsi
mov qword [rsp + 0x20], rbp
mov edx, WSAGetLastError
call qword [sym.imp.USER32.dll_DialogBoxParamW]
cmp rax, 1
mov edi, ebp
sete dil
jmp 0x180019c49
test cl, 4
je 0x180019bb3
mov rcx, rsi
call fcn.180019a90
mov edi, eax
jmp 0x180019c49
mov rbx, rbp
test eax, eax
je 0x180019bce
mov rcx, qword [0x180176788]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SetCursor]
mov rbx, rax
cmp word [0x180176fe0], bp
lea r9, [0x1801769b0]
mov edx, 0x104
lea rcx, [rsp + 0x70]
je 0x180019c02
lea rax, [0x180176fe0]
lea r8, str.mailto:_s_subject__22_s__22__20Error__20Report
mov qword [rsp + 0x20], rax
call fcn.180003f3c
jmp 0x180019c0e
lea r8, str.mailto:_s_subjectError__20Report
call fcn.180003f3c
mov dword [rsp + 0x28], 0xa
lea r8, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x20], rbp
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
test rax, rax
mov edi, ebp
sete dil
test rbx, rbx
je 0x180019c49
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetCursor]
cmp dword [0x180178e18], ebp
je 0x180019d07
mov rcx, qword [0x1801769a0]
lea r8, [rsp + 0x30]
mov r9d, 0x20
lea edx, [r9 + 0x50]
call qword [sym.imp.USER32.dll_LoadStringW]
test edi, edi
je 0x180019cc0
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [0x1801769a0]
lea r8, [rsp + 0x70]
mov r9d, 0x80
lea edx, [r9 + 1]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, 0x40
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_EndDialog]
jmp 0x180019d07
test byte [0x180176dc8], 2
jne 0x180019d07
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [0x1801769a0]
lea r8, [rsp + 0x70]
mov r9d, 0x80
lea edx, [r9 + 2]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, setsockopt
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, edi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.180021cb0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18001b2a4
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x18004a010]
xor rax, rsp
mov qword [rsp + 0x250], rax
and qword [rsp + 0x20], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and dword [0x1801763e0], 0
cmp dword [0x180178e18], 0
je 0x18001b2eb
lea rcx, [rsp + 0x20]
call fcn.18000774c
call fcn.180013f5c
mov rcx, qword [0x180176bb8]
lea r8, [rsp + 0x40]
mov rdx, rax
call fcn.180013a5c
lea rbx, [0x180176790]
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, [rsp + 0x40]
mov rdx, rbx
lea rcx, [0x180176580]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test byte [0x180176dc8], 1
je 0x18001b359
mov rcx, rbx
call fcn.18001bda0
mov r8, qword [0x180176998]
mov rdx, rbx
mov rcx, qword [0x180176bb8]
call fcn.180013938
xor ebx, ebx
jmp 0x18001b375
mov r8, qword [0x180176998]
lea rdx, [0x180176580]
mov rcx, qword [0x180176bb8]
call fcn.180013b60
mov ebx, eax
cmp qword [rsp + 0x20], 0
je 0x18001b3b5
mov rcx, qword [rsp + 0x28]
xor r9d, r9d
xor r8d, r8d
mov dword [0x1801763e0], 1
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x20]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [0x1801763e0], 0
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180021cb0
add rsp, 0x260
pop rbx
ret

Function at 0x18001b3d8
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
test byte [0x180176dc8], 1
je 0x18001b3fc
lea rcx, [0x180176790]
call fcn.18001bb5c
mov word [0x180176790], bx
lea rcx, [0x180176580]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov word [0x180176580], bx
add rsp, 0x20
pop rbx
ret

Function at 0x18001b520
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [0x180176bb8], 0
je 0x18001b61b
cmp qword [0x180176998], 0
je 0x18001b61b
cmp dword [0x180174138], 1
jne 0x18001b5d9
mov dword [0x180178e18], 1
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
test rax, rax
jne 0x18001b575
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x18001b5ae
and dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x40], eax
jne 0x18001b5ac
mov rcx, rbx
jmp 0x18001b59f
mov rbx, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
jne 0x18001b599
jmp 0x18001b5ae
xor ebx, ebx
mov ecx, 0xa0
call fcn.180021c64
test rax, rax
je 0x18001b5c8
mov rdx, rbx
mov rcx, rax
call fcn.18001c41c
mov rcx, rbx
mov qword [0x180176788], rax
call fcn.18001b4d0
jmp 0x18001b5e0
and dword [0x180178e18], 0
and qword [rsp + 0x28], 0
lea r8, [0x18001b418]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call fcn.180029cdc
mov rbx, rax
test rax, rax
je 0x18001b61b
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x30
pop rbx
ret
Function at 0x18001b624
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x18004a010]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r12, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov ebx, 0x104
mov r8d, ebx
lea rdx, [rsp + 0x50]
mov rcx, qword [0x1801769a0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.DBGHELP.DLL
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
jne 0x18001b6b7
lea rcx, str.DBGHELP.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rsi, rsi
je 0x18001b7ab
lea rdx, str.MiniDumpWriteDump
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x18001b7a2
lea rdx, [rsp + 0x260]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, str.BugTrap_1.3.3718.38316.dmp
lea rcx, [rsp + 0x260]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x18001b7a2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x44], r12
mov r9d, 1
mov dword [rsp + 0x4c], r9d
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r8, r15
mov edx, ebx
mov rcx, rdi
call r14
mov ebx, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x18001b7a2
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x18001b7ad
xor eax, eax
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.180021cb0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x18001bb5c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov rax, qword [0x18004a010]
xor rax, rsp
mov qword [rbp + 0x590], rax
mov rbx, rcx
lea r8, [0x1800415ac]
mov rdx, rcx
lea rcx, [rbp + 0x380]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18001bc6b
test byte [rsp + 0x20], 0x10
je 0x18001bc26
movzx edx, word [rsp + 0x4c]
cmp dx, word [0x1800440c0]
movzx ecx, word [rsp + 0x4e]
jne 0x18001bbe3
cmp cx, word [0x1800440c2]
je 0x18001bc4c
cmp dx, word [0x1800440c4]
jne 0x18001bc03
cmp cx, word [0x1800440c6]
jne 0x18001bc03
movzx eax, word [rsp + 0x50]
cmp ax, word [0x1800440c8]
je 0x18001bc4c
lea r8, [rsp + 0x4c]
mov rdx, rbx
lea rcx, [rbp + 0x170]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x170]
call fcn.18001bb5c
jmp 0x18001bc48
lea r8, [rsp + 0x4c]
mov rdx, rbx
lea rcx, [rbp + 0x170]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x18001bc62
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18001bbc0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.180021cb0
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x18001bc98
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x18004a010]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov r8, rcx
mov ebp, 0x104
mov edx, ebp
lea rcx, [rsp + 0x20]
call fcn.180029998
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathSkipRootW]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x18001bd72
lea rax, [rsp + 0x20]
mov r9, rdi
sub r9, rax
lea r8, [rsp + 0x20]
sar r9, 1
lea rcx, [rsp + 0x230]
mov edx, ebp
call fcn.180029e1c
cmp word [rdi], bx
je 0x18001bd6d
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFindNextComponentW]
mov r8, rdi
lea rcx, [rsp + 0x230]
mov r9, rax
mov rdx, rbp
sub r9, rdi
mov rsi, rax
sar r9, 1
call fcn.18002a254
xor edx, edx
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18001bd65
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x18001bd72
cmp word [rsi], bx
mov rdi, rsi
jmp 0x18001bd1a
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180021cb0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18001bda0
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x18004a010]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov dword [rsp + 0x20], eax
jmp 0x18001bdfe
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x18001be4c
inc ebx
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x30]
mov edx, 0x104
lea r8, str._sTEMP_lu
mov rcx, rdi
call fcn.180003f3c
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x18001bdeb
mov eax, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180021cb0
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
xor eax, eax
jmp 0x18001be2b

Function at 0x18001bffc
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0x660
mov rax, qword [0x18004a010]
xor rax, rsp
mov qword [rsp + 0x650], rax
xor r15d, r15d
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x18001c05b
cmp word [rdx], r15w
je 0x18001c05b
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
je 0x18001c05b
mov r8, rbx
mov edx, 0x104
mov rcx, rsi
call fcn.180029998
mov eax, 1
jmp 0x18001c131
mov r9d, 1
lea rdx, [rsp + 0x440]
xor ecx, ecx
lea r8d, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x18001c12f
mov r8d, 1
lea rcx, [rsp + 0x20]
call fcn.18001be50
test rax, rax
je 0x18001c12f
mov r8d, 0x104
lea rdx, [rsp + 0x230]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x18001c12f
lea rcx, [rsp + 0x230]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rcx, rax
mov r14, rax
call qword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
cmp word [rsp + 0x20], r15w
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x440]
mov rcx, rsi
cmove r8, r14
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rbx, rbx
je 0x18001c106
cmp word [rbx], r15w
je 0x18001c106
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x18001c051
test rbp, rbp
je 0x18001c12f
cmp word [rbp], 0x2e
jne 0x18001c12f
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
jmp 0x18001c051
xor eax, eax
mov rcx, qword [rsp + 0x650]
xor rcx, rsp
call fcn.180021cb0
add rsp, 0x660
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800206c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r10, qword [rdx]
xor r11d, r11d
test r10, r10
lea rdx, [0x180041418]
movzx eax, r11w
cmovne rdx, r10
jmp 0x1800206e5
add ax, ax
lea rdx, [rdx + 2]
xor ax, r9w
movzx r9d, word [rdx]
test r9w, r9w
jne 0x1800206da
movzx eax, ax
xor edx, edx
div qword [rcx + 0x10]
mov rax, qword [rcx]
mov qword [r8], rdx
mov rax, qword [rax + rdx*8]
jmp 0x18002072b
mov rcx, qword [rax]
mov r8, r10
sub r8, rcx
movzx edx, word [rcx]
movzx r9d, word [rcx + r8]
sub edx, r9d
jne 0x180020723
add rcx, 2
test r9d, r9d
jne 0x18002070d
test edx, edx
je 0x180020730
mov rax, qword [rax + 0x30]
test rax, rax
jne 0x180020704
ret

Function at 0x180020734
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r10, qword [rdx]
xor r11d, r11d
mov rcx, r10
movzx eax, r11w
movzx edx, word [r10]
jmp 0x180020754
add ax, ax
lea rcx, [rcx + 2]
xor ax, dx
movzx edx, word [rcx]
test dx, dx
jne 0x180020747
movzx eax, ax
xor edx, edx
div qword [reloc.WS2_32.dll_inet_addr]
mov rax, qword [0x180174ea8]
mov qword [r8], rdx
mov rax, qword [rax + rdx*8]
jmp 0x18002079c
mov rcx, qword [rax]
mov r8, r10
sub r8, rcx
movzx edx, word [rcx]
movzx r9d, word [rcx + r8]
sub edx, r9d
jne 0x180020794
add rcx, 2
test r9d, r9d
jne 0x18002077e
test edx, edx
je 0x1800207a1
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x180020775
ret

Function at 0x180020ea0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx - 0x40]
cmp rcx, 0xffffffffffffffff
jne 0x180020ec4
mov dword [rbx - 0x38], 0x649
or rax, 0xffffffffffffffff
jmp 0x180020ef2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rbx - 0x260]
mov edi, eax
movsxd rdx, dword [rcx + 4]
lea rcx, [rbx - 0x260]
add rcx, rdx
mov rdx, qword [rcx]
call qword [rdx + 0x28]
mov dword [rbx - 0x38], eax
test eax, eax
jne 0x180020ebe
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800214f8
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x258], 2
mov rbx, rcx
jne 0x180021579
cmp qword [rcx + 0x248], 0
jbe 0x180021562
mov r8d, dword [rcx + 0x248]
lea r9, [rsp + 0x40]
mov rdx, qword [rcx + 0x238]
mov rcx, qword [rcx + 0x228]
and dword [rsp + 0x40], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rbx + 8]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, rbx
mov rax, qword [rcx]
call qword [rax + 0x28]
mov dword [rbx + 0x230], eax
test eax, eax
je 0x180021562
xor al, al
jmp 0x18002157b
and dword [rbx + 0x258], 0
and qword [rbx + 0x250], 0
and qword [rbx + 0x248], 0
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140017d20
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1400e2230]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x140017dae
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x140017d52
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x140017dc0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1400e2230]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x140017ec4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x140017ebf
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x140017e94
cmp qword [rsp + 0x38], 2
jb 0x140017e94
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140017e94
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140017e94
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140017e07
jmp 0x140017f56
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x140017f56
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x140017f2c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140017f2c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140017f2c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140017ec4
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x140052820
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub rsp, 0x48
call fcn.140050f30
mov qword [rsp + 0x28], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
add rax, 0x2c
mov r9d, 4
mov r8, rax
mov edx, 0x20001004
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140052882
mov rax, qword [rsp + 0x28]
mov dword [rax + 0x2c], 0
add rsp, 0x48
ret

Function at 0x140053680
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400536a6
mov dword [rsp + 0x20], 1
jmp 0x1400536ae
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140094da0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.1400a6380
nop
lea rax, [0x140091d60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.14008fd30
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x140094e25
lea rcx, [rsp + 0x30]
call fcn.1400d3d50
jmp 0x140094e3c
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x30]
call fcn.1400b0960
add rsp, 0x58
ret