joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800142b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 5], sil
je 0x1800142e4
mov ecx, esi
lea eax, [rcx - 0x42]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 4
jb 0x1800142d0
mov byte [r8 + 5], sil
lea rax, [r8 + 4]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp r9, rax
je 0x180014319
mov r8d, 4
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.180012510
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x180014327
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.180011690
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18001439c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014397
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180014397
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18007ca3c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800143b0
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
xor esi, esi
mov dword [rbp - 0x10], esi
mov rdx, qword [rcx]
mov rax, qword [rdx]
mov qword [rdx + 8], rax
mov rbx, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
lea rcx, [rbp - 0x60]
call fcn.180011e80
mov r8, rax
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.180003380
mov rdx, rax
mov rcx, qword [rdi]
call fcn.180015b70
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x180014444
mov rdx, qword [rbp - 0x20]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001443f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001443f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18007ca3c
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov qword [rcx + 8], rax
mov rbx, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
lea rcx, [rbp - 0x60]
call fcn.180011e80
mov r8, rax
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.180003380
mov rdx, rax
mov rcx, qword [rdi + 0x18]
call fcn.180015b70
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1800144b8
mov rdx, qword [rbp - 0x20]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800144b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800144b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18007ca3c
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x3ff
and ax, cx
cmp ax, 4
jne 0x1800144e4
mov rcx, qword [rdi + 0x28]
lea rdx, [0x180094068]
mov rcx, qword [rcx]
call fcn.1800196f0
jmp 0x1800145d5
mov dword [rbp - 0x60], 0x3cf03eb
mov dword [rbp - 0x5c], 0x3a003a4
mov dword [rbp - 0x58], 0x3a603b6
mov dword [rbp - 0x54], 0x3e503a0
mov dword [rbp - 0x50], 0x3b203b5
mov dword [rbp - 0x4c], 0x3aa03ab
mov dword [rbp - 0x48], 0x3b803af
mov dword [rbp - 0x44], 0x3ab03bf
mov dword [rbp - 0x40], 0x3a303bb
mov dword [rbp - 0x3c], 0x3a803bc
mov dword [rbp - 0x38], 0x3fc
mov byte [rbp - 0x34], 1
mov rcx, rsi
mov edx, 0x3be
nop dword [rax]
lea eax, [rdx + rcx]
xor word [rbp + rcx*2 - 0x60], ax
inc rcx
cmp rcx, 0x15
jb 0x180014540
mov byte [rbp - 0x34], sil
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 7
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x30]
call fcn.180011cf0
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov rcx, qword [rdi + 0x28]
mov rcx, qword [rcx]
call fcn.1800196f0
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1800145d5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800145d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800145d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18007ca3c
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
add rcx, 8
jmp 0x1800143b0
Function at 0x180014620
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rdi, rcx
xor esi, esi
mov dword [rbp + 0x47], esi
mov rdx, qword [rcx]
mov rax, qword [rdx]
mov qword [rdx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edx, 0x3ff
and ax, dx
mov edx, 0x3be
cmp ax, 4
jne 0x1800146e5
mov dword [rbp - 0x39], 0x965252cd
mov dword [rbp - 0x35], 0x515e61d0
mov dword [rbp - 0x31], 0x3ec
mov byte [rbp - 0x2d], 1
mov eax, esi
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x39], cx
inc rax
cmp rax, 5
jb 0x180014690
mov byte [rbp - 0x2d], sil
mov qword [rbp + 0x27], rsi
mov qword [rbp + 0x37], rsi
mov qword [rbp + 0x3f], 7
mov word [rbp + 0x27], si
mov r8d, 5
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 0x27]
call fcn.180011cf0
nop
mov ebx, reloc.WS2_32.dll_listen
lea rax, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rax, qword [rbp + 0x27]
jmp 0x18001478b
mov dword [rbp - 0x29], 0x3d303fd
mov dword [rbp - 0x25], 0x3b203af
mov dword [rbp - 0x21], 0x3a703a7
mov dword [rbp - 0x1d], 0x3b603e4
mov dword [rbp - 0x19], 0x3a403b3
mov dword [rbp - 0x15], 0x3ac03ab
mov dword [rbp - 0x11], 0x3b803b9
mov dword [rbp - 0xd], 0x3b803aa
mov dword [rbp - 9], 0x3a303a2
mov dword [rbp - 5], 0x3ff03a9
mov word [rbp - 1], si
mov byte [rbp + 1], 1
mov rcx, rsi
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [rbp + rcx*2 - 0x29], ax
inc rcx
cmp rcx, 0x14
jb 0x180014740
mov byte [rbp + 1], sil
mov qword [rbp + 7], rsi
mov qword [rbp + 0x17], rsi
mov qword [rbp + 0x1f], 7
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, [rbp - 0x29]
lea rcx, [rbp + 7]
call fcn.180011cf0
mov ebx, 0x32
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rax, qword [rbp + 7]
mov rcx, qword [rdi + 8]
mov rdx, rax
mov rcx, qword [rcx]
call fcn.1800196f0
test bl, 2
je 0x1800147f5
and ebx, 0xfffffffd
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x1800147e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800147e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800147e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18007ca3c
mov qword [rbp + 0x17], rsi
mov qword [rbp + 0x1f], 7
mov word [rbp + 7], si
test bl, 1
je 0x18001483d
mov rdx, qword [rbp + 0x3f]
cmp rdx, 8
jb 0x18001483d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014838
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180014838
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18007ca3c
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180014ca0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180014cc8
xor eax, eax
lea r8, [0x180013010]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180014e30
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov rdx, rcx
mov qword [rsp + 0x20], rbx
xor r8d, r8d
cmp byte [rcx + 7], r8b
je 0x180014e63
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x43]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 6
jb 0x180014e50
mov byte [rdx + 7], r8b
lea rcx, [rdx + 6]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
cmp rdx, rcx
je 0x180014e8c
mov r8d, 6
mov rcx, rbx
call fcn.180012510
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180014ea0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov rdx, rcx
mov qword [rsp + 0x20], rbx
xor r8d, r8d
cmp byte [rcx + 0xe], r8b
je 0x180014ed3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 0x43]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xd
jb 0x180014ec0
mov byte [rdx + 0xe], r8b
lea rcx, [rdx + 0xd]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
cmp rdx, rcx
je 0x180014efc
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.180012510
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180015200
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x180015237
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x180015258
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18001525a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1800152b3
test ecx, ecx
jle 0x180015293
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1800152b3
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1800152b3
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180015830
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1800a3690]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18001585d
xor eax, eax
jmp 0x1800159b2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x180015888
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x180015888
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1800159b2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1800159a5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1800158cb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1800158f6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800159aa
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180015965
sub eax, 1
je 0x180015965
cmp eax, 2
jne 0x1800159a5
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800159aa
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180015993
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1800159a5
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x1800159aa
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18007c9f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180015db0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1800a3690]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180015e83
cmp byte [rcx + 0x71], 0
je 0x180015e83
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180015e7f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180015e44
sub eax, 1
je 0x180015e48
cmp eax, 2
jne 0x180015e7f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18007c9f0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180015e76
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180015e7f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180015e2c
xor al, al
jmp 0x180015e2c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18007c9f0
add rsp, 0x60
pop rbx
ret

Function at 0x1800169a0
Capabilities:
Encode data using xor
Identify system language via api

Disassembly:
add rcx, 8
jmp fcn.180014620
Function at 0x180016a90
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1800a3690]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, qword [rcx + 0x10]
xor ebx, ebx
mov rbp, qword [rcx + 8]
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180016b47
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x180016af4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180016b47
mov qword [rsp + 0x2a8], r14
lea r14, str.League_of_Legends.exe
lea rdx, [rsp + 0x5c]
mov rax, rbx
nop dword [rax + rax]
movzx ecx, word [rdx + rax*2]
cmp cx, word [r14 + rax*2]
jne 0x180016b95
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r14 + rax*2 + 2]
jne 0x180016b95
add rax, 2
cmp rax, 0x16
jne 0x180016b10
mov ebx, dword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x2a8]
xor r8d, r8d
lea r9, [rsp + 0x20]
mov dl, 1
lea ecx, [r8 + 0x14]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
mov edx, ebx
mov rcx, rbp
call fcn.18001ed30
mov r8, rax
mov edx, ebx
mov rcx, rsi
call fcn.18001f6e0
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.18007c9f0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180016b03
jmp 0x180016b36

Function at 0x180019810
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 8]
mov rbx, qword [rcx]
cmp rbx, rdi
je 0x18001983e
mov ecx, dword [rbx]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x18001984b
add rbx, 4
cmp rbx, rdi
jne 0x180019826
mov al, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x180019860
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x3ff
and ax, cx
cmp ax, 4
sete al
add rsp, 0x28
ret
Function at 0x18001b200
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1800a3690]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x30]
lea rcx, str.ProgramData
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x18001b283
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18001b271
lea rdx, [rsp + 0x30]
jmp 0x18001b2a1
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
xor r8d, r8d
lea rdx, [0x180094c28]
mov rcx, rbx
call fcn.180011cf0
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18007c9f0
add rsp, 0x250
pop rbx
ret
Function at 0x18001b850
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1800a3690]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rbx, rdx
mov r14, rcx
mov dword [rsp + 0x58], 0x208
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18001b8af
mov rdx, qword [rbx]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18001b8dd
xor al, al
jmp 0x18001ba7b
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], ax
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18001b903
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.180011cf0
nop
lea rcx, [rsp + 0x38]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
cmp rsi, 8
cmovae rcx, rdi
mov r12d, 0xa
mov qword [rsp + 0x20], r12
lea r9, str.RUNASADMIN
mov rdx, qword [rsp + 0x48]
call fcn.18001d310
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x18001b961
mov bl, 1
jmp 0x18001ba3a
call fcn.18001a640
mov qword [rsp + 0x30], 1
lea rcx, [rsp + 0x30]
call fcn.18001d020
mov r8, qword [rsp + 0x48]
cmp r8, r15
jb 0x18001baa6
mov rax, r8
sub rax, r15
cmp rax, r12
cmovb r12, rax
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rax, qword [rsp + 0x38]
lea rcx, [rax + r15*2]
sub r8, r12
mov qword [rsp + 0x48], r8
lea rdx, [rcx + r12*2]
sub r8, r15
lea r8, [r8*2 + 2]
call sub.VCRUNTIME140.dll_memmove
cmp qword [rsp + 0x48], 0
jne 0x18001b9e7
cmp qword [rbx + 0x18], 8
jb 0x18001b9d7
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
jmp 0x18001ba2b
mov eax, dword [rsp + 0x48]
lea ecx, [rax*2 + 2]
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rax, qword [rsp + 0x38]
cmp qword [rbx + 0x18], 8
jb 0x18001ba0d
mov rbx, qword [rbx]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
sete bl
cmp rsi, 8
jb 0x18001ba78
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x18001ba70
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001ba70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.18007ca3c
movzx eax, bl
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.18007c9f0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1800119d0
nop
int3
Function at 0x18001c6e0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1800a3690]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, 0xffff
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x18001c711
xor eax, eax
jmp 0x18001c854
mov rdx, qword [rcx + 0x40]
mov rcx, qword [rdx]
test rcx, rcx
je 0x18001c741
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rdx, [rcx + r8*2]
cmp rcx, rdx
jae 0x18001c741
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_protected:_wchar_t____ptr64___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::_Pninc_void____ptr64]
mov word [rax], si
movzx eax, si
jmp 0x18001c854
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x18001c849
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18001c788
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18001c7b2
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, di
je 0x18001c849
movzx edi, si
jmp 0x18001c849
lea rax, [rsp + 0x40]
mov word [rsp + 0x50], si
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x52]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18001c808
sub eax, 1
je 0x18001c808
cmp eax, 2
jne 0x18001c849
movzx ecx, word [rsp + 0x50]
jmp 0x18001c794
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x18001c836
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x18001c849
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
movzx eax, si
jne 0x18001c84c
movzx eax, di
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18007c9f0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret