joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003f410
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
test edx, edx
je 0x18003f446
cmp edx, 1
jne 0x18003f474
xor eax, eax
lea r8, [0x18003f3a0]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
cmp dword [0x18016da78], 0
je 0x18003f474
xor edx, edx
xor ecx, ecx
call fcn.1800389b0
mov rcx, qword [0x18016da70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [0x18016da70], rax
mov dword [0x18016da78], eax
mov eax, 1
add rsp, 0x38
ret

Function at 0x18003ffa0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r8d, dword [0x18016da90]
lea r11, [0x18016da90]
mov r9d, 0x270
cmp r8d, r9d
jne 0x180040005
lea r8, [0x18016da98]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x18003ffc0
mov r8d, dword [0x18016da90]
jmp 0x1800400df
cmp r8d, 0x4e0
jb 0x1800400df
xor r8d, r8d
mov r9d, 0x38c
mov r10d, r8d
nop
mov eax, dword [r10 + r11 + 0x9c4]
mov edx, eax
xor edx, dword [r10 + r11 + 0x9c8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + r11 + 0xff8]
xor ecx, edx
mov dword [r10 + r11 + 4], ecx
add r10, 4
cmp r10, r9
jb 0x180040020
mov eax, dword [r9 + r11 + 0x9c4]
mov edx, eax
xor edx, dword [r9 + r11 + 0x9c8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + r11 - 0x388]
xor ecx, edx
mov dword [r9 + r11 + 4], ecx
add r9, 4
cmp r9, 0x9bc
jb 0x180040060
mov edx, dword [0x18016da94]
xor edx, dword [0x18016ee10]
btr edx, 0x1f
mov dword [0x18016da90], r8d
xor edx, dword [0x18016ee10]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [0x18016e0c4]
mov dword [0x18016e450], ecx
mov eax, r8d
inc r8d
mov ecx, dword [r11 + rax*4 + 4]
mov eax, ecx
shr eax, 0xb
and eax, dword [0x18016ee14]
xor ecx, eax
mov dword [0x18016da90], r8d
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140006008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x140006008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140006008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret

Function at 0x142948de8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x142948df2
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x142948e1b
pop rbp
sub rbp, 0x33
sub rbp, 0x2948de8
sub rsp, 0x20
jmp 0x142948e3a
mov rax, 0x2948de8
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffea152fff
xor byte [rax], dl
inc rax
dec rcx
jne 0x142948e59
jmp 0x142948e70
mov bh, 0x76
invalid
Function at 0x1800023f4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor esi, esi
mov r8, rcx
test rcx, rcx
je 0x1800024a0
cmp qword [rcx], rsi
je 0x180002489
cmp word [rdx + 0x58], si
je 0x1800024a0
movzx r11d, word [rdx + 0x58]
lea r9d, [rsi + 1]
shr r11, 1
movabs r10, 0xcbf29ce484222325
mov rdi, qword [rdx + 0x60]
mov ebx, esi
je 0x180002473
movzx eax, word [rdi + rbx*2]
movzx ecx, word [rdi + rbx*2]
sub ax, 0x41
add cx, 0x20
cmp ax, 0x19
cmova cx, word [rdi + rbx*2]
add rbx, r9
movzx eax, cx
movabs rcx, 0x100000001b3
imul r10, rcx
xor r10, rax
cmp rbx, r11
jb 0x18000243e
cmp r10, qword [r8]
jne 0x1800024a0
mov rax, qword [rdx + 0x30]
mov qword [r8 + 8], rax
mov eax, dword [rdx + 0x40]
mov qword [r8 + 0x10], rax
jmp 0x1800024a3
mov rax, qword [rdx + 0x30]
mov r9d, 1
mov qword [rcx + 8], rax
mov eax, dword [rdx + 0x40]
mov qword [rcx + 0x10], rax
jmp 0x1800024a3
mov r9b, sil
mov rbx, qword [rsp + 8]
mov al, r9b
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x1800024b8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movzx esi, r8w
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x180002548
xor r10d, r10d
lea r11d, [r10 + 1]
cmp byte [r9], r10b
je 0x1800024f0
add r10, r11
cmp byte [r10 + r9], 0
jne 0x1800024e6
xor edi, edi
movabs r8, 0xcbf29ce484222325
test r10, r10
je 0x180002539
mov al, byte [rdi + r9]
mov dl, byte [rdi + r9]
add al, 0x20
movzx ecx, al
sub dl, 0x41
movzx eax, byte [rdi + r9]
cmp dl, 0x19
cmova ecx, eax
add rdi, r11
movsx rax, cl
movabs rcx, 0x100000001b3
imul r8, rcx
xor r8, rax
cmp rdi, r10
jb 0x180002501
cmp r8, qword [rbx]
jne 0x180002548
mov qword [rbx + 0x10], rbp
mov word [rbx + 8], si
jmp 0x18000254b
xor r11b, r11b
mov rbx, qword [rsp + 8]
mov al, r11b
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x180005eac
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rbx, rcx
mov rdx, qword [rax + 0x18]
mov r9, qword [rdx + 0x10]
mov r8, qword [r9 + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r10d, dword [rax + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x180005f39
xor edx, edx
cmp dword [r10 + 0x18], edx
jbe 0x180005f39
mov edi, dword [r10 + 0x20]
lea rax, [rdi + rdx*4]
mov r11d, 0x811c9dc5
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x180005f31
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x180005f12
cmp r11d, 0xb3f819f8
je 0x180005f3e
inc edx
cmp edx, dword [r10 + 0x18]
jb 0x180005ef8
mov r9, qword [r9]
jmp 0x180005ed4
mov rax, qword gs:[0x30]
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov r9d, dword [rcx + rdx*4]
mov edx, 8
mov rcx, qword [rax + 0x60]
add r9, r8
lea r8, [rbx + 0x10]
mov rcx, qword [rcx + 0x30]
call r9
test rax, rax
je 0x180005f87
mov dword [rax], 0x4d474943
mov qword [rax + 8], rbx
add rax, 0x10
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180005f9c
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
test rcx, rcx
je 0x180006122
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea r11, [rcx - 0x10]
cmp dword [r11], 0x4d474943
je 0x180006066
int3
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r10d, dword [rax + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1800060dc
xor ecx, ecx
cmp dword [r10 + 0x18], ecx
jbe 0x1800060dc
mov esi, dword [r10 + 0x20]
lea rax, [rsi + rcx*4]
mov edi, ecx
mov r9d, dword [rax + r8]
mov ebx, 0x811c9dc5
add r9, r8
mov al, byte [r9]
inc r9
test al, al
je 0x1800060d4
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [r9]
inc r9
test al, al
jne 0x1800060b7
cmp ebx, 0x7c76ecf5
je 0x1800060e1
inc ecx
cmp ecx, dword [r10 + 0x18]
jb 0x18000609b
mov rdx, qword [rdx]
jmp 0x180006077
mov rax, qword gs:[0x30]
mov edx, dword [r10 + 0x24]
add rdx, r8
mov rcx, qword [rax + 0x60]
movzx r9d, word [rdx + rdi*2]
mov edx, dword [r10 + 0x1c]
mov rcx, qword [rcx + 0x30]
add rdx, r8
mov eax, dword [rdx + r9*4]
xor edx, edx
add rax, r8
mov r8, r11
call rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004076a0]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x004076b0]
mov dword [rax], 1
mov rax, qword [0x004076c0]
mov dword [rax], 1
mov rax, qword [0x00407690]
mov dword [rax], 1
mov rax, qword [0x00407550]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x00407680]
mov dword [0x0040a008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call dbg._encode_pointer
mov rdx, qword [0x004075e0]
mov qword [rdx], rax
mov rdx, qword [0x004075d0]
mov qword [rdx], rax
mov rax, qword [0x00407640]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x00407500]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x404400
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x0040a074]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x40451a
mov rax, qword [0x0040a078]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x40444e
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x404500
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x404432
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x404552
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x0040a078]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x0040a078]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x404535
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4044f9
sub eax, 0x40
and eax, 0xffffffbf
je 0x4044f9
mov r9, rbp
add r9, qword [0x0040a078]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x404521
add dword [0x0040a074], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x40445b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x0040a078]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x405130
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x405140
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x405150
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x405191
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x405188
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x405193
add rax, 0x28
cmp rax, r9
jne 0x405174
xor eax, eax
repz ret

Function at 0x405240
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x00407550]
cmp word [rbx], 0x5a4d
je 0x405260
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym._ValidateImageBase.part.0
test eax, eax
je 0x405254
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection
Function at 0x4054b0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0040a9c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0040a9a0]
test rbx, rbx
je 0x405504
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4054fb
test rsi, rsi
je 0x4054fb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4054e0
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x0040a9c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x140001ec4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001f0e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001f0e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001f0e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001f0e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001f0e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001f10
xor al, al
add rsp, 0x28
ret
Function at 0x14006f31c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14006f32f
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14006f948
lea rdx, [0x1401230a0]
lea rcx, [rsp + 0x20]
call fcn.14008a248
int3

Function at 0x140079d6c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x14012b670]
xor edx, edx
jmp fcn.14006f31c

Function at 0x14007a73c
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x14012b670]
jmp fcn.14006f31c

Function at 0x140086690
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140086750]
mov r9, qword [r9 + 8]
jmp fcn.1400776d4

Function at 0x140086724
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140086760]
mov r9, qword [r9 + 8]
jmp fcn.1400776d4
Function at 0x14001d95c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r14d, r14d
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rsi, rdx
movsxd rdi, r9d
mov rbp, rcx
test r9d, r9d
jle 0x14001db4d
lea rbx, [r8 + 0x20]
xor r13d, r13d
lea r8d, [r14 + 1]
mov r11d, 0x100
xorps xmm7, xmm7
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x14001d9fe
movsxd r10, dword [rsi + 0x24]
mov r9, qword [rsi + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
mov r8d, 1
movd xmm0, eax
jmp 0x14001da20
movsxd rdx, dword [rsi + 0x1c]
mov rax, qword [rsi + 8]
xorps xmm6, xmmword [0x140046c80]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
mov al, byte [rbp + 0x20]
xor r15d, r15d
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
mov al, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], r15d
jle 0x14001db40
mov rcx, qword [rsp + 0xe0]
mov rax, r13
shl rax, 4
add rcx, 6
xor r12d, r12d
add rcx, rax
mov qword [rsp + 0x60], rcx
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x14001da6e
mov edx, dword [rbx - 0x1c]
add edx, r15d
jmp 0x14001da72
mov edx, dword [rax + r12]
mov rcx, rsi
call fcn.14001d0c8
mov edx, eax
xorps xmm3, xmm3
mov eax, dword [rbp + 0x24]
xorps xmm2, xmm2
mov rcx, rsi
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
mulss xmm3, xmm6
mulss xmm2, xmm6
movss dword [rsp + 0x20], xmm7
call fcn.14001d500
mov rcx, qword [rsp + 0x60]
mov r8d, 1
movzx eax, word [rbp + 0x20]
add r14d, r8d
sub ax, word [rsp + 0xd8]
add r13, r8
add ax, word [rbp + 0x1c]
add r15d, r8d
add ax, word [rsp + 0x50]
add r12, 4
sub ax, r8w
mov word [rcx - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x54]
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x58]
sub ax, r8w
mov word [rcx], ax
add rcx, 0x10
mov qword [rsp + 0x60], rcx
cmp r15d, dword [rbx - 0x10]
jl 0x14001da5d
mov r11d, 0x100
add rbx, 0x28
sub rdi, r8
jne 0x14001d9ac
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov eax, r14d
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001ecac
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140054ac0]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.140008c14
mov rcx, qword [0x1400552f8]
lea rdx, [rbp - 0x18]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp - 0x10]
sub ecx, dword [rbp - 0x18]
movd xmm1, ecx
mov ecx, dword [rbp - 0xc]
sub ecx, dword [rbp - 0x14]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rbp - 0x20]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x20]
xorps xmm1, xmm1
sub rax, qword [0x140055300]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x140055308]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rbp - 0x20]
mov qword [0x140055300], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov ecx, 0x10
mov byte [rdi + 0x128], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, bl
mov byte [rdi + 0x129], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
mov byte [rdi + 0x12b], 0
mov byte [rdi + 0x12a], al
call fcn.140008c14
cmp byte [rax + 0x3a7], 0
lea rbx, [rax + 0x110]
je 0x14001edd5
cvttss2si ecx, dword [rbx]
lea rdx, [rbp - 0x30]
cvttss2si eax, dword [rax + 0x114]
mov dword [rbp - 0x30], ecx
mov rcx, qword [0x1400552f8]
mov dword [rbp - 0x2c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x2c]
mov ecx, dword [rbp - 0x30]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, 0xff7fffff
mov dword [rbx], eax
mov dword [rbx + 4], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x1400552f8]
jne 0x14001ee2a
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14001ee2a
mov rcx, qword [0x1400552f8]
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x14001ee2a
movd xmm0, dword [rbp - 0x28]
movd xmm1, dword [rbp - 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x14001ee38
or eax, 0xffffffff
jmp 0x14001ee3d
call fcn.140008c98
cmp dword [0x140053138], eax
je 0x14001ee50
mov dword [0x140053138], eax
call fcn.14001ee78
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140043020
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x14002b3c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov dword [rsp + 0x34], 0xc0000001
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0x240
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwOpenKey]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x14002b514
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call fcn.140036f8c
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14002b468
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
xor eax, eax
jmp 0x14002b516
mov eax, dword [rsp + 0x30]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x30]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x40]
mov r8d, 1
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwQueryValueKey]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x14002b4d1
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x30], eax
je 0x14002b4eb
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
jmp 0x14002b516
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + rax]
jmp 0x14002b516
xor eax, eax
add rsp, 0x88
ret