joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180042440
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x1800bddb0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [rcx]
movsxd r10, edx
mov qword [rsp + 0x38], r9
mov rdx, qword [rax + 0x20]
shl r10, 5
mov qword [rsp + 0x30], r8
mov rbp, qword [r10 + rdx]
mov r13, rcx
mov r12d, 1
nop word [rax + rax]
lea r8, str.sqlite_stat_d
lea rdx, [rsp + 0x40]
mov r9d, r12d
mov ecx, 0x18
call sym.sqlite3.dll_sqlite3_snprintf
mov r14, qword [r13]
xor ebx, ebx
mov r15d, dword [r14 + 0x28]
xor edi, edi
test r15d, r15d
jle 0x180042680
movzx esi, byte [rsp + 0x40]
mov r10d, edi
cmp edi, 2
jge 0x1800424cf
xor r10d, 1
test rbp, rbp
je 0x18004254c
mov rax, qword [r14 + 0x20]
movzx edx, byte [rbp]
movsxd rcx, r10d
shl rcx, 5
mov r8, rbp
mov r11, qword [rcx + rax]
lea rcx, [0x1800a0de0]
movzx eax, byte [r11]
movzx r9d, byte [rdx + rcx]
movzx eax, byte [rax + rcx]
sub r9d, eax
jne 0x180042645
sub r11, rbp
jmp 0x180042517
lea rcx, [0x1800a0de0]
test dl, dl
je 0x180042543
movzx eax, byte [r11 + r8 + 1]
movzx edx, byte [r8 + 1]
inc r8
movzx ecx, byte [rax + rcx]
lea rax, [0x1800a0de0]
movzx r9d, byte [rdx + rax]
sub r9d, ecx
je 0x180042510
jmp 0x180042645
test r9d, r9d
jne 0x180042645
mov rax, qword [r14 + 0x20]
movsxd rcx, r10d
shl rcx, 5
mov r9, qword [rcx + rax + 0x18]
mov r10, qword [r9 + 0x18]
test r10, r10
je 0x1800425bb
xor eax, eax
lea r8, [rsp + 0x40]
movzx ecx, sil
test sil, sil
je 0x1800425a3
lea r15, [0x1800a0de0]
nop dword [rax]
movzx ecx, cl
lea r8, [r8 + 1]
movzx edx, byte [rcx + r15]
lea ecx, [rax*8]
xor edx, ecx
movzx ecx, byte [r8]
xor eax, edx
test cl, cl
jne 0x180042580
mov r15d, dword [r14 + 0x28]
xor edx, edx
div dword [r9 + 8]
mov ecx, edx
shl rcx, 4
add rcx, r10
mov r10, qword [rcx + 8]
mov r11d, dword [rcx]
jmp 0x1800425c3
mov r10, qword [r9 + 0x10]
mov r11d, dword [r9 + 0xc]
test r11d, r11d
je 0x180042643
lea rdx, [0x1800a0de0]
movzx eax, sil
movzx ebx, byte [rax + rdx]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
dec r11d
movzx r8d, byte [rax]
movzx ecx, byte [r8 + rdx]
sub ecx, ebx
jne 0x18004263b
lea r9, [rsp + 0x40]
sub r9, rax
nop dword [rax]
test r8b, r8b
je 0x180042637
movzx ecx, byte [r9 + rax + 1]
movzx r8d, byte [rax + 1]
inc rax
movzx edx, byte [rcx + rdx]
lea rcx, [0x1800a0de0]
movzx ecx, byte [r8 + rcx]
sub ecx, edx
lea rdx, [0x1800a0de0]
je 0x180042600
lea rdx, [0x1800a0de0]
jmp 0x18004263b
test ecx, ecx
je 0x1800426ab
mov r10, qword [r10]
test r11d, r11d
jne 0x1800425e0
xor ebx, ebx
inc edi
cmp edi, r15d
jl 0x1800424c3
test rbx, rbx
je 0x180042680
mov rax, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
lea rdx, str.DELETE_FROM__Q._s_WHERE__s_Q
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x30]
mov r8, rbp
mov rcx, r13
mov qword [rsp + 0x20], rax
call fcn.180057be0
inc r12d
cmp r12d, 4
jle 0x180042490
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180092ad0
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rbx, qword [r10 + 0x10]
test rbx, rbx
jne 0x180042655
jmp 0x180042645
Function at 0x18004bf20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x20
mov r9d, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x18004c0cd
test rdx, rdx
je 0x18004c0cd
mov eax, dword [rcx + 4]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov esi, dword [rdx + 4]
mov ebp, esi
or ebp, eax
bt ebp, 0xa
jae 0x18004bf80
and esi, eax
bt esi, 0xa
jae 0x18004bfff
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x18004bfff
xor eax, eax
jmp 0x18004bfc3
movzx r8d, byte [rcx]
cmp r8b, byte [rdx]
je 0x18004bfd8
cmp r8b, 0x35
jne 0x18004bfa5
mov rcx, qword [rcx + 0x10]
mov r8d, r9d
call fcn.18004bf20
cmp eax, 2
jl 0x18004bfbe
mov r9d, dword [rsp + 0x40]
cmp byte [rbx], 0x35
jne 0x18004bfff
mov rdx, qword [rbx + 0x10]
mov r8d, r9d
mov rcx, rdi
call fcn.18004bf20
cmp eax, 2
jge 0x18004bfff
mov eax, 1
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
lea eax, [r8 + 0x68]
test al, 0xfd
je 0x18004c03a
mov rax, qword [rcx + 8]
test rax, rax
je 0x18004c03a
cmp r8b, 0x97
jne 0x18004c006
mov rdx, qword [rdx + 8]
mov rcx, rax
call fcn.180066a40
test eax, eax
je 0x18004c035
mov eax, 2
jmp 0x18004bfc3
mov r10, qword [rdx + 8]
sub r10, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r10]
sub edx, ecx
jne 0x18004c023
inc rax
test ecx, ecx
jne 0x18004c010
test edx, edx
je 0x18004c03a
xor ecx, ecx
cmp r8b, 0x35
setne cl
lea eax, [rcx + 1]
jmp 0x18004bfc3
mov r9d, dword [rsp + 0x40]
xor esi, dword [rdi + 4]
test sil, 0x10
jne 0x18004bfff
bt ebp, 0xe
jb 0x18004c0c6
bt ebp, 0xb
jb 0x18004bfff
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
mov r8d, r9d
call fcn.18004bf20
test eax, eax
jne 0x18004bfff
mov esi, dword [rsp + 0x40]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
mov r8d, esi
call fcn.18004bf20
test eax, eax
jne 0x18004bfff
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
mov r8d, esi
call fcn.18004ce80
test eax, eax
jne 0x18004bfff
bt ebp, 0xd
jb 0x18004c0c6
cmp byte [rdi], 0x61
je 0x18004c0c6
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x18004bfff
mov ecx, dword [rdi + 0x2c]
mov eax, dword [rbx + 0x2c]
cmp ecx, eax
je 0x18004c0c6
cmp ecx, esi
jne 0x18004bfff
test eax, eax
jns 0x18004bfff
xor eax, eax
jmp 0x18004bfc3
mov rbx, qword [rsp + 0x48]
xor ecx, ecx
mov eax, 2
cmp rdx, rdi
cmove eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x18004dd50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
xor ebx, ebx
xor r11d, r11d
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x18004de39
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], r15
lea r15, [0x1800a0de0]
mov eax, ebx
cmp ebx, 2
jge 0x18004dd8f
xor eax, 1
movsxd rcx, eax
mov rax, qword [rdi + 0x20]
shl rcx, 5
mov rbp, qword [rcx + rax + 0x18]
test rsi, rsi
je 0x18004ddef
mov r10, qword [rcx + rax]
movzx edx, byte [rsi]
mov r8, rsi
movzx eax, byte [r10]
movzx r9d, byte [rdx + r15]
movzx ecx, byte [rax + r15]
sub r9d, ecx
jne 0x18004de13
movzx eax, dl
sub r10, rsi
test al, al
je 0x18004ddea
movzx eax, byte [r8 + 1]
movzx ecx, byte [r10 + r8 + 1]
inc r8
movzx edx, byte [rcx + r15]
movzx r9d, byte [rax + r15]
sub r9d, edx
je 0x18004ddc7
jmp 0x18004de13
test r9d, r9d
jne 0x18004de13
lea rcx, [rbp + 0x20]
lea r8, [rsp + 0x40]
mov rdx, r14
call fcn.180023430
test rax, rax
je 0x18004de10
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x18004de1e
jmp 0x18004de13
xor r11d, r11d
inc ebx
cmp ebx, dword [rdi + 0x28]
jl 0x18004dd85
mov rbp, qword [rsp + 0x48]
mov r15, qword [rsp + 0x50]
mov rax, r11
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, r11
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x18004de50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
xor r11d, r11d
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x18004df3a
mov qword [rsp + 0x48], r14
lea r14, [0x1800a0de0]
nop
mov r9d, ebx
cmp ebx, 2
jge 0x18004de8c
xor r9d, 1
test rdi, rdi
je 0x18004dee6
mov rax, qword [rsi + 0x20]
movzx edx, byte [rdi]
movsxd rcx, r9d
shl rcx, 5
mov r8, rdi
mov r10, qword [rcx + rax]
movzx ecx, byte [rdx + r14]
movzx eax, byte [r10]
movzx eax, byte [rax + r14]
sub ecx, eax
jne 0x18004df1a
movzx eax, dl
sub r10, rdi
nop
test al, al
je 0x18004dee2
movzx ecx, byte [r10 + r8 + 1]
movzx eax, byte [r8 + 1]
inc r8
movzx edx, byte [rcx + r14]
movzx ecx, byte [rax + r14]
sub ecx, edx
je 0x18004dec0
jmp 0x18004df1a
test ecx, ecx
jne 0x18004df1a
mov rax, qword [rsi + 0x20]
movsxd rcx, r9d
lea r8, [rsp + 0x40]
shl rcx, 5
mov rdx, rbp
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.180023430
test rax, rax
je 0x18004df17
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x18004df25
jmp 0x18004df1a
xor r11d, r11d
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x18004de80
mov rax, r11
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov rax, r11
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x180076cc0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, qword [rcx + 0x18]
mov r14, qword [rcx + 0x28]
xor ebx, ebx
mov rdi, qword [rsi + 0x30]
mov r15, r9
mov ebp, r8d
mov r13, rdx
test rdi, rdi
jne 0x180076d63
movzx eax, word [r14 + 6]
imul ecx, eax, 0x38
add ecx, 0x50
test ecx, ecx
jle 0x180076d34
movsxd rax, ecx
mov rcx, qword [r14 + 0x10]
test rcx, rcx
je 0x180076d1f
mov rdx, rax
call fcn.180046280
jmp 0x180076d27
mov rcx, rax
call fcn.180057350
mov rdi, rax
test rax, rax
jne 0x180076d37
mov rdi, rbx
jmp 0x180076d4e
mov rdi, rbx
lea rax, [rdi + 0x18]
mov qword [rdi], r14
mov qword [rdi + 8], rax
movzx eax, word [r14 + 6]
inc ax
mov word [rdi + 0x10], ax
mov qword [rsi + 0x30], rdi
test rdi, rdi
jne 0x180076d5f
lea eax, [rdi + 7]
jmp 0x180076de7
mov word [rdi + 0x10], bp
cmp byte [rsi + 0x58], bl
je 0x180076d9b
cmp byte [rsi + 0x59], bl
je 0x180076d7a
mov rax, qword [rsi + 0x10]
mov edx, dword [rax + 0x14]
mov r8, qword [rax + 0x28]
jmp 0x180076da5
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rcx + rcx*4]
shl rax, 4
add rax, qword [rdx + 0x18]
mov edx, dword [rax + 0x14]
mov r8, qword [rax + 0x28]
jmp 0x180076da5
mov rax, qword [rsi + 0x38]
mov edx, dword [rax]
lea r8, [rax + 0x10]
mov r9, rdi
mov rcx, r14
call fcn.180076430
test ebp, ebp
jle 0x180076dcf
mov rax, qword [rdi + 8]
add rax, 8
nop dword [rax]
test byte [rax], 1
jne 0x180076e06
inc ebx
add rax, 0x38
cmp ebx, ebp
jl 0x180076dc0
mov rdx, qword [r13 + 0x10]
mov ecx, dword [r13 + 0xc]
xor r9d, r9d
mov r8, rdi
call fcn.180075db0
mov dword [r15], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
ret
mov dword [r15], 0xffffffff
jmp 0x180076de5
Function at 0x18007f530
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
movzx ecx, byte [rcx]
xor eax, eax
test cl, cl
je 0x18007f571
lea r10, [0x1800a0de0]
nop dword [rax]
nop word [rax + rax]
movzx edx, cl
lea ecx, [rax*8]
lea r9, [r9 + 1]
movzx r8d, byte [rdx + r10]
xor r8d, ecx
movzx ecx, byte [r9]
xor eax, r8d
test cl, cl
jne 0x18007f550
ret
Function at 0x180082600
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x20], 0
mov rbx, rcx
je 0x18008265d
mov rcx, qword [rcx]
call fcn.1800847a0
mov ecx, eax
test eax, eax
jne 0x18008267b
movups xmm1, xmmword [rbx + 0x28]
movups xmm0, xmmword [rbx + 0x38]
movups xmmword [rbx + 0x28], xmm0
movups xmmword [rbx + 0x38], xmm1
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x30], rax
jne 0x180082646
mov eax, ecx
mov dword [rbx + 0x1c], 1
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx]
lea rdx, [0x1800825e0]
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.180066d40
call fcn.1800822c0
movups xmm0, xmmword [rbx + 0x38]
movups xmmword [rbx + 0x28], xmm0
mov rcx, qword [rbx + 0x10]
cmp qword [rbx + 0x30], rcx
jne 0x18008267b
mov dword [rbx + 0x1c], 1
add rsp, 0x20
pop rbx
ret
Function at 0x140011267
Capabilities:
Terminate process

Disassembly:
jmp 0x140013ec0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011302
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015210
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015230
xor al, al
jmp 0x1400152b1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015243
xor al, al
jmp 0x1400152b1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001526d
xor al, al
jmp 0x1400152b1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015281
xor al, al
jmp 0x1400152b1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015293
xor al, al
jmp 0x1400152b1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400152af
xor al, al
jmp 0x1400152b1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400092cc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
test r8, r8
je 0x1400092f3
and qword [r8], 0
call fcn.1400093d8
mov rbx, rax
test rax, rax
je 0x1400093bb
mov rcx, rax
call fcn.140009254
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400093b2
mov rax, qword [0x14004ddf0]
test rax, rax
je 0x14000932b
inc dword [rax + 0xf4]
mov rdx, qword [0x14004de00]
lea rcx, [rdi + rbp]
call qword [section..data]
mov rsi, rax
test rax, rax
je 0x1400093b2
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rdi
je 0x14000938a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14004ddf0]
test rax, rax
je 0x140009378
dec dword [rax + 0xf4]
mov rdx, qword [0x14004de00]
mov rcx, rsi
call qword [0x14004d008]
jmp 0x1400093bb
test ebp, ebp
jle 0x14000939c
lea rcx, [rsi + rdi]
mov r8, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x1400093ad
mov qword [r14], rdi
mov rax, rsi
jmp 0x1400093bd
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400096fc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
not r8d
test rdx, rdx
je 0x14000972a
movzx eax, byte [r9]
inc r9
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x140040a40]
xor r8d, dword [rax + rcx*4]
sub rdx, 1
jne 0x140009707
not r8d
mov eax, r8d
ret

Function at 0x140009734
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x14000978e
mov r11b, 0x23
lea rdi, [0x140040a40]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x140009778
cmp rdx, 2
jb 0x140009778
cmp byte [r10], r11b
jne 0x140009778
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x140009756
jmp 0x1400097cf
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x1400097cf
mov r11b, 0x23
lea rdi, [0x140040a40]
cmp dl, r11b
jne 0x1400097b3
cmp byte [r10], r11b
jne 0x1400097b3
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x1400097a1
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x14000ab7c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x53e0], 0
lea rbx, [rcx + 0x53e8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14000ac15
mov r9d, dword [rbx + 4]
test r9d, r9d
jns 0x14000abcd
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140015d60
and dword [rbx], 0
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.140015464
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x53e0]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x14004ddf8]
movsxd r8, eax
mov rax, qword [rdi + 0x53f0]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14000ac1d
mov rcx, rbx
call fcn.140015464
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14001115c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x14004ddf0]
mov rbx, rcx
and dword [rax + 0x537c], 0
test rcx, rcx
je 0x1400111c5
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.1400111d0
lea rdx, [0x140041e78]
mov rcx, rbx
mov rdi, rax
call fcn.1400093d8
mov rbx, rax
test rax, rax
je 0x1400111c5
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140024aa4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14004da40]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.140008a84
mov rcx, qword [0x14004de78]
lea rdx, [rbp - 0x18]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp - 0x10]
sub ecx, dword [rbp - 0x18]
movd xmm1, ecx
mov ecx, dword [rbp - 0xc]
sub ecx, dword [rbp - 0x14]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rbp - 0x20]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x20]
xorps xmm1, xmm1
sub rax, qword [0x14004de80]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x14004de88]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rbp - 0x20]
mov qword [0x14004de80], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov ecx, 0x10
mov byte [rdi + 0xe0c], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, bl
mov byte [rdi + 0xe0d], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
mov byte [rdi + 0xe0f], 0
mov byte [rdi + 0xe0e], al
call fcn.140008a84
cmp byte [rax + 0xd3], 0
lea rbx, [rax + 0xdf4]
je 0x140024bcd
cvttss2si ecx, dword [rbx]
lea rdx, [rbp - 0x30]
cvttss2si eax, dword [rax + 0xdf8]
mov dword [rbp - 0x30], ecx
mov rcx, qword [0x14004de78]
mov dword [rbp - 0x2c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x2c]
mov ecx, dword [rbp - 0x30]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, 0xff7fffff
mov dword [rbx], eax
mov dword [rbx + 4], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x14004de78]
jne 0x140024c22
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140024c22
mov rcx, qword [0x14004de78]
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x140024c22
movd xmm0, dword [rbp - 0x28]
movd xmm1, dword [rbp - 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0x70], 0
je 0x140024c2d
or eax, 0xffffffff
jmp 0x140024c32
call fcn.140008c08
cmp dword [0x14004d018], eax
je 0x140024c45
mov dword [0x14004d018], eax
call fcn.140024c70
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003e0b0
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x14002f900
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov dword [rsp + 0x34], 0xc0000001
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0x240
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwOpenKey]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x14002fa50
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call fcn.140036d24
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14002f9a4
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
xor eax, eax
jmp 0x14002fa52
mov eax, dword [rsp + 0x30]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x30]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x40]
mov r8d, 1
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwQueryValueKey]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x14002fa0d
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x30], eax
je 0x14002fa27
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
jmp 0x14002fa52
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + rax]
jmp 0x14002fa52
xor eax, eax
add rsp, 0x88
ret