joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
xor esi, esi
xor edx, edx
mov r10d, 0xffffffff
mov ebp, r9d
mov dword [rsp + 0x68], r10d
mov r14, r8
mov dword [rsp + 0x6c], edx
movzx eax, word [rdi]
mov r15, rcx
test ax, ax
je 0x14007c33c
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], r12
lea r12, [0x140000000]
nop dword [rax + rax]
movzx ebx, ax
test ebx, 0xffffff80
je 0x14007c27f
xor eax, eax
jmp 0x14007c294
mov edx, 2
mov ecx, ebx
call fcn.1400fc354
mov edx, dword [rsp + 0x6c]
mov r10d, dword [rsp + 0x68]
mov ecx, ebx
and ecx, 0xffffffdf
test eax, eax
cmove ecx, ebx
add ecx, 0xffffffd5
cmp ecx, 0x33
ja case.0x14007c2bd.51
movsxd rax, ecx
movzx eax, byte [r12 + rax + 0x7c39c]
mov ecx, dword [r12 + rax*4 + 0x7c378]
add rcx, r12
jmp rcx
movzx esi, word [rdi]
jmp case.0x14007c2bd.51
mov ecx, 1
jmp 0x14007c2f3
mov ecx, SafeArrayAllocDescriptor
jmp 0x14007c2f3
mov ecx, 4
jmp 0x14007c2f3
mov ecx, 2
jmp 0x14007c2f3
mov ecx, 0x80
jmp 0x14007c2f3
mov ecx, 0x1000
jmp 0x14007c2f3
mov ecx, 0x100
cmp esi, 0x2b
je 0x14007c30f
cmp esi, 0x2d
je 0x14007c306
cmp esi, 0x5e
jne case.0x14007c2bd.51
xor edx, ecx
jmp 0x14007c31d
not ecx
and r10d, ecx
and edx, ecx
jmp 0x14007c318
mov eax, ecx
not eax
and r10d, eax
or edx, ecx
mov dword [rsp + 0x68], r10d
mov dword [rsp + 0x6c], edx
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x14007c270
mov r12, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
movzx r9d, byte [rsp + 0x80]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov r8d, ebp
lea rax, [0x14007c3d0]
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.14007c410
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007cd20
Capabilities:
Get file size

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x290
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r14, r8
mov rdi, rdx
mov rbp, rcx
xor edx, edx
mov rcx, qword [0x140162ac0]
lea r8, [r9 - 1]
call fcn.1400d5e90
test rdi, rdi
je 0x14007cedc
cmp word [rdi], 0
je 0x14007cedc
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x2b0], rbx
mov edx, 0x80
mov dword [rsp + 0x28], 0
mov rcx, rdi
mov qword [rsp + 0x2c0], rsi
lea r8d, [r9 + 7]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14007cdd3
lea rdx, [rsp + 0x2b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x14007cdd3
mov rcx, qword [rsp + 0x2b8]
jmp 0x14007ce3d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x14007ce1d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14015bc10]
mov dl, 1
mov dword [rcx + 0x40], eax
mov rcx, rbp
call fcn.1400629e0
mov rbx, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2c0]
add rsp, 0x290
pop r14
pop rdi
pop rbp
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [rsp + 0x5c]
mov eax, dword [rsp + 0x60]
shl rcx, 0x20
or rcx, rax
mov qword [rsp + 0x2b8], rcx
movzx ebx, word [r14]
test ebx, 0xffffff80
je 0x14007ce4d
xor eax, eax
jmp 0x14007ce61
mov edx, 2
mov ecx, ebx
call fcn.1400fc354
mov rcx, qword [rsp + 0x2b8]
mov edx, ebx
and edx, 0xffffffdf
test eax, eax
cmove edx, ebx
cmp edx, 0x4b
je 0x14007ce89
cmp edx, 0x4d
jne 0x14007cea3
mov rax, rcx
cqo
and edx, 0xfffff
add rax, rdx
sar rax, 0x14
jmp 0x14007ce9b
mov rax, rcx
cqo
and edx, 0x3ff
add rax, rdx
sar rax, 0xa
mov qword [rsp + 0x2b8], rax
mov rax, qword [0x14015bc10]
xor edx, edx
mov rcx, rbp
mov dword [rax + 0x40], 0
call fcn.1400629e0
mov rdx, qword [rsp + 0x2b8]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, qword [0x140162ac0]
call fcn.140001570
mov eax, 1
jmp 0x14007ce01
mov rax, qword [0x14015bc10]
mov dl, 1
mov rcx, rbp
mov dword [rax + 0x40], 0x57
call fcn.1400629e0
add rsp, 0x290
pop r14
pop rdi
pop rbp
ret
Function at 0x14007f030
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x240
movzx ebp, word [rdx + 4]
xor r14d, r14d
mov rsi, rdx
mov rdi, rcx
mov ebx, 2
test ebp, 0xffffff80
je 0x14007f064
mov eax, r14d
jmp 0x14007f06d
mov edx, ebx
mov ecx, ebp
call fcn.1400fc354
mov ecx, ebp
and ecx, 0xffffffdf
test eax, eax
cmove ecx, ebp
sub ecx, 0x41
je 0x14007f139
sub ecx, 3
je 0x14007f12f
sub ecx, 0xb
je 0x14007f0eb
sub ecx, 1
je 0x14007f0eb
cmp ecx, 3
jne 0x14007f0e2
movzx ebp, word [rsi + 0xe]
test ebp, 0xffffff80
je 0x14007f0a9
mov eax, r14d
jmp 0x14007f0b2
mov edx, ebx
mov ecx, ebp
call fcn.1400fc354
movzx ecx, bp
mov edx, 0xffdf
and cx, dx
test eax, eax
cmove cx, bp
cmp cx, 0x4d
jne 0x14007f0d8
cmp word [rsi + 0x16], r14w
mov ebx, reloc.WSOCK32.dll_inet_ntoa
lea eax, [rbx + 0xb]
jmp 0x14007f148
mov ebx, 7
lea eax, [rbx + 0x11]
jmp 0x14007f143
mov ebx, dword [rsp + 0x260]
jmp 0x14007f14b
movzx ebp, word [rsi + 0x12]
test ebp, 0xffffff80
je 0x14007f0fc
mov eax, r14d
jmp 0x14007f105
mov edx, ebx
mov ecx, ebp
call fcn.1400fc354
movzx ecx, bp
mov edx, 0xffdf
and cx, dx
test eax, eax
cmove cx, bp
cmp cx, 0x53
jne 0x14007f128
cmp word [rsi + 0x14], r14w
mov eax, reloc.WSOCK32.dll_socket
jmp 0x14007f148
mov ebx, 0x26
jmp 0x14007f14b
mov ebx, reloc.WSOCK32.dll_recv
lea eax, [rbx + 9]
jmp 0x14007f143
mov ebx, DispGetParam
mov eax, reloc.OLEAUT32.dll_SafeArrayAllocDescriptor
cmp word [rsi + 0x12], r14w
cmovne ebx, eax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14007f16f
mov word [rsp + 0x30], r14w
test rdi, rdi
je 0x14007f1a0
lea rax, [rsp + 0x30]
sub rdi, rax
lea rcx, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdi + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14007f190
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x14007f1b0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140094d20
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cl
test cl, cl
jne 0x140094d35
xor al, al
add rsp, 0x20
pop rbx
ret
sub edx, 1
je 0x140094d60
mov ecx, ebx
cmp edx, 1
je 0x140094d52
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 1
add rsp, 0x20
pop rbx
ret
lea eax, [rbx - 1]
cmp al, 5
ja 0x140094d6c
cmp bl, 3
jne 0x140094d73
lea eax, [rbx + 0x66]
cmp al, 5
ja 0x140094d90
cmp qword [0x140160788], 0
jne 0x140094db2
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x20
pop rbx
ret
cmp qword [0x140160790], 0
je 0x140094d7d
xor edx, edx
xor r8d, r8d
movzx ecx, bl
call fcn.140023810
test al, al
je 0x140094db2
mov cl, 1
call fcn.1400235b0
lea rcx, [0x1401615d0]
movzx eax, byte [rbx + rcx]
shr al, 7
add rsp, 0x20
pop rbx
ret
Function at 0x140095220
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x230
mov rdi, rdx
mov esi, ecx
mov r8d, ecx
xor r15d, r15d
mov word [rdx], r15w
mov ecx, 0x410
xor edx, edx
movzx ebx, r9b
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x14009527a
mov r8d, esi
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x1400953cc
xor edx, edx
mov qword [rsp + 0x250], rbp
mov r9d, 0x104
mov r8, rdi
mov rcx, r14
test bl, bl
je 0x14009529c
call qword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
jmp 0x1400952a2
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov ebp, eax
test eax, eax
jne 0x1400953b9
mov rax, qword [0x140142bc8]
test rax, rax
je 0x1400953b9
mov r8d, 0x104
mov rdx, rdi
mov rcx, r14
call rax
mov ebp, eax
test eax, eax
je 0x1400953b9
test bl, bl
je 0x140095313
mov edx, 0x5c
mov rcx, rdi
call fcn.1400f0974
test rax, rax
je 0x1400953b9
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x1400952f5
add r8, r8
lea rdx, [rax + 2]
mov rcx, rdi
call fcn.1400f1320
jmp 0x1400953b9
mov eax, 0x41
mov dword [rsp + 0x25a], 0x3a
mov word [rsp + 0x258], ax
nop dword [rax + rax]
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ebx, eax
cmp eax, 2
jbe 0x140095372
add ebx, 0xfffffffe
lea rcx, [rsp + 0x20]
mov r8d, ebx
mov rdx, rdi
call fcn.140102b68
test eax, eax
jne 0x140095372
cmp word [rdi + rbx*2], 0x5c
lea rdx, [rdi + rbx*2]
je 0x14009538d
movzx eax, word [rsp + 0x258]
inc ax
mov word [rsp + 0x258], ax
cmp ax, 0x5a
jbe 0x140095330
jmp 0x1400953b9
movzx eax, word [rsp + 0x258]
lea rcx, [rdi + 4]
mov word [rdi], ax
sub ebp, ebx
movzx eax, word [rsp + 0x25a]
mov word [rdi + 2], ax
lea r8d, [rbp + 1]
add r8, r8
call fcn.1400f1320
add ebp, 2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov rbp, qword [rsp + 0x250]
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140098a00
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x270
mov rax, rdx
mov rbx, rcx
test rdx, rdx
je 0x140098ad7
cmp word [rdx], 0
je 0x140098ad7
lea r9, [rsp + 0x288]
mov edx, 0x104
lea r8, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x60]
mov rax, rcx
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140098a50
xor edx, edx
test rax, rax
je 0x140098a6e
cmp word [rsp + rax*2 + 0x5e], 0x5c
jne 0x140098a6e
mov word [rsp + rax*2 + 0x5e], dx
lea rax, [rsp + 0x60]
cmp word [rax + rcx*2 + 2], dx
lea rcx, [rcx + 1]
jne 0x140098a73
lea rax, [rsp + 0x60]
mov word [rsp + rcx*2 + 0x62], dx
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov eax, 0x4054
mov dword [rsp + 0x44], edx
xorps xmm0, xmm0
mov word [rsp + 0x40], ax
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x28], 3
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
mov rcx, rbx
setne dl
call fcn.1400629e0
add rsp, 0x270
pop rbx
ret
mov dl, 1
call fcn.1400629e0
add rsp, 0x270
pop rbx
ret

Function at 0x140098af0
Capabilities:
Get file version info

Disassembly:
push rbx
push rdi
sub rsp, 0x148
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rbx, rdx
mov rdi, rcx
mov rcx, qword [0x140162ac0]
xor edx, edx
lea r8, [r9 - 1]
call fcn.1400d5e90
test rbx, rbx
je 0x140098c86
cmp word [rbx], 0
je 0x140098c86
lea rdx, [rsp + 0x168]
mov qword [rsp + 0x140], rsi
mov rcx, rbx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
jne 0x140098b78
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14015bc10]
mov dl, 1
mov dword [rcx + 0x40], eax
mov rcx, rdi
call fcn.1400629e0
mov rsi, qword [rsp + 0x140]
add rsp, 0x148
pop rdi
pop rbx
ret
mov rcx, rsi
mov qword [rsp + 0x160], rbp
call fcn.1400f75c0
mov r9, rax
mov r8d, esi
xor edx, edx
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x140098c62
lea r9, [rsp + 0x170]
mov rcx, rbp
lea r8, [rsp + 0x178]
lea rdx, [0x140139590]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140098c62
mov rax, qword [rsp + 0x178]
lea r8, str._u._u._u._u
mov edx, dword [rax + 0xc]
mov r9d, dword [rax + 8]
movzx ecx, dx
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x40]
shr edx, 0x10
mov dword [rsp + 0x28], edx
mov edx, 0x80
movzx eax, r9w
shr r9d, 0x10
mov dword [rsp + 0x20], eax
call fcn.1400d08d0
mov rcx, rbp
call fcn.1400f75c8
mov rax, qword [0x14015bc10]
xor edx, edx
mov rcx, rdi
mov dword [rax + 0x40], 0
call fcn.1400629e0
mov rcx, qword [0x140162ac0]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400d5e90
mov rbp, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x140]
add rsp, 0x148
pop rdi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14015bc10]
mov dword [rcx + 0x40], eax
mov rcx, rbp
call fcn.1400f75c8
mov dl, 1
mov rcx, rdi
call fcn.1400629e0
jmp 0x140098c48
mov rax, qword [0x14015bc10]
mov dl, 1
mov rcx, rdi
mov dword [rax + 0x40], 0x57
call fcn.1400629e0
add rsp, 0x148
pop rdi
pop rbx
ret
Function at 0x140098f70
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
test dl, dl
jne 0x140098fa2
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x140099074
mov al, 1
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
lea r9, [rsp + 0x290]
mov edx, 0x104
lea r8, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x60]
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140098fd0
xor edi, edi
test rax, rax
je 0x140098fee
cmp word [rsp + rax*2 + 0x5e], 0x5c
jne 0x140098fee
mov word [rsp + rax*2 + 0x5e], di
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140099074
test al, 0x10
je 0x140099074
lea rax, [rsp + 0x60]
nop word [rax + rax]
cmp word [rax + rbx*2 + 2], di
lea rbx, [rbx + 1]
jne 0x140099010
lea rax, [rsp + 0x60]
mov word [rsp + rbx*2 + 0x62], di
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov eax, 0x614
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
mov word [rsp + 0x40], ax
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
mov rbx, qword [rsp + 0x280]
xor al, al
add rsp, 0x270
pop rdi
ret
Function at 0x140099690
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x270
mov edx, 0x2a
mov rbx, rcx
call fcn.1400f0a4c
test rax, rax
jne 0x1400996d4
lea edx, [rax + 0x3f]
mov rcx, rbx
call fcn.1400f0a4c
test rax, rax
jne 0x1400996d4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400996e8
mov al, 1
add rsp, 0x270
pop rbx
ret
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400996f3
xor al, al
add rsp, 0x270
pop rbx
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
add rsp, 0x270
pop rbx
ret

Function at 0x140099710
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x58]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14009979a
lea r8, [rsp + 0x34]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x30]
xor eax, eax
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14009979a
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x14009979a
mov al, 1
add rsp, 0x40
pop rbx
ret
xor al, al
add rsp, 0x40
pop rbx
ret

Function at 0x1400997b0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x40
xor r9d, r9d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], 0x1f4
mov rbx, rcx
mov dword [rsp + 0x20], 2
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
jne 0x14009982d
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x58], eax
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x58]
test r8d, r8d
je 0x14009982d
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14009982d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x40
pop rbx
ret
Function at 0x1400b7910
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
movzx eax, word [rcx]
xor bl, bl
mov rdi, rcx
test ax, ax
je 0x1400b795a
nop dword [rax]
cmp ax, 0x21
je 0x1400b794a
cmp ax, 0x2b
je 0x1400b7946
cmp ax, 0x5e
jne 0x1400b795a
mov al, 2
jmp 0x1400b794c
mov al, 1
jmp 0x1400b794c
mov al, 4
add rdi, 2
or bl, al
movzx eax, word [rdi]
test ax, ax
jne 0x1400b7930
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140024340
movzx esi, al
test al, al
jne 0x1400b798d
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor edx, edx
mov rcx, rdi
call fcn.140024220
movzx edx, ax
test ax, ax
jne 0x1400b79ad
xor edx, edx
movzx ecx, sil
call fcn.140025120
movzx edx, ax
mov eax, 0x100
and dx, ax
movzx eax, bl
or al, 8
movzx ecx, al
test dx, dx
movzx eax, bl
mov rbx, qword [rsp + 0x40]
cmove ecx, eax
movzx eax, cl
shl ax, 8
or ax, si
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b9950
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x30
mov r14, rdx
mov rbx, rcx
movzx eax, word [rbx]
cmp ax, 0x20
je 0x1400b9970
cmp ax, 9
jne 0x1400b9976
add rbx, 2
jmp 0x1400b9961
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
test ax, ax
je 0x1400b9bc2
cmp word [rbx + 2], 0
lea rcx, [rbx + 2]
jne 0x1400b99a7
mov word [rdx + 2], ax
mov al, 1
mov byte [rdx], 0
jmp 0x1400b9bc4
mov byte [rdx], 1
xor sil, sil
mov edx, 0x2b
call fcn.1400f0a4c
mov rbp, rax
test rax, rax
je 0x1400b9a88
lea rdi, [rbp - 2]
cmp rdi, rbx
jbe 0x1400b99e8
nop dword [rax]
movzx eax, word [rdi]
cmp ax, 0x20
je 0x1400b99df
cmp ax, 9
jne 0x1400b99e8
sub rdi, 2
cmp rdi, rbx
ja 0x1400b99d0
sub rdi, rbx
lea rdx, str.Ctrl
sar rdi, 1
mov rcx, rbx
inc rdi
mov r8, rdi
call fcn.1400f7630
test eax, eax
jne 0x1400b9a0b
mov al, 1
jmp 0x1400b9a41
mov r8, rdi
lea rdx, [0x140136170]
mov rcx, rbx
call fcn.1400f7630
test eax, eax
jne 0x1400b9a25
mov al, 4
jmp 0x1400b9a41
mov r8, rdi
lea rdx, str.Shift
mov rcx, rbx
call fcn.1400f7630
test eax, eax
jne 0x1400b9bc2
mov al, reloc.WSOCK32.dll_recv
or sil, al
lea rbx, [rbp + 2]
nop dword [rax + rax]
movzx eax, word [rbx]
cmp ax, 0x20
je 0x1400b9a5f
cmp ax, 9
jne 0x1400b9a65
add rbx, 2
jmp 0x1400b9a50
test ax, ax
je 0x1400b9bc2
mov edx, 0x2b
lea rcx, [rbx + 2]
call fcn.1400f0a4c
mov rbp, rax
test rax, rax
jne 0x1400b99c3
xor ecx, ecx
cmp word [rbx + 2], cx
jne 0x1400b9b7b
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, word [rbx]
mov rbp, rax
call qword [sym.imp.USER32.dll_CharLowerW]
mov rdi, rax
cmp ax, 0xa
jne 0x1400b9ab9
mov cl, 0xd
movzx eax, cl
jmp 0x1400b9b96
mov rdx, rbp
movzx ecx, di
call qword [sym.imp.USER32.dll_VkKeyScanExW]
movsx rcx, ax
mov r8, rcx
shr r8, 8
cmp r8b, 0xff
jne 0x1400b9b29
cmp cl, 0xff
jne 0x1400b9b29
movzx ebp, di
test ebp, 0xffffff80
jne 0x1400b9b2f
mov edx, 0x103
mov ecx, ebp
call fcn.1400fc354
test eax, eax
je 0x1400b9b2f
mov edx, 2
mov ecx, ebp
call fcn.1400fc354
mov edx, 1
movzx edi, dil
mov ecx, ebp
mov ebx, eax
call fcn.1400fc354
test eax, eax
movzx ecx, dil
setne r8b
and cl, 0xdf
test ebx, ebx
movzx ecx, cl
cmove ecx, edi
test r8b, 0x38
je 0x1400b9b36
xor cl, cl
movzx eax, cl
jmp 0x1400b9b96
movzx eax, r8b
and al, 6
cmp al, 6
jne 0x1400b9b46
or sil, 8
jmp 0x1400b9b66
test r8b, 2
je 0x1400b9b56
test sil, 3
jne 0x1400b9b56
or sil, 1
test r8b, 4
je 0x1400b9b66
test sil, 0xc
jne 0x1400b9b66
or sil, 4
test r8b, 1
je 0x1400b9b76
test sil, 0x30
jne 0x1400b9b76
or sil, 0x10
movzx eax, cl
jmp 0x1400b9b96
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140024340
movzx eax, al
mov word [r14 + 2], ax
test sil, 1
je 0x1400b9ba5
or byte [r14], 8
test sil, 4
je 0x1400b9baf
or byte [r14], 0x10
test sil, 0x10
je 0x1400b9bb9
or byte [r14], 4
cmp ax, 0
setne al
jmp 0x1400b9bc4
xor al, al
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400bb850
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x20
mov r14, 0xffffffffffffffff
mov rbx, r9
mov rax, r14
mov r15, r8
mov rbp, rdx
mov r13, rcx
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400bb884
cmp rax, 1
jbe 0x1400bb921
cmp word [rdx + rax*2 - 2], 0x26
jne 0x1400bb921
cmp word [rdx + rax*2 - 4], 0x26
je 0x1400bb921
mov rcx, rbp
nop
movzx eax, word [rcx]
cmp ax, 0x20
je 0x1400bb8bf
cmp ax, 9
jne 0x1400bb8c5
add rcx, 2
jmp 0x1400bb8b0
test ax, ax
je 0x1400bb915
cmp ax, 0x2d
je 0x1400bb8d6
cmp ax, 0x2b
jne 0x1400bb8e0
lea rax, [rcx + 2]
mov rcx, rax
movzx eax, word [rax]
cmp ax, 0x30
jne 0x1400bb915
movzx eax, word [rcx + 2]
mov edx, 0xffdf
sub ax, 0x58
test dx, ax
jne 0x1400bb915
movzx ecx, word [rcx + 4]
call fcn.1400f57c0
test eax, eax
je 0x1400bb915
xor edx, edx
mov rcx, rbp
lea r8d, [rdx + 0x10]
call fcn.1400f7190
jmp 0x1400bb91d
mov rcx, rbp
call fcn.1400f73ac
lea r14d, [rax - 1]
xor edi, edi
mov eax, r14d
shr eax, 0x1f
mov esi, edi
xor al, 1
mov byte [rbx], al
mov rbx, qword [r13 + 8]
test rbx, rbx
je 0x1400bb960
cmp edi, r14d
je 0x1400bb95b
mov rcx, qword [rbx]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400bb95b
mov rsi, rbx
inc edi
mov rbx, qword [rbx + 0x38]
test rbx, rbx
jne 0x1400bb938
mov qword [r15], rsi
jmp 0x1400bb963
mov qword [r15], rdi
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
ret