joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180037c40
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r13
push r14
sub rsp, 0x60
mov r13d, r9d
mov rbx, r8
mov r14, rdx
mov rdi, rcx
add rcx, 0x1c8
call fcn.180031200
cmp byte [rdi + 0x328], 0
je 0x180037c8a
mov rax, qword [rdi]
mov r8b, 1
xor edx, edx
mov rcx, rdi
call qword [rax + 0x208]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.18001f0e0
xor esi, esi
cmp dword [rax + 0xc], esi
je 0x180037ca3
mov rbp, qword [rax]
jmp 0x180037ca6
mov rbp, rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x40], 0x1000
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, 0xffffffff
mov r8, r14
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 1
cmp eax, ecx
cmovl eax, ecx
lea edx, [rax + rax]
movzx r8d, cl
lea rcx, [rsp + 0x30]
call fcn.1800126d0
mov ebx, dword [rsp + 0x3c]
shr ebx, 1
cmp dword [rsp + 0x3c], esi
cmovne rsi, qword [rsp + 0x30]
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, r14
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, 1
mov edx, 1
cmovl eax, edx
cmp eax, ebx
jg 0x180037d55
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 0xffffffff
mov r8, r14
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x180037d5e
xor r14d, r14d
mov word [rsi], r14w
jmp 0x180037d61
xor r14d, r14d
mov rbx, r14
cmp dword [rsp + 0x3c], 0
cmovne rbx, qword [rsp + 0x30]
cmp qword [rdi + 0x4c8], 0
jne 0x180037e00
mov rax, qword [rdi + 0x4c0]
test rax, rax
je 0x180037dba
nop dword [rax]
mov qword [rdi + 0x4c8], rax
mov rcx, rax
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
jne 0x180037d90
lea rdx, [rdi + 0x5c0]
mov rcx, qword [rdi + 0x4c8]
call fcn.1800383f0
jmp 0x180037e00
cmp dword [rdi + 0x5cc], 0
je 0x180037dd1
mov rax, qword [rdi + 0x5c0]
test rax, rax
je 0x180037e00
jmp 0x180037ddf
mov byte [0x180186048], 0
lea rax, [0x180186048]
cmp byte [rax], 0
je 0x180037e00
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rdi + 0x4e0], eax
mov rdx, rdi
lea rcx, [0x1800384b0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov r9d, r13d
mov r8, rbp
mov rdx, rbx
mov rcx, qword [rdi + 0x4c8]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov edi, eax
mov rcx, qword [rsp + 0x30]
call fcn.1800e1170
mov rcx, qword [rsp + 0x48]
call fcn.1800e1170
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x180037e56
mov dword [rsp + 0x80], edi
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
lea rdx, [rsp + 0x80]
call rax
nop
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x180037e6f
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], r14
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rdi
ret
Function at 0x18003a890
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, 0xd
mov rdi, rdx
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x18003a906
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x18003a900
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
je 0x18003a900
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x18003a900
mov rdx, rax
mov rcx, rdi
call fcn.1800338c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.USER32.dll_CloseClipboard]
xor r8d, r8d
mov edx, 1
mov rcx, rdi
call fcn.1800126d0
xor ecx, ecx
cmp dword [rdi + 0xc], 1
cmove rcx, rax
xor al, al
test rcx, rcx
je 0x18003a929
mov byte [rcx], al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18003a940
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 0x4c8]
mov rbx, rdx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x18003a960
add rsp, 0x30
pop rbx
ret
mov qword [rsp + 0x48], rsi
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rax, 0xffffffffffffffff
mov sil, 1
inc rax
cmp byte [rbx + rax], 0
jne 0x18003a975
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x50], rdi
test rax, rax
je 0x18003aa29
xor eax, eax
mov r9d, 0xffffffff
mov dword [rsp + 0x28], eax
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebp, eax
mov ecx, 2
mov eax, 1
cmp ebp, eax
cmovl ebp, eax
movsxd rdx, ebp
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
jne 0x18003a9e1
call qword [sym.imp.USER32.dll_CloseClipboard]
xor al, al
jmp 0x18003aa33
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x18003aa29
mov r8d, ebp
mov rdx, rbx
mov rcx, rax
call fcn.180033830
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
setne sil
test rax, rax
jne 0x18003aa29
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
call qword [sym.imp.USER32.dll_CloseClipboard]
movzx eax, sil
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
Function at 0x18003aa50
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x40
mov rcx, qword [rcx + 0x4c8]
mov rbx, rdx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x18003aa70
add rsp, 0x40
pop rbx
ret
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.18001f0e0
mov eax, dword [rsp + 0x2c]
mov ecx, 0x42
shr eax, 1
mov esi, eax
lea rdx, [rax*2 + 0x16]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
jne 0x18003aab4
xor bl, bl
jmp 0x18003ab31
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor bl, bl
test rax, rax
je 0x18003ab22
xor edx, edx
mov dword [rax], 0x14
cmp dword [rsp + 0x2c], edx
mov ecx, edx
mov qword [rsp + 0x50], rdx
mov qword [rax + 4], rdx
cmovne rdx, qword [rsp + 0x20]
mov dword [rax + 0xc], 1
mov dword [rax + 0x10], 1
test esi, esi
je 0x18003ab00
lea r8, [rsi + rsi]
lea rcx, [rax + 0x14]
call fcn.1801188c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 0xf
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
setne bl
test rax, rax
jne 0x18003ab2b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, qword [rsp + 0x20]
call fcn.1800e1170
mov rdi, qword [rsp + 0x60]
movzx eax, bl
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rbx
ret
Function at 0x18003ae90
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x90
mov rdi, r9
mov rbp, r8
mov rsi, rdx
mov r15, rcx
xor ebx, ebx
lea r13, [0x1801823a8]
mov qword [rsp + 0x50], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rax, [0x1801823a0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0xc0], ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x70], 0x80
mov rax, qword [r15 + 0x4a0]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x60]
lea rdx, [0x180132df8]
mov rcx, rdi
call fcn.1800669e0
mov edx, eax
test eax, eax
jne 0x18003af24
mov qword [rsi], rbx
jmp 0x18003b0b0
sub edx, 1
je 0x18003af8d
cmp edx, 1
jne 0x18003af1c
mov r9, qword [r15 + 0x4a0]
mov rbx, qword [rsp + 0x60]
cmp dword [rsp + 0x6c], 0
je 0x18003af46
mov rcx, rbx
jmp 0x18003af54
mov byte [0x180186048], 0
lea rcx, [0x180186048]
lea r8, [rsp + 0xc0]
lea rdx, [0x180132df8]
call fcn.180066b80
mov edx, dword [rsp + 0xc0]
mov dword [rsp + 0x20], edx
mov r9, rax
mov r8, rbp
mov rdx, rsi
mov rcx, r15
call fcn.18003b1e0
nop
mov rcx, rbx
jmp 0x18003b0b5
lea rdx, [0x18012f730]
cmp dword [rsp + 0x6c], 0
cmovne rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x78]
call fcn.18001f0e0
mov rcx, rbx
cmp dword [rsp + 0x84], ebx
cmovne rcx, qword [rsp + 0x78]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
mov rcx, qword [rsp + 0x78]
call fcn.1800e1170
mov qword [rsp + 0x48], rbx
test r14, r14
je 0x18003b0ad
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor edx, edx
mov r8d, 2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbp, rax
test rax, rax
je 0x18003b0a4
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r13, rax
mov dword [rsp + 0x20], edi
mov r9, rax
mov r8, qword [rsp + 0xd0]
lea rdx, [rsp + 0xc0]
mov rcx, r15
call fcn.18003b1e0
mov rcx, qword [rax]
mov qword [rax], rbx
mov rbx, rcx
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x18003b08b
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r13, [0x1801823a8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], rbx
mov rcx, qword [rsp + 0x60]
call fcn.1800e1170
nop
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rsi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x18004ce20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov edx, dword [rcx + 0x10]
mov rbx, rcx
mov edi, edx
and edi, 7
je 0x18004ce91
cmp edx, edi
jge 0x18004ce81
mov r11, qword [rcx + 8]
mov r10d, dword [rcx + 0x14]
mov rax, qword [rbx]
cmp rax, r11
jb 0x18004ce4d
xor cl, cl
jmp 0x18004ce56
movzx ecx, byte [rax]
inc rax
mov qword [rbx], rax
movzx eax, cl
mov ecx, edx
shl eax, cl
add edx, 8
or eax, r10d
mov dword [rbx + 0x10], edx
mov dword [rbx + 0x14], eax
mov r10d, eax
cmp edx, 0x18
jle 0x18004ce41
mov ecx, edi
lea r11, [rbx + 0x10]
shr dword [rbx + 0x14], cl
sub edx, edi
mov dword [rbx + 0x10], edx
jmp 0x18004ce95
lea r11, [rcx + 0x10]
mov ecx, edi
shr dword [rbx + 0x14], cl
sub edx, edi
mov dword [rbx + 0x10], edx
jmp 0x18004ce95
lea r11, [rcx + 0x10]
xor r9d, r9d
mov ecx, edx
test edx, edx
jle 0x18004cece
mov eax, dword [rbx + 0x14]
lea rdx, [rsp + 0x40]
movzx r10d, al
nop word [rax + rax]
shr eax, 8
inc r9d
mov byte [rdx], r10b
lea rdx, [rdx + 1]
sub ecx, 8
mov dword [rbx + 0x14], eax
movzx r10d, al
test ecx, ecx
jg 0x18004ceb0
mov dword [r11], ecx
movsxd rcx, r9d
cmp rcx, 4
jge 0x18004cf02
mov r8, qword [rbx + 8]
nop dword [rax + rax]
mov rax, qword [rbx]
cmp rax, r8
jb 0x18004ceec
xor dl, dl
jmp 0x18004cef5
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x40], dl
inc rcx
cmp rcx, 4
jl 0x18004cee0
movzx eax, byte [rsp + 0x40]
movzx esi, byte [rsp + 0x41]
movzx ecx, byte [rsp + 0x43]
shl esi, 8
add esi, eax
shl ecx, 8
movzx eax, byte [rsp + 0x42]
add ecx, eax
mov qword [rsp + 0x48], rbp
mov eax, esi
mov qword [rsp + 0x50], r14
xor eax, 0xffff
cmp ecx, eax
jne 0x18004cfca
mov rcx, qword [rbx]
mov edx, esi
add rcx, rdx
cmp rcx, qword [rbx + 8]
ja 0x18004cfca
mov rbp, qword [rbx + 0x18]
lea rdi, [rbx + 0x18]
mov rcx, qword [rbx + 0x28]
lea rax, [rsi + rbp]
cmp rax, rcx
jbe 0x18004cfab
cmp dword [rbx + 0x30], 0
mov qword [rdi], rbp
je 0x18004cfca
sub ebp, dword [rbx + 0x20]
sub ecx, dword [rbx + 0x20]
lea edx, [rsi + rbp]
cmp edx, ecx
jle 0x18004cf83
lea eax, [rcx + rcx]
mov ecx, eax
cmp edx, eax
jg 0x18004cf76
lea rdi, [rbx + 0x18]
movsxd r14, ecx
mov rcx, qword [rbx + 0x20]
mov rdx, r14
call fcn.1800e1168
test rax, rax
je 0x18004cfca
movsxd rcx, ebp
add rcx, rax
mov qword [rbx + 0x20], rax
add rax, r14
mov qword [rdi], rcx
mov qword [rbx + 0x28], rax
mov rdx, qword [rbx]
mov rcx, qword [rdi]
mov r8d, esi
call fcn.1801188c0
mov eax, esi
add qword [rbx], rax
mov eax, esi
add qword [rdi], rax
mov eax, 1
jmp 0x18004cfcc
xor eax, eax
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800669e0
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x70
mov r14, r8
mov rbp, rdx
mov rdi, rcx
test rcx, rcx
je 0x180066b62
cmp byte [rcx], 0
je 0x180066b62
xor ebx, ebx
mov dword [rax - 0x18], 0x80
mov rdx, rcx
mov qword [rax - 0x28], rbx
lea rcx, [rax - 0x58]
mov qword [rax - 0x20], rbx
mov byte [rax - 0x10], bl
call fcn.18001f0e0
mov rsi, rax
cmp dword [rax + 0xc], ebx
je 0x180066a41
mov rcx, qword [rax]
jmp 0x180066a44
mov rcx, rbx
call fcn.1800f56b4
cmp dword [rsi + 0xc], ebx
je 0x180066a53
mov rdx, qword [rsi]
jmp 0x180066a56
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1800338c0
mov rcx, qword [rsp + 0x20]
call fcn.1800e1170
mov rdx, rbp
lea rcx, [rsp + 0x38]
call fcn.18001f0e0
mov rsi, rax
cmp dword [rax + 0xc], ebx
je 0x180066a84
mov rcx, qword [rax]
jmp 0x180066a87
mov rcx, rbx
call fcn.1800f5408
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.18001f000
mov rcx, qword [rsp + 0x38]
call fcn.1800e1170
cmp dword [rsp + 0x2c], ebx
lea r9, [rsp + 0x50]
mov rsi, qword [rsp + 0x20]
lea r8, [0x180066710]
mov rcx, qword [rsp + 0xa0]
mov rdx, rbx
cmovne rdx, rsi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
cmp byte [rsp + 0x68], bl
je 0x180066af9
cmp dword [rsp + 0x5c], ebx
je 0x180066ae5
mov rdi, qword [rsp + 0x50]
mov ebx, 2
jmp 0x180066b2c
mov byte [0x180186048], bl
lea rdi, [0x180186048]
mov ebx, 2
jmp 0x180066b2c
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.18001f0e0
cmp dword [rax + 0xc], ebx
je 0x180066b0e
mov rbx, qword [rax]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call fcn.1800e1170
test ebx, ebx
je 0x180066b50
mov ebx, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call fcn.180012880
mov rcx, rsi
call fcn.1800e1170
mov rcx, qword [rsp + 0x50]
call fcn.1800e1170
mov eax, ebx
jmp 0x180066b64
mov rcx, rsi
call fcn.1800e1170
mov rcx, qword [rsp + 0x50]
call fcn.1800e1170
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x180066b80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r13
push r14
sub rsp, 0x60
mov rbp, rcx
mov rdi, r9
lea rcx, [rsp + 0x30]
mov r14, r8
call fcn.18001f0e0
xor esi, esi
mov rbx, rax
cmp dword [rax + 0xc], esi
je 0x180066bba
mov rcx, qword [rax]
jmp 0x180066bbd
mov rcx, rsi
call fcn.1800f5408
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.18001f000
mov rcx, qword [rsp + 0x30]
call fcn.1800e1170
cmp dword [rsp + 0x54], esi
mov r13, rsi
mov dword [rsp + 0x28], esi
mov r9d, 0xffffffff
cmovne r13, qword [rsp + 0x48]
mov r8, rbp
xor edx, edx
mov qword [rsp + 0x30], rsi
mov ecx, 0xfde9
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x40], 0x1000
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 1
cmp eax, ecx
movzx r8d, cl
cmovl eax, ecx
lea rcx, [rsp + 0x30]
lea edx, [rax + rax]
call fcn.1800126d0
mov eax, dword [rsp + 0x3c]
mov r9d, 0xffffffff
mov ebx, eax
mov r8, rbp
shr ebx, 1
mov ecx, 0xfde9
test eax, eax
cmovne rsi, qword [rsp + 0x30]
xor eax, eax
mov dword [rsp + 0x28], eax
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, 1
mov edx, 1
cmovl eax, edx
cmp eax, ebx
jg 0x180066c95
mov dword [rsp + 0x28], eax
mov r9d, 0xffffffff
mov r8, rbp
mov qword [rsp + 0x20], rsi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x180066c9c
xor ebp, ebp
mov word [rsi], bp
jmp 0x180066c9e
xor ebp, ebp
cmp dword [rsp + 0x3c], 0
mov rdx, rbp
mov r8, r13
mov rcx, rdi
cmovne rdx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, qword [rsp + 0x30]
mov rbx, rax
call fcn.1800e1170
test rbx, rbx
je 0x180066cfd
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp eax, 8
jb 0x180066cfd
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x180066d27
mov dword [r14], ebp
mov rbx, rbp
mov rcx, qword [rsp + 0x48]
call fcn.1800e1170
lea r11, [rsp + 0x60]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop rdi
ret
mov dword [r14], esi
jmp 0x180066d00
Function at 0x18006d220
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movsx r8d, cx
movzx ebx, dl
test r8w, r8w
je 0x18006d4d7
cmp r8d, 0x39
je 0x18006d4d7
lea eax, [r8 - 1]
cmp eax, 0x38
ja case.default.0x18006d262
lea r9, [0x180000000]
cdqe
mov ecx, dword [r9 + rax*4 + 0x6d4f4]
add rcx, r9
jmp rcx
mov eax, 8
add rsp, 0x20
pop rbx
ret
mov eax, 9
add rsp, 0x20
pop rbx
ret
mov eax, 0xc
add rsp, 0x20
pop rbx
ret
mov eax, 0x13
add rsp, 0x20
pop rbx
ret
mov eax, 0x1b
add rsp, 0x20
pop rbx
ret
mov eax, 0x20
add rsp, 0x20
pop rbx
ret
mov eax, 0x23
add rsp, 0x20
pop rbx
ret
mov eax, 0x24
add rsp, 0x20
pop rbx
ret
mov eax, 0x25
add rsp, 0x20
pop rbx
ret
mov eax, 0x26
add rsp, 0x20
pop rbx
ret
mov eax, 0x27
add rsp, 0x20
pop rbx
ret
mov eax, 0x28
add rsp, 0x20
pop rbx
ret
mov eax, 0x21
add rsp, 0x20
pop rbx
ret
mov eax, 0x22
add rsp, 0x20
pop rbx
ret
mov eax, 0x29
add rsp, 0x20
pop rbx
ret
mov eax, 0x2a
add rsp, 0x20
pop rbx
ret
mov eax, 0xd
add rsp, 0x20
pop rbx
ret
mov eax, 0x2c
add rsp, 0x20
pop rbx
ret
mov eax, 0x2d
add rsp, 0x20
pop rbx
ret
mov eax, 0x2e
add rsp, 0x20
pop rbx
ret
mov eax, 0x2f
add rsp, 0x20
pop rbx
ret
mov eax, 0x60
add rsp, 0x20
pop rbx
ret
mov eax, 0x61
add rsp, 0x20
pop rbx
ret
mov eax, 0x62
add rsp, 0x20
pop rbx
ret
mov eax, 0x63
add rsp, 0x20
pop rbx
ret
mov eax, 0x64
add rsp, 0x20
pop rbx
ret
mov eax, 0x65
add rsp, 0x20
pop rbx
ret
mov eax, 0x66
add rsp, 0x20
pop rbx
ret
mov eax, 0x67
add rsp, 0x20
pop rbx
ret
mov eax, 0x68
add rsp, 0x20
pop rbx
ret
mov eax, 0x69
add rsp, 0x20
pop rbx
ret
mov eax, 0x6a
add rsp, 0x20
pop rbx
ret
mov eax, 0x6b
add rsp, 0x20
pop rbx
ret
mov eax, 0x6c
add rsp, 0x20
pop rbx
ret
mov eax, 0x6d
add rsp, 0x20
pop rbx
ret
mov eax, 0x6e
add rsp, 0x20
pop rbx
ret
mov eax, 0x6f
add rsp, 0x20
pop rbx
ret
mov eax, 0x70
add rsp, 0x20
pop rbx
ret
mov eax, 0x71
add rsp, 0x20
pop rbx
ret
mov eax, 0x72
add rsp, 0x20
pop rbx
ret
mov eax, 0x73
add rsp, 0x20
pop rbx
ret
mov eax, 0x74
add rsp, 0x20
pop rbx
ret
mov eax, 0x75
add rsp, 0x20
pop rbx
ret
mov eax, 0x76
add rsp, 0x20
pop rbx
ret
mov eax, 0x77
add rsp, 0x20
pop rbx
ret
mov eax, 0x78
add rsp, 0x20
pop rbx
ret
mov eax, 0x79
add rsp, 0x20
pop rbx
ret
mov eax, 0x7a
add rsp, 0x20
pop rbx
ret
mov eax, 0x7b
add rsp, 0x20
pop rbx
ret
mov eax, 0x90
add rsp, 0x20
pop rbx
ret
mov eax, 0x91
add rsp, 0x20
pop rbx
ret
mov eax, 0x10
add rsp, 0x20
pop rbx
ret
mov eax, 0x11
add rsp, 0x20
pop rbx
ret
mov eax, 0x12
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor eax, eax
lea ecx, [r8 - 0x50]
mov r9d, 0x80
cmp r8w, r9w
cmovge eax, ecx
add rsp, 0x20
pop rbx
ret
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov rdx, rax
movzx ecx, bl
call qword [sym.imp.USER32.dll_VkKeyScanExA]
cwde
add rsp, 0x20
pop rbx
ret
Function at 0x18007be60
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, 0x20070
call fcn.1801109a0
sub rsp, rax
movaps xmmword [rsp + 0x20040], xmm8
mov rax, qword [0x180166040]
xor rax, rsp
mov qword [rsp + 0x20030], rax
cvttss2si eax, dword [0x180166dbc]
xorps xmm8, xmm8
xorps xmm3, xmm3
cvtss2sd xmm8, xmm0
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movaps xmm0, xmm8
addsd xmm8, xmm8
mulsd xmm0, qword [0x180140d88]
divsd xmm1, xmm0
addsd xmm1, qword [0x180140d30]
cvttsd2si ebx, xmm1
cmp ebx, 1
jl 0x18007c02e
mov qword [rsp + 0x20080], rsi
mov esi, 0x1000
mov qword [rsp + 0x20088], rdi
xor edi, edi
movaps xmmword [rsp + 0x20060], xmm6
movsd xmm6, qword [0x1801419c0]
movaps xmmword [rsp + 0x20050], xmm7
movsd xmm7, qword [0x1801411c8]
nop word [rax + rax]
cmp ebx, esi
lea rax, [rsp + 0x10030]
mov r8d, ebx
mov ecx, 0x400
cmova r8d, esi
nop word [rax + rax]
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rdi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x10], rdi
mov qword [rax - 8], rdi
sub rcx, 1
jne 0x18007bf30
lea rax, [rsp + 0x30]
mov ecx, 0x400
nop dword [rax]
nop word [rax + rax]
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rdi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x10], rdi
mov qword [rax - 8], rdi
sub rcx, 1
jne 0x18007bf70
mov edx, 1
mov eax, edx
cmp r8, rdx
jb 0x18007bfde
lea rcx, [rsp + 0x10028]
nop dword [rax]
movd xmm0, edx
lea rcx, [rcx - 8]
movaps xmm2, xmm7
inc edx
cvtdq2pd xmm0, xmm0
divsd xmm2, xmm0
movaps xmm1, xmm2
xorps xmm1, xmm6
movsd qword [rsp + rax*8 + 0x30], xmm1
inc rax
movsd qword [rcx + 8], xmm2
cmp rax, r8
jle 0x18007bfb0
lea r8, [rsp + 0x10030]
movsd qword [rsp + 0x20], xmm8
lea rdx, [rsp + 0x30]
call fcn.18007c050
shr ebx, 1
addsd xmm8, xmm8
xorps xmm3, xmm3
cvtss2sd xmm3, xmm0
cmp ebx, 1
jae 0x18007bf10
movaps xmm7, xmmword [rsp + 0x20050]
movaps xmm6, xmmword [rsp + 0x20060]
mov rdi, qword [rsp + 0x20088]
mov rsi, qword [rsp + 0x20080]
mov rcx, qword [rsp + 0x20030]
xor rcx, rsp
call fcn.1800b6030
movaps xmm8, xmmword [rsp + 0x20040]
add rsp, 0x20070
pop rbx
ret
Function at 0x180098bc0
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x180098be4
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
je 0x180098c72
mov rdi, r15
mov qword [rsp + 0x40], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x180098c40
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x180098c40
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.1801188c0
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x180098c5d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x180098c65
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x180098c01
mov rbp, qword [rsp + 0x40]
sub r15, rdi
jmp 0x180098d50
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x180098c89
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180098c8b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180098cbd
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.1801188c0
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x180098d4d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180098cf8
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x180098d2e
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.1800f2c60
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x180098d4d
cmp rsi, rax
ja 0x180098d01
test rsi, rsi
je 0x180098d4d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1800f2c60
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x48]
mov rax, r15
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret