joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000c8c0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x38], 0xfffffffffffffffe
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.18000b870
nop
lea rcx, [rsp + 0x40]
call fcn.18000ba20
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x18000c91e
mov dword [rsp + 0x20], 0xffffffff
lea rcx, [rsp + 0x40]
call fcn.18000b970
mov eax, dword [rsp + 0x20]
jmp 0x18000c96b
mov r8, qword [rsp + 0x68]
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jne 0x18000c955
mov dword [rsp + 0x28], 0xffffffff
lea rcx, [rsp + 0x40]
call fcn.18000b970
mov eax, dword [rsp + 0x28]
jmp 0x18000c96b
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x40]
call fcn.18000b970
mov eax, dword [rsp + 0x2c]
add rsp, 0x58
ret

Function at 0x18000c9a0
Capabilities:
Encrypt data using aes via winapi

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rcx, qword [rsp + 0x88]
call fcn.18000ba20
test rax, rax
jne 0x18000c9d4
mov eax, 0xffffffff
jmp 0x18000ca8f
mov r8d, 0x2c
xor edx, edx
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll_memset
mov byte [rsp + 0x40], 8
mov byte [rsp + 0x41], 2
xor eax, eax
mov word [rsp + 0x42], ax
mov dword [rsp + 0x44], 0x660e
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x98]
mov r8d, eax
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x4c]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x88]
call fcn.18000ba20
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x2c
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], 0
cmp dword [rsp + 0x30], 0
jne 0x18000ca8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x34], eax
mov eax, 0xffffffff
jmp 0x18000ca8f
xor eax, eax
add rsp, 0x78
ret

Function at 0x18000ee50
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov ebx, ecx
xor ecx, ecx
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000eeac
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18000eeac
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18000eeac
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18000eeac
cmp dword [rcx + 0x84], 0xe
jbe 0x18000eeac
cmp dword [rcx + 0xf8], 0
je 0x18000eeac
mov ecx, ebx
call fcn.18000ede0
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x18001d090]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.18000ec60
cmp dword [rsp + 0x60], 0
jne 0x18000eeef
mov ecx, ebx
call fcn.18000ed90
int3
add rsp, 0x40
pop rbx
ret
Function at 0x18000f1d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x18001b2c0]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x18000f20c
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.1800132f4
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x18000f2c8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x18000f32e
test ebx, ebx
jne 0x18000f32e
lea ecx, [rax + 2]
call fcn.1800132f4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.1800132d0
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
Function at 0x14000a7f0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [rdx + 0x28]
xor r8d, r8d
test rax, rax
jne 0x14000a805
mov edx, r8d
jmp 0x14000a809
mov rdx, qword [rdx + 0x18]
mov dword [rsp + 0x48], r8d
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], r8
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x48]
add rsp, 0x38
ret

Function at 0x14000b130
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rdx, [rcx + 0x18]
xor edi, edi
mov qword [rsp + 0x28], rdx
lea r8, [0x14000ade0]
mov qword [rcx + 0x20], rdi
mov rbx, rcx
mov r9, rcx
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx + 0x28], rax
mov rbx, qword [rsp + 0x40]
setne dil
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x14000e720
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rbx, r8
mov edi, edx
test r8, r8
je 0x14000e8f0
mov rax, qword [rcx]
call qword [rax]
mov rbp, rax
test edi, edi
je 0x14000e790
cmp edi, 3
je 0x14000e790
sub edi, 1
je 0x14000e77f
cmp edi, 1
jne 0x14000e8f0
movzx edx, bx
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadIconW]
jmp 0x14000e8f2
movzx edx, bx
mov rcx, rbp
call qword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x14000e8f2
movzx edx, bx
mov r8d, 0xa
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x14000e8f0
xor ebx, ebx
mov esi, ebx
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x14000e8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x14000e856
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.14000c230
test rax, rax
je 0x14000e82f
mov rsi, qword [rsp + 0x50]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000e856
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
test rsi, rsi
je 0x14000e8f0
cmp edi, 3
jne 0x14000e8eb
lea r8, [rsp + 0x30]
lea edx, [rdi + 0x1d]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x14000e8dd
mov edx, dword [rsp + 0x38]
test edx, edx
je 0x14000e8dd
lea ecx, [rdx + 1]
and ecx, 0xfffffffe
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8d, [rdi + 0x1e]
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov rdi, rax
test rax, rax
je 0x14000e8dd
mov r8d, 0xff00ff
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
test eax, eax
jns 0x14000e8da
mov rcx, rdi
call qword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x14000e8f2
mov rbx, rdi
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x14000e8f2
mov rax, rsi
jmp 0x14000e8f2
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000e9b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x20
xor esi, esi
mov r14, r9
mov qword [r8 + 0x28], rsi
mov rbx, r8
mov rbp, rdx
test rdx, rdx
jne 0x14000e9e2
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r15
call qword [rax]
movzx edx, bp
mov r8, r14
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x14000ead7
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x14000ead7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14000eace
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov qword [rbx + 0x28], rsi
cmp qword [rbx + 0x20], rdi
jl 0x14000eaac
cmp rdi, 1
jne 0x14000ea6a
movzx ecx, byte [r14]
mov rax, qword [rbx + 0x18]
mov byte [rax], cl
inc qword [rbx + 0x28]
jmp 0x14000eac9
cmp rdi, 2
jne 0x14000ea81
movzx ecx, word [r14]
mov rax, qword [rbx + 0x18]
mov word [rax], cx
add qword [rbx + 0x28], rdi
jmp 0x14000eac9
cmp rdi, 4
jne 0x14000ea96
mov ecx, dword [r14]
mov rax, qword [rbx + 0x18]
mov dword [rax], ecx
add qword [rbx + 0x28], rdi
jmp 0x14000eac9
cmp rdi, 8
jne 0x14000eaac
mov rcx, qword [r14]
mov rax, qword [rbx + 0x18]
mov qword [rax], rcx
add qword [rbx + 0x28], rdi
jmp 0x14000eac9
test eax, eax
je 0x14000eac9
mov rdx, rdi
mov rcx, rbx
call fcn.140010790
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.140016740
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r15, qword [rsp + 0x48]
mov rax, rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
Function at 0x14000f430
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
test rcx, rcx
je 0x14000f56f
cmp word [rcx], 0
je 0x14000f56f
lea rdx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x60], rdx
lea rsi, vtable.CVolObject.0
mov qword [rbp - 0x60], rsi
xor edi, edi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], rdi
lea rax, vtable.CWString.0
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x40]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rdi
lea r14, vtable.CVolMem.0
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], 0x40
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x10], 0xfe
cmp word [rcx], di
je 0x14000f526
cmp word [rcx + 2], di
je 0x14000f526
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rcx + r8*2], 0
jne 0x14000f4e0
cmp word [rcx + r8*2 - 2], 0x5c
jne 0x14000f526
cmp word [rcx + r8*2 - 4], 0x3a
je 0x14000f526
dec r8
mov rdx, rcx
lea rcx, [rbp - 0x60]
call fcn.1400118f0
mov rcx, qword [rbp - 0x48]
test rcx, rcx
jne 0x14000f526
lea rcx, [0x14002dc4c]
cmp qword [rbp - 0x18], 0
cmovne rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rbx, rdi
cmp eax, 0xffffffff
setne bl
lea rax, [rbp - 0x40]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x40], r14
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x14000f556
lea rcx, [rbp - 0x40]
mov r8, qword [rbp - 0x40]
call qword [r8 + 0x18]
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x60], rsi
mov rax, rbx
jmp 0x14000f571
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000f590
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rbx, rdx
test rcx, rcx
je 0x14000f70e
cmp word [rcx], 0
je 0x14000f70e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
mov dword [rbp - 0x60], 0x68
psrldq xmm0, 0xc
movd eax, xmm0
or eax, 1
mov dword [rbp - 0x24], eax
xor edi, edi
mov word [rbp - 0x20], di
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x50], rax
lea rsi, vtable.CVolObject.0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea r14, vtable.CVolMem.0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], 0x40
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.1400108e0
mov rdx, qword [rsp + 0x68]
cmp qword [rsp + 0x78], rdi
cmove rdx, rdi
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000f69e
mov ebx, edi
jmp 0x14000f6d8
mov rcx, qword [rbp - 0x78]
test rbx, rbx
je 0x14000f6b4
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x14000f6bf
mov edx, 0x1f4
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
mov qword [rsp + 0x50], r14
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x14000f6f5
lea rcx, [rsp + 0x50]
mov r8, qword [rsp + 0x50]
call qword [r8 + 0x18]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x50], rsi
mov rax, rbx
jmp 0x14000f710
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000f760
Capabilities:
Accept command line arguments

Disassembly:
push rdi
push r14
sub rsp, 0x28
mov r14, rcx
call fcn.14000b4d0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx edx, word [rax]
test dx, dx
je 0x14000f793
nop
cmp dx, 0x20
ja 0x14000f793
movzx edx, word [rax + 2]
add rax, 2
test dx, dx
jne 0x14000f780
movzx r8d, word [rax]
movzx ecx, r8w
cmp r8w, 0x22
jne 0x14000f7a6
movzx ecx, word [rax + 2]
mov edx, 0x22
lea rdi, [rax + 2]
mov r9d, 0x20
cmovne rdi, rax
cmovne dx, r9w
cmp cx, dx
je 0x14000f7d5
test cx, cx
je 0x14000f7de
movzx ecx, word [rdi + 2]
add rdi, 2
cmp cx, dx
jne 0x14000f7c3
test cx, cx
je 0x14000f7de
add rdi, 2
cmp r8w, 0x22
jne 0x14000f7ef
cmp word [rdi], r9w
jne 0x14000f7ef
add rdi, 2
movzx eax, word [rdi]
test ax, ax
je 0x14000f97e
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
cmp ax, 0x22
jne 0x14000f8c2
movzx eax, word [rdi + 2]
add rdi, 2
mov rsi, rdi
test ax, ax
je 0x14000f843
nop dword [rax]
cmp ax, 0x22
je 0x14000f843
movzx eax, word [rsi + 2]
add rsi, 2
test ax, ax
jne 0x14000f830
mov rbx, rsi
sub rbx, rdi
sar rbx, 1
test rbx, rbx
jle 0x14000f878
mov rax, qword [r14]
add rbx, rbx
mov rcx, r14
lea rdx, [rbx + 2]
call qword [rax]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbp, rax
call fcn.140016740
mov word [rbx + rbp], r15w
jmp 0x14000f87b
mov rbp, r15
mov rbx, qword [r14 + 0x30]
lea rcx, [r14 + 8]
mov rax, qword [rcx + 0x20]
sub rax, rbx
cmp rax, 8
jl 0x14000f89f
mov rax, qword [rcx + 0x18]
mov qword [rbx + rax], rbp
add qword [rcx + 0x28], 8
jmp 0x14000f8ac
lea rdx, [rbx + 8]
call fcn.140010790
mov qword [rax + rbx], rbp
mov rdi, rsi
cmp word [rsi], r15w
je 0x14000f95e
lea rdi, [rsi + 2]
jmp 0x14000f95e
cmp ax, 0x20
jbe 0x14000f95a
mov rsi, rdi
nop
cmp ax, 0x22
je 0x14000f8e9
cmp ax, 0x20
jbe 0x14000f8e9
movzx eax, word [rsi + 2]
add rsi, 2
test ax, ax
jne 0x14000f8d0
mov rbx, rsi
sub rbx, rdi
sar rbx, 1
test rbx, rbx
jle 0x14000f91e
mov rax, qword [r14]
add rbx, rbx
mov rcx, r14
lea rdx, [rbx + 2]
call qword [rax]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbp, rax
call fcn.140016740
mov word [rbx + rbp], r15w
jmp 0x14000f921
mov rbp, r15
mov rbx, qword [r14 + 0x30]
lea rcx, [r14 + 8]
mov rax, qword [rcx + 0x20]
sub rax, rbx
cmp rax, 8
jl 0x14000f948
mov rax, qword [rcx + 0x18]
mov rdi, rsi
mov qword [rbx + rax], rbp
add qword [rcx + 0x28], 8
jmp 0x14000f95e
lea rdx, [rbx + 8]
call fcn.140010790
mov rdi, rsi
mov qword [rax + rbx], rbp
jmp 0x14000f95e
add rdi, 2
movzx eax, word [rdi]
test ax, ax
jne 0x14000f812
mov r15, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, qword [r14 + 0x30]
shr rax, 3
add rsp, 0x28
pop r14
pop rdi
ret
Function at 0x140016e8c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140016d1f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140016d1f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140016d1f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140016d1f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140016d1f
cmp dword [rcx + 0x84], 0xe
jbe 0x140016d1f
cmp dword [rcx + 0xf8], 0
je 0x140016d1f
mov ecx, ebx
call fcn.140016dc0
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140016bb0
cmp dword [rbp + 0x20], 0
je 0x140016d6c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140016d74
int3
xor r8d, r8d
xor edx, edx
jmp 0x140016cb8
Function at 0x1400013f0
Capabilities:
Delete file
Open clipboard
Write clipboard data

Disassembly:
push rsi
sub rsp, 0x20
mov eax, dword [0x1400490b8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
xor edi, edi
xor esi, esi
test al, 1
je 0x140001469
bt eax, 0xe
jb 0x140001469
call fcn.140003510
test rax, rax
mov rbx, rax
je 0x140001463
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140001452
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea ecx, [rsi + 0xd]
mov rdx, rbx
lea edi, [rsi + 1]
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [0x1400490b8]
mov esi, edi
jmp 0x140001469
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [0x1400490b8]
jmp 0x140001469
mov eax, dword [0x1400490b8]
test eax, 0x4002
je 0x1400014d1
bt eax, 0xe
jae 0x140001480
call fcn.140005260
mov rbx, rax
jmp 0x140001488
call fcn.140003d30
mov rbx, rax
test rbx, rbx
je 0x1400014d1
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400014c8
test edi, edi
jne 0x1400014a3
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea rcx, str.Rich_Text_Format
call qword [sym.imp.USER32.dll_RegisterClipboardFormatA]
mov rdx, rbx
mov ecx, eax
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov esi, 1
jmp 0x1400014d1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rax, qword [0x14004c138]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
cmp byte [rax + 0x58], 0
lea rcx, [rax + 0x58]
je 0x140001511
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [0x14004c138]
xor edx, edx
add rcx, 0x58
mov r8d, 0x106
call fcn.14001b8f0
mov rax, qword [0x14004c138]
mov rcx, qword [0x14004c150]
test rcx, rcx
je 0x140001545
test esi, esi
je 0x140001545
mov edx, dword [0x14004c170]
xor r9d, r9d
lea r8d, [r9 + 4]
call qword [sym.imp.USER32.dll_PostMessageA]
mov r11, qword [0x14004c138]
mov dword [r11 + 0x44], 0
jmp 0x14000154c
mov dword [rax + 0x44], 0
mov rax, qword [0x14004c138]
mov dword [rax + 0x54], 1
add rsp, 0x20
pop rsi
ret
Function at 0x140002cc0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
cmp qword [0x14004c110], 0
mov esi, edx
mov rbp, rcx
je 0x140002cf3
mov eax, 1
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
call fcn.140001180
test eax, 0x4003
jne 0x140002d11
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rdi
lea rcx, str.HSTxtCap64.dll
xor edi, edi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov qword [0x14004c110], rax
je 0x140002e4f
lea rdx, str.GetSharedData
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004c110]
lea rdx, str.CaptureConsoleText
mov qword [0x14004c118], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004c118]
test rcx, rcx
mov qword [0x14004c158], rax
je 0x140002e34
test rax, rax
je 0x140002e34
call rcx
test rax, rax
mov qword [0x14004c138], rax
je 0x140002e34
mov ecx, dword [0x14004c160]
test ecx, ecx
je 0x140002dab
cmp dword [rax + 0x10], ecx
jne 0x140002dab
lea ebx, [rdi + 1]
jmp 0x140002e4f
cmp dword [rax + 0x10], ebx
jne 0x140002e34
mov rcx, qword [0x14004c110]
lea rdx, str.InstallTxMsgHook
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004c110]
lea rdx, str.ReleaseTxMsgHook
mov qword [0x14004c120], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004c110]
lea rdx, str.TxSnap_SetSnapMoreMode
mov qword [0x14004c128], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test esi, esi
mov qword [0x14004c150], rbp
sete dil
test esi, esi
mov ebx, 1
mov dword [0x14004c144], edi
mov qword [0x14004c130], rax
je 0x140002e4f
lea rcx, [fcn.140002810]
xor r8d, r8d
xor edx, edx
call fcn.14001c990
jmp 0x140002e4f
mov rcx, qword [0x14004c110]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14004c110], rdi
mov qword [0x14004c138], rdi
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x1400064d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
lea ecx, [rdi + 0x11]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea ecx, [rdi + 0x10]
mov ebx, edi
test ax, 0x8000
mov eax, 0x40
cmovne ebx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140006505
bts ebx, 7
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140006518
or ebx, 0x20
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140006538
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14000653c
bts ebx, 8
mov ecx, dword [0x1400490b8]
and ecx, 0x1e0
cmp ecx, ebx
mov rbx, qword [rsp + 0x30]
sete dil
mov eax, edi
add rsp, 0x20
pop rdi
ret