joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001f30
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x290
mov rax, qword [0x140045270]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r14, rcx
xor ebp, ebp
xor edx, edx
lea ecx, [rbp + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001f9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [r14 + 0x10]
lea r9d, [rbp + 1]
mov dword [rsp + 0x28], eax
lea rax, str.Failed_to_create_TH_snapshot._System_error__lu
lea rdx, str.C:dvsp4_build_swgcomp_relgs_03_40_srcNvContainercontainerNvcHost.cpp
mov r8d, 0x1b8
mov qword [rsp + 0x20], rax
call fcn.140006d00
jmp 0x1400020e9
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8d, 0x234
call fcn.140009820
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov dword [rsp + 0x40], 0x238
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x140001ffd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [r14 + 0x10]
lea rdx, str.C:dvsp4_build_swgcomp_relgs_03_40_srcNvContainercontainerNvcHost.cpp
mov dword [rsp + 0x28], eax
lea rax, str.Failed_start_walking_TH_snapshot._System_error__lu
mov r9d, 1
mov r8d, 0x1c1
mov qword [rsp + 0x20], rax
call fcn.140006d00
jmp 0x1400020e0
mov qword [rsp + 0x2b8], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x2c0], rsi
mov ebx, eax
cmp dword [rsp + 0x48], ebx
je 0x14000202e
lea rdx, [rsp + 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140002015
jmp 0x140002036
mov esi, dword [rsp + 0x60]
test esi, esi
jne 0x140002064
mov rcx, qword [r14 + 0x10]
lea rax, str.Failed_find_our_PID__lu_in_TH_snapshot
lea rdx, str.C:dvsp4_build_swgcomp_relgs_03_40_srcNvContainercontainerNvcHost.cpp
mov r9d, 1
mov r8d, 0x1d2
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call fcn.140006d00
jmp 0x1400020d0
mov r8d, esi
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x14000209a
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rax
mov r9d, 3
lea rax, str.Open_parent_process__p_for_PID__lu
mov r8d, 0x1d9
jmp 0x1400020bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 1
mov r8d, 0x1dd
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], esi
lea rax, str.Failed_open_parent_process_for_PID__lu._System_error__lu
mov rcx, qword [r14 + 0x10]
lea rdx, str.C:dvsp4_build_swgcomp_relgs_03_40_srcNvContainercontainerNvcHost.cpp
mov qword [rsp + 0x20], rax
call fcn.140006d00
mov rsi, qword [rsp + 0x2c0]
mov rbx, qword [rsp + 0x2b8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400097f0
add rsp, 0x290
pop r14
pop rdi
pop rbp
ret
Function at 0x1400023e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x480
mov rax, qword [0x140045270]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov qword [rsp + 0x28], rdx
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
lea rax, str.Load_plugins_from__S
lea rdx, str.C:dvsp4_build_swgcomp_relgs_03_40_srcNvContainercontainerNvcHost.cpp
mov r9d, 3
mov r8d, 0x14d
mov qword [rsp + 0x20], rax
call fcn.140006d00
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000247e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx + 0x10]
lea rdx, str.C:dvsp4_build_swgcomp_relgs_03_40_srcNvContainercontainerNvcHost.cpp
mov dword [rsp + 0x30], eax
lea rax, str.GetFileAttributes_failed_for_path:__S__system_err:__lu_
mov r9d, 1
mov r8d, 0x152
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.140006d00
xor al, al
jmp 0x14000252f
test al, 0x10
jne 0x140002566
mov qword [rsp + 0x4a0], rsi
lea rcx, [rsp + 0x262]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x260], si
call fcn.140009820
mov qword [rsp + 0x40], 0x104
lea rax, [rsp + 0x260]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call fcn.14000846c
mov rdx, qword [str..dll]
lea rcx, [rsp + 0x260]
call fcn.1400082f8
test eax, eax
je 0x140002550
mov rcx, qword [rbx + 0x10]
lea rax, str.File__S_is_not_supported
lea r9d, [rsi + 1]
lea rdx, str.C:dvsp4_build_swgcomp_relgs_03_40_srcNvContainercontainerNvcHost.cpp
mov r8d, 0x15e
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.140006d00
xor al, al
mov rsi, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400097f0
mov rbx, qword [rsp + 0x4a8]
add rsp, 0x480
pop rdi
ret
or dword [rbx + 8], 0x10
mov rdx, rdi
mov rcx, rbx
call fcn.140001910
test eax, eax
sete al
jmp 0x140002527
lea rcx, [rsp + 0x50]
mov r8, rdi
mov edx, 0x104
call fcn.14000783c
lea rcx, [rsp + 0x50]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002581
test rax, rax
je 0x1400025b7
movzx ecx, word [rsp + rax*2 + 0x4e]
cmp cx, 0x5c
je 0x1400025b7
cmp cx, 0x2f
je 0x1400025b7
lea r8, [0x140036174]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call fcn.1400081a4
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rbx
call fcn.140002d50
test al, al
je 0x14000252f
test byte [rbx + 8], 8
je 0x14000252f
lea rdx, [rsp + 0x50]
mov r8d, 0x10
mov rcx, rbx
call fcn.140002d50
jmp 0x14000252f
Function at 0x1400056c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov rbx, r8
mov rdi, rcx
mov r8, r9
call fcn.140001490
nop
lea rax, vtable.nvc::ServiceHost.0
mov qword [rdi], rax
xor ebp, ebp
mov qword [rdi + 0x390], rbp
mov qword [rdi + 0x418], rbp
lea rax, str.Service_host
mov qword [rsp + 0x20], rax
lea r9d, [rbp + 4]
lea r8d, [rbp + 0x1d]
lea rdx, str.C:dvsp4_build_swgcomp_relgs_03_40_srcNvContainercontainerNvcServiceHost.cpp
mov rcx, qword [rdi + 0x10]
call fcn.140006d00
xor eax, eax
mov qword [rdi + 0x370], rax
mov qword [rdi + 0x378], rax
mov qword [rdi + 0x380], rax
mov dword [rdi + 0x388], eax
mov dword [rdi + 0x370], 0x10
xor r9d, r9d
xor r8d, r8d
lea edx, [rbp + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x418], rax
mov r8, rbx
lea edx, [rbp + 0x40]
lea rcx, [rdi + 0x398]
call fcn.14000783c
mov edx, 0x200
mov rcx, rdi
call fcn.140005f40
test al, al
je 0x140005795
or dword [rdi + 8], 4
mov edx, 0x100
mov rcx, rdi
call fcn.140005f40
test al, al
je 0x1400057aa
or dword [rdi + 8], 4
mov qword [0x1400478c0], rdi
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea r8, [0x140006310]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x140005819
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.Service_host:_failed_to_creat_thread._Error__lu
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8d, [r9 + 0x36]
lea rdx, str.C:dvsp4_build_swgcomp_relgs_03_40_srcNvContainercontainerNvcServiceHost.cpp
mov rcx, qword [rdi + 0x10]
call fcn.140006d00
xor edx, edx
mov r8d, 0x80
lea rcx, [rdi + 0x398]
call fcn.140009820
jmp 0x140005822
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x418]
test rcx, rcx
je 0x140005865
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x28], eax
lea rax, str.Service_host:_wait_completed_with__lu
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8d, [r9 + 0x48]
lea rdx, str.C:dvsp4_build_swgcomp_relgs_03_40_srcNvContainercontainerNvcServiceHost.cpp
mov rcx, qword [rdi + 0x10]
call fcn.140006d00
jmp 0x14000588c
lea rax, str.Service_host_failed
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8d, [r9 + 0x4e]
lea rdx, str.C:dvsp4_build_swgcomp_relgs_03_40_srcNvContainercontainerNvcServiceHost.cpp
mov rcx, qword [rdi + 0x10]
call fcn.140006d00
nop
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140005f40
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140045270]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x48]
or edx, 0x2001f
mov rbx, rcx
call fcn.140005e50
test eax, eax
jne 0x140006024
movzx eax, word [0x1400375d8]
movups xmm0, xmmword [str.Recovery]
xor ecx, ecx
mov word [rsp + 0x60], ax
lea rax, [rsp + 0x44]
mov dword [rsp + 0x40], ecx
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
lea r9d, [rcx + 0x10]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x50]
xor edx, edx
mov dword [rsp + 0x44], 4
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x40], 0
je 0x140006024
mov rcx, qword [rbx + 0x10]
lea rax, str.Safe_mode_is_ON._Optional_plugins_will_not_be_loaded
lea rdx, str.C:dvsp4_build_swgcomp_relgs_03_40_srcNvContainercontainerNvcServiceHost.cpp
mov r9d, 2
mov r8d, 0x85
mov qword [rsp + 0x20], rax
call fcn.140006d00
mov al, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400097f0
add rsp, 0x70
pop rbx
ret
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400097f0
add rsp, 0x70
pop rbx
ret

Function at 0x140006210
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140045270]
xor rax, rsp
mov qword [rsp + 0x78], rax
movups xmm0, xmmword [str.ServiceAutoStart]
movups xmm1, xmmword [0x140037628]
movzx eax, word [0x140037638]
lea r8, [rsp + 0x48]
or edx, 0x20006
mov rdi, rcx
mov word [rsp + 0x70], ax
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm1
call fcn.140005e50
mov ebx, eax
test eax, eax
jne 0x1400062ab
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9d, [rbx + 4]
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1400062ed
mov rcx, qword [rdi + 0x10]
mov dword [rsp + 0x38], ebx
lea rax, [rdi + 0x398]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
lea rdx, str.C:dvsp4_build_swgcomp_relgs_03_40_srcNvContainercontainerNvcServiceHost.cpp
mov qword [rsp + 0x28], rax
lea rax, str.Failed_to_save_auto_start_flag__S_to_registry_for_service__S._Error__ld
mov r9d, 1
mov r8d, 0xa8
mov qword [rsp + 0x20], rax
call fcn.140006d00
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400097f0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x140006be0
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x140045270]
xor rax, rsp
mov qword [rsp + 0x460], rax
cmp qword [rcx + 0x10], 0
mov rsi, rdx
mov rdi, rcx
je 0x140006c13
mov al, 1
jmp 0x140006cd7
mov qword [rsp + 0x488], rbx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x30]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov r9d, dword [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov r8, rsi
mov edx, 0x104
call fcn.1400070f0
lea r9, [rsp + 0x40]
lea r8, str._s_backup_d
lea rcx, [rsp + 0x250]
mov edx, 0x104
mov dword [rsp + 0x20], 1
call fcn.1400070f0
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r9, [rsp + 0x40]
lea r8, str._s_backup1
lea rcx, [rsp + 0x250]
mov edx, 0x104
call fcn.1400070f0
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
lea r8d, [rbx + 0x20]
lea rdx, [0x140037c88]
lea rcx, [rsp + 0x40]
call fcn.14000b0e4
mov rbx, qword [rsp + 0x488]
test rax, rax
mov qword [rdi + 0x10], rax
setne al
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400097f0
mov rsi, qword [rsp + 0x490]
add rsp, 0x470
pop rdi
ret

Function at 0x1400073e0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x208], 0
mov rbx, rcx
jne 0x140007425
lea rax, str.Directory_listener_has_not_been_configured.
mov r8d, 0x54
mov rcx, qword [rcx + 0x210]
lea rdx, str.C:dvsp4_build_swgcomp_relgs_03_40_srcNvContainercommonDirectoryListener.cpp
mov r9d, 1
mov qword [rsp + 0x20], rax
call fcn.140006d00
xor al, al
add rsp, 0x30
pop rbx
ret
cmp qword [rcx + 0x220], 0
je 0x14000743e
lea rax, str.Directory_listener_is_already_running.
mov r8d, 0x5a
jmp 0x1400073ff
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x220], rax
test rax, rax
jne 0x140007470
mov rcx, qword [rbx + 0x210]
lea rax, str.Failed_to_start_directory_listener__no_start_event_.
mov r8d, 0x61
jmp 0x140007406
xor eax, eax
lea r8, [0x1400076b0]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x218], rax
test rax, rax
jne 0x1400074b4
mov rcx, qword [rbx + 0x210]
lea rax, str.Failed_to_create_directory_listener_thread.
mov r8d, 0x68
jmp 0x140007406
mov rcx, qword [rbx + 0x220]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x210]
lea rdx, str.C:dvsp4_build_swgcomp_relgs_03_40_srcNvContainercommonDirectoryListener.cpp
test eax, eax
je 0x1400074ea
lea rax, str.Failed_to_start_directory_listener_thread.
mov r8d, 0x6e
jmp 0x14000740d
mov r9d, 4
lea rax, str.Directory_listener_thread_started.
lea r8d, [r9 + 0x6e]
mov qword [rsp + 0x20], rax
call fcn.140006d00
mov al, 1
add rsp, 0x30
pop rbx
ret

Function at 0x14000a3ac
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14000a214
Function at 0x10000714c
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
lea rax, [r11 + 0x10]
mov rbx, rcx
lea r9, [0x1000064a8]
mov qword [r11 - 0x18], rax
lea rax, [r11 + 0x18]
lea rdx, [0x1000061a0]
mov qword [r11 - 0x20], rax
and qword [r11 - 0x28], 0
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1000071b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
jmp 0x1000071f6
mov rcx, qword [rsp + 0x70]
lea rdx, [0x100006218]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 0x330
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
test eax, eax
je 0x1000071ee
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10000719b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x50
pop rbx
ret

Function at 0x100007988
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
cmp edx, esi
jne 0x1000079bd
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rbx
jne 0x1000079bd
lea ecx, [rsi + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, si
jl 0x100007aa3
cmp dword [0x10002a3d8], esi
mov ebx, esi
jle 0x1000079e5
lea rdi, [0x10002a3e0]
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + 0x30]
inc ebx
add rdi, 8
cmp ebx, dword [0x10002a3d8]
jl 0x1000079ce
cmp dword [0x10002a3ac], esi
je 0x100007a81
movzx eax, byte [0x10002a41c]
lea ecx, [rax + rax*2]
mov eax, 0x51eb851f
shl ecx, 2
mul ecx
mov eax, 0xb
mov edi, edx
shr edi, 5
cmp edi, 0xc
cmovae edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
mov r8d, 0x100
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, rsi
je 0x100007a50
movzx r9d, byte [0x10002a41c]
lea r8, [0x100029a30]
mov edx, 0x80
mov rcx, rax
call fcn.10000b07c
mov ecx, dword [0x10002a38c]
mov r8d, edi
mov r9, rbx
mov edx, 0x402
call qword [sym.imp.USER32.dll_PostThreadMessageW]
cmp eax, esi
jne 0x100007a9e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100007a9e
mov ecx, dword [0x10002a38c]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x404
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov dword [0x10002a3ac], eax
call fcn.100007860
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x100008600
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [0x10002a358]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x10002a350]
test rcx, rcx
je 0x10000864a
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [0x10002a350]
test rcx, rcx
je 0x10000864a
cmp rcx, 0xffffffffffffffff
je 0x10000864a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [0x10002a350], 0xffffffffffffffff
cmp qword [0x10002a3d0], 0
jne 0x100008688
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x1000085bc]
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x10002a3d0], rax
test rax, rax
jne 0x100008688
mov rcx, rbx
call qword [sym.imp.USER32.dll_DestroyWindow]
add rsp, 0x30
pop rbx
ret
Function at 0x100009b44
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0xe0
mov rax, qword [0x100028110]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor ebx, ebx
cmp dword [rcx + 8], 0x100
mov r12, rcx
jne 0x100009d99
cmp qword [rcx + 0x10], 9
je 0x100009b95
cmp qword [rcx + 0x10], 0xd
jne 0x100009d99
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, bx
jl 0x100009d99
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, bx
jl 0x100009d99
call qword [sym.imp.USER32.dll_GetFocus]
lea rdx, [rsp + 0x60]
mov r8d, 0x32
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
cmp eax, ebx
je 0x100009d99
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
lea rdx, [0x100006600]
lea rcx, [rsp + 0x60]
cmp ax, bx
mov r13d, ebx
setge r13b
call qword [sym.imp.SHLWAPI.dll_StrCmpICW]
cmp eax, ebx
jne 0x100009c29
xor r9d, r9d
xor r8d, r8d
mov edx, 0x101f
mov rcx, rsi
mov rbp, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, rax
jmp 0x100009c52
lea rdx, [0x100006620]
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrCmpICW]
cmp eax, ebx
jne 0x100009d0d
mov rcx, rsi
mov rdi, rsi
call qword [sym.imp.USER32.dll_GetParent]
mov rbp, rax
cmp rbp, rbx
je 0x100009d0d
cmp rdi, rbx
je 0x100009d0d
cmp qword [r12 + 0x10], 0xd
jne 0x100009cd2
cmp rdi, rsi
jne 0x100009d99
xor edx, edx
lea rcx, [rsp + 0x28]
lea r8d, [rdx + 0x38]
call sub.msvcrt.dll_memset
or dword [rsp + 0x38], 0xffffffff
xor r9d, r9d
xor r8d, r8d
mov edx, 0x121b
mov rcx, rdi
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x30], 0xffffff94
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbp
mov dword [rsp + 0x3c], eax
call qword [sym.imp.USER32.dll_GetParent]
xor r8d, r8d
lea r9, [rsp + 0x20]
lea edx, [r8 + 0x4e]
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x100009d94
cmp r13d, ebx
je 0x100009ce0
cmp rbp, rsi
je 0x100009d86
cmp rdi, rsi
jne 0x100009d99
cmp r13d, ebx
je 0x100009d08
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetParent]
xor r8d, r8d
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
jmp 0x100009d83
mov rdi, rbp
jmp 0x100009d86
cmp r13d, ebx
jne 0x100009d99
cmp qword [r12 + 0x10], 9
jne 0x100009d99
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetParent]
mov r8d, 1
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov rdi, rax
cmp rax, rbx
je 0x100009d99
lea rdx, [rsp + 0x60]
mov r8d, 0x32
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
cmp eax, ebx
je 0x100009d99
lea rdx, [0x100006600]
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrCmpICW]
cmp eax, ebx
jne 0x100009d99
xor r9d, r9d
xor r8d, r8d
mov edx, 0x101f
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, rax
cmp rdi, rbx
je 0x100009d99
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetFocus]
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.100022bc0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x10000a048
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x270
mov rax, qword [0x100028110]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov esi, ecx
lea r8, [0x100006130]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x10002a350], rax
test rax, rax
jne 0x10000a09a
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10000a0a6
mov ebx, 0x80004005
jmp 0x10000a0b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
test eax, eax
je 0x10000a0b4
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x10000a1c3
cmp bx, 0xb7
jne 0x10000a1c3
mov rcx, qword [0x10002a350]
test esi, esi
jne 0x10000a0e2
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ebx, 1
jmp 0x10000a1c3
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x10002a370]
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x2713
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jle 0x10000a112
xor ebx, ebx
jmp 0x10000a139
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10000a12c
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10000a131
mov ebx, 0x80004005
test ebx, ebx
js 0x10000a1c3
lea rdx, [rsp + 0x50]
mov ecx, 0x8002
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
je 0x10000a1c3
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
lea r11, [rsp + 0x48]
mov ebx, 0x40b
mov qword [rsp + 0x30], r11
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rsi
mov dword [rsp + 0x28], 0x2710
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
jne 0x10000a1b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x10000a1c1
cmp qword [rsp + 0x48], rbx
je 0x10000a0d8
xor ebx, ebx
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.100022bc0
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rsi
ret
Function at 0x10000b158
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
sub rsp, 0x60
lea rax, [0x100006970]
xor edx, edx
mov rbx, rcx
mov qword [rcx], rax
lea rax, [rcx + 0xc8]
lea r8d, [rdx + 0x48]
add rcx, 0x58
mov qword [rax + 8], rax
mov qword [rax], rax
call sub.msvcrt.dll_memset
and qword [rbx + 8], 0
and qword [rbx + 0x10], 0
and qword [rbx + 0xb0], 0
and dword [rbx + 0xd8], 0
and dword [rbx + 0xdc], 0
and qword [rbx + 0xb8], 0
and dword [rbx + 0xe0], 0
and dword [rbx + 0xe8], 0
and dword [rbx + 0xec], 0
mov rcx, rbx
call fcn.10000e50c
xor r9d, r9d
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0x40]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x10000b235
mov eax, dword [rsp + 0x28]
mov dword [0x100028ec4], eax
shr eax, 0xa
imul eax, dword [rsp + 0x2c]
mov qword [0x10002ae38], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, 0x7d0
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x10002a428], rax
mov rax, rbx
add rsp, 0x60
pop rbx
ret