joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140051110
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r14d, r14d
mov r12, r9
mov rax, rdx
lea ebx, [r14 + 1]
mov edi, r14d
mov ebp, r14d
cmp word [rdx], r14w
jne 0x14005114e
xor al, al
jmp 0x14005129a
or edx, 0xffffffff
mov rcx, rax
call fcn.140017380
mov rsi, qword [rsp + 0xb0]
mov r15, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xa0]
mov rcx, rax
mov byte [rsi], r14b
mov byte [r15], r14b
mov qword [rsp + 0x30], rax
mov byte [r12], r14b
mov byte [r13], r14b
call fcn.140019350
lea rcx, [rbx + rax]
call fcn.140017e04
mov rdx, qword [rsp + 0x30]
mov r14, rax
movsxd rax, edi
mov cl, byte [rax + rdx]
cmp cl, 0x2b
je 0x1400511bc
cmp cl, 0x5e
je 0x1400511b7
cmp cl, 0x21
je 0x1400511b7
cmp cl, 0x23
jne 0x1400511e2
cmp cl, 0x2b
jne 0x1400511c2
mov byte [r12], bl
jmp 0x1400511de
cmp cl, 0x5e
jne 0x1400511cd
mov byte [r13], bl
jmp 0x1400511de
cmp cl, 0x21
jne 0x1400511d7
mov byte [r15], bl
jmp 0x1400511de
cmp cl, 0x23
jne 0x1400511de
mov byte [rsi], bl
add edi, ebx
jmp 0x14005119d
mov rsi, qword [rsp + 0x90]
movsxd rax, edi
add edi, ebx
mov cl, byte [rax + rdx]
mov dword [rsp + 0x88], edi
cmp cl, 0x7b
jne 0x140051258
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x88]
mov r8, rdx
mov r9, r14
mov dl, 0x7d
mov qword [rsp + 0x20], rax
call fcn.1400432b0
test eax, eax
jne 0x1400512c6
lea rdi, [0x1400ab890]
mov rcx, qword [rdi]
mov rdx, r14
call fcn.14002e180
test eax, eax
je 0x140051250
lea rax, reloc.WSOCK32.dll_accept
add rdi, 8
add ebp, ebx
cmp rdi, rax
jl 0x14005122f
cmp ebp, 0x62
jne 0x1400512b2
mov cl, byte [r14]
call qword [sym.imp.USER32.dll_VkKeyScanA]
movsx ecx, ax
bt ecx, 9
mov dword [rsi], ecx
jae 0x14005126d
mov byte [r13], bl
bt ecx, 0xa
jae 0x140051276
mov byte [r15], bl
bt ecx, 8
jae 0x140051280
mov byte [r12], bl
mov rcx, qword [rsp + 0x30]
and dword [rsi], 0xff
call fcn.1400185f4
mov rcx, r14
call fcn.1400185f4
mov al, bl
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140000000]
movsxd rax, ebp
cmp byte [rax + rcx + 0xabba0], 0
je 0x1400512ca
xor bl, bl
jmp 0x140051280
mov eax, dword [rcx + rax*4 + 0xabc10]
mov dword [rsi], eax
jmp 0x140051280
Function at 0x1400512e0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x120
mov ebx, edx
mov rdi, rcx
xor edx, edx
mov ecx, ebx
mov bpl, r8b
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp qword [rdi + 0x68], 0
mov esi, eax
je 0x1400513b9
cmp ebx, 0x14
je 0x1400513b9
cmp ebx, 0x90
je 0x1400513b9
cmp ebx, 0x91
je 0x1400513b9
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetKeyboardState]
shl esi, 0x10
mov eax, 0xc0000001
mov r9d, esi
mov r8b, 1
or r9, rax
cmp bpl, r8b
je 0x140051367
mov edx, ebx
mov rcx, rdi
call fcn.140043310
cmp al, r8b
jne 0x14005136c
bts r9, 0x18
mov eax, dword [rdi + 0x60]
test r8b, al
jne 0x14005137f
bt eax, 8
jb 0x14005137f
cmp ebx, 0x12
jne 0x140051395
test al, 8
jne 0x140051395
bt eax, 0xb
jb 0x140051395
bts r9, 0x1d
mov edx, 0x105
jmp 0x14005139a
mov edx, 0x101
mov rcx, qword [rdi + 0x68]
mov r8, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
xor byte [rsp + rbx + 0x20], 0x80
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x1400513ea
mov r8b, 1
cmp bpl, r8b
je 0x1400513d6
mov edx, ebx
mov rcx, rdi
call fcn.140043310
cmp al, r8b
mov r8d, 2
jne 0x1400513dc
mov r8d, 3
xor r9d, r9d
mov dl, sil
mov cl, bl
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rdi
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
jmp fcn.140043740

Function at 0x140051410
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x120
mov ebx, edx
mov rdi, rcx
xor edx, edx
mov ecx, ebx
mov bpl, r8b
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp qword [rdi + 0x68], 0
mov esi, eax
je 0x1400514e2
cmp ebx, 0x14
je 0x1400514e2
cmp ebx, 0x90
je 0x1400514e2
cmp ebx, 0x91
je 0x1400514e2
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetKeyboardState]
or byte [rsp + rbx + 0x20], 0x80
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetKeyboardState]
shl esi, 0x10
mov r9d, esi
or r9, 1
cmp bpl, 1
je 0x1400514a1
mov edx, ebx
mov rcx, rdi
call fcn.140043310
cmp al, 1
jne 0x1400514a6
bts r9, 0x18
mov eax, dword [rdi + 0x60]
test al, 1
jne 0x1400514b8
bt eax, 8
jb 0x1400514b8
cmp ebx, 0x12
jne 0x1400514ce
test al, 8
jne 0x1400514ce
bt eax, 0xb
jb 0x1400514ce
bts r9, 0x1d
mov edx, 0x104
jmp 0x1400514d3
mov edx, 0x100
mov rcx, qword [rdi + 0x68]
mov r8, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14005150f
cmp bpl, 1
je 0x1400514fb
mov edx, ebx
mov rcx, rdi
call fcn.140043310
cmp al, 1
je 0x1400514fb
xor r8d, r8d
jmp 0x140051501
mov r8d, 1
xor r9d, r9d
mov dl, sil
mov cl, bl
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rdi
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
jmp fcn.140043720
Function at 0x140051540
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov bl, r8b
mov edi, edx
mov rsi, rcx
call fcn.140051410
mov r8b, bl
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400512e0
Function at 0x1400519f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x120
bt edx, 9
mov rbx, rcx
jae 0x140051a0f
or dword [rcx + 0x60], 8
bt edx, 0xa
jae 0x140051a19
or dword [rcx + 0x60], 1
bt edx, 8
jae 0x140051a23
or dword [rcx + 0x60], 2
mov eax, dword [rcx + 0x60]
test al, 8
je 0x140051a36
bt eax, 0xb
jae 0x140051a36
xor eax, 8
mov dword [rcx + 0x60], eax
mov eax, dword [rcx + 0x60]
test al, 1
je 0x140051a49
bt eax, 8
jae 0x140051a49
xor eax, 1
mov dword [rcx + 0x60], eax
mov eax, dword [rcx + 0x60]
test al, 2
je 0x140051a5c
bt eax, 9
jae 0x140051a5c
xor eax, 2
mov dword [rcx + 0x60], eax
mov eax, dword [rcx + 0x60]
test al, 0x10
je 0x140051a6f
bt eax, 0xc
jae 0x140051a6f
xor eax, 0x10
mov dword [rcx + 0x60], eax
xor edi, edi
cmp qword [rcx + 0x68], rdi
je 0x140051ae6
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov r11d, dword [rbx + 0x60]
mov eax, r11d
and eax, 0x800
neg eax
sbb al, al
and al, byte [rsp + 0x31]
mov byte [rsp + 0x31], al
mov eax, r11d
and eax, 0x100
neg eax
sbb al, al
and al, byte [rsp + 0x32]
bt r11d, 9
mov byte [rsp + 0x32], al
jb 0x140051ac2
mov eax, dword [rbx + 0x78]
mov byte [rsp + 0x30], dil
mov byte [rsp + rax + 0x20], dil
and r11d, 0x1000
lea rcx, [rsp + 0x20]
neg r11d
sbb al, al
and al, byte [rsp + 0x7b]
mov byte [rsp + 0x7b], al
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x140051be8
mov esi, reloc.WSOCK32.dll_recvfrom
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edi, 0x8000
test di, ax
jne 0x140051b0a
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x140051b1e
bt dword [rbx + 0x60], 0xb
jb 0x140051b1e
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1400512e0
mov esi, reloc.WSOCK32.dll_select
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
jne 0x140051b3d
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x140051b51
bt dword [rbx + 0x60], 8
jb 0x140051b51
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1400512e0
mov ecx, dword [rbx + 0x78]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
jne 0x140051b6d
mov ecx, dword [rbx + 0x78]
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x140051b82
bt dword [rbx + 0x60], 9
jb 0x140051b82
mov edx, dword [rbx + 0x78]
xor r8d, r8d
mov rcx, rbx
call fcn.1400512e0
mov esi, RegisterTypeLib
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
jne 0x140051ba1
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x140051bb5
bt dword [rbx + 0x60], 0xa
jb 0x140051bb5
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1400512e0
mov esi, 0x5b
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
jne 0x140051bd4
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x140051be8
bt dword [rbx + 0x60], 0xc
jb 0x140051be8
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1400512e0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140051c00
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
xor edx, edx
mov edi, r8d
mov rbx, rcx
call fcn.1400519f0
mov edx, dword [rbx + 0x60]
mov rcx, rbx
call fcn.1400517b0
test edi, edi
je 0x140051c3f
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.140051540
sub edi, 1
jne 0x140051c2d
mov edx, dword [rbx + 0x60]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140051580

Function at 0x140051c60
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov ecx, edx
mov bl, r8b
mov esi, edx
call qword [sym.imp.USER32.dll_GetKeyState]
movzx edi, ax
and dil, 1
cmp bl, dil
je 0x140051cd7
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
xor r8d, r8d
mov dl, al
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rbp
call fcn.140043720
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, sil
lea r8d, [r9 + 2]
mov dl, al
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rbp
call fcn.140043740
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov al, dil
add rsp, 0x20
pop rdi
ret

Function at 0x140051d20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rcx, qword [r8]
mov rdi, rdx
mov rsi, r8
mov r12d, dword [rcx + rdx]
lea rax, [rcx + 4]
mov qword [r8], rax
lea eax, [r12 + 1]
movsxd rcx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140017e04
lea ecx, [r12 + r12]
movsxd rbx, ecx
mov rcx, qword [rsi]
mov rbp, rax
lea rdx, [rdi + rcx]
mov r8, rbx
mov rcx, rax
call fcn.140018610
add qword [rsi], rbx
xor eax, eax
cmp r12d, eax
movsxd r11, r12d
mov word [rbp + r11*2], ax
jle 0x140051db3
mov rax, rbp
mov rcx, r12
xor word [rax], r12w
add rax, 2
sub rcx, 1
jne 0x140051da5
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r12
ret
Function at 0x140052ad0
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
cmp r8b, 1
jne 0x140052b03
call fcn.140044b50
test al, al
jne 0x140052b23
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, 1
jmp 0x140052b19
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
add rsp, 0x20
pop rbx
ret

Function at 0x140052ec0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdx, qword [rcx]
mov r8b, 1
mov rdi, rcx
call fcn.140052ad0
xor edx, edx
test ebx, ebx
lea ebx, [rdx + 0x25]
mov ecx, ebx
jns 0x140052f1d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi]
mov r8, rbx
shl eax, 0x10
mov edx, 0x100
mov r9d, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8, rbx
jmp 0x140052f59
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi]
mov edx, 0x100
shl eax, 0x10
mov r8d, reloc.OLEAUT32.dll_SafeArrayRedim
mov r9d, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, reloc.OLEAUT32.dll_SafeArrayRedim
mov rcx, qword [rdi]
shl eax, 0x10
mov edx, 0x101
mov r9d, eax
mov eax, 0xc0000001
or r9, rax
call qword [sym.imp.USER32.dll_PostMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rdi]
xor r8d, r8d
mov rcx, rdi
call fcn.140052ad0
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400550d0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
sub rsp, 0x30
lea rcx, [0x1400bdcd0]
mov r12d, r9d
mov rbp, r8
mov rsi, rdx
call fcn.14003efa0
movsxd rcx, eax
mov rax, qword [0x1400bdd70]
mov rcx, qword [rax + rcx*8]
mov rbx, qword [rcx]
cmp rbp, rsi
jne 0x140055154
cmp qword [rbx + 0x2a8], 0
je 0x1400551c6
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
and qword [rsp + 0x28], 0
mov rcx, qword [rbx + 0x2a8]
mov qword [rsp + 0x20], rsi
mov r8d, dword [rsp + 0x50]
mov r9d, dword [rsp + 0x54]
xor edx, edx
call qword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x1400551e8
lea rcx, [0x1400bdcd0]
mov rdx, rbp
call fcn.14004ed20
cmp eax, 0xffffffff
je 0x1400551c6
movsxd rdi, eax
mov rax, qword [0x1400bdd98]
mov rcx, qword [rax + rdi*8]
mov rdx, qword [rcx]
mov al, byte [rdx + 0xd4]
cmp al, 0xe
je 0x1400551c6
cmp al, 0xf
je 0x1400551c6
cmp al, 0x13
je 0x1400551c6
cmp al, 0x10
je 0x1400551c6
cmp qword [rdx + 0x10], 0
je 0x1400551c6
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r11, qword [0x1400bdd98]
and qword [rsp + 0x28], 0
mov rax, qword [r11 + rdi*8]
mov rcx, qword [rax]
mov rax, qword [rbx]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rax
jmp 0x14005513d
movzx r9d, word [rsp + 0x70]
movzx eax, r12w
mov r8, rbp
shl r9d, 0x10
mov edx, 0x7b
mov rcx, rsi
or r9, rax
call qword [sym.imp.USER32.dll_DefDlgProcW]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x1400587b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x100
lea rcx, [rsp + 0x20]
mov ebx, r9d
mov esi, r8d
mov rdi, rdx
call fcn.14004f4c0
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.14004f3f0
test esi, esi
je 0x140058805
mov rbx, rsi
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0xff
call fcn.14004f480
xor byte [rdi], al
inc rdi
sub rbx, 1
jne 0x1400587e8
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140058b20
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
sub dword [reloc.WSOCK32.dll_accept], 1
jne 0x140058b32
call fcn.14004f690
mov rax, qword [0x1400bd2d8]
pxor xmm0, xmm0
mov ecx, dword [rax]
add rax, 4
mov qword [0x1400bd2d8], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x14009e8d8]
add rsp, 0x28
ret

Function at 0x140058b90
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
sub dword [reloc.WSOCK32.dll_accept], 1
jne 0x140058ba2
call fcn.14004f690
mov rax, qword [0x1400bd2d8]
mov ecx, dword [rax]
add rax, 4
mov qword [0x1400bd2d8], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
add rsp, 0x28
ret

Function at 0x140059a20
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov bl, dl
lea rdx, [rsp + 0x60]
call fcn.1400158f0
lea rcx, [rsp + 0x60]
call fcn.140041e40
xor edi, edi
cmp al, dil
jne 0x140059a4e
xor al, al
jmp 0x140059ab3
lea rcx, [rsp + 0x60]
cmp bl, dil
jne 0x140059a65
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, edi
setne al
jmp 0x140059ab3
call fcn.140018b2c
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rdi
mov word [rsp + rax*2 + 0x62], di
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x30], rax
mov eax, 0x614
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp eax, edi
sete al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x140059ad0
Capabilities:
Copy file
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x480
mov rbx, rdx
lea rdx, [rsp + 0x270]
mov dil, r8b
call fcn.1400158f0
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1400158f0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ebx, ebx
cmp eax, ebx
jne 0x140059b52
cmp dil, bl
je 0x140059b4b
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x270]
call fcn.140018ccc
cmp eax, ebx
je 0x140059b44
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov al, 1
jmp 0x140059bfe
xor al, al
jmp 0x140059bfe
lea rcx, [rsp + 0x270]
call fcn.140041e40
cmp al, bl
je 0x140059b4b
lea rcx, [rsp + 0x60]
call fcn.140041e40
cmp al, bl
je 0x140059c0f
cmp dil, bl
je 0x140059b4b
lea rdx, [0x140098e40]
lea rcx, [rsp + 0x270]
call fcn.1400180f4
lea rcx, [rsp + 0x270]
call fcn.140018b2c
lea rcx, [rsp + 0x60]
mov word [rsp + rax*2 + 0x272], bx
call fcn.140018b2c
lea rcx, [rsp + 0x20]
mov word [rsp + rax*2 + 0x62], bx
lea rax, [rsp + 0x270]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x38], rax
mov eax, 0x614
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 2
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp eax, ebx
sete al
mov rbx, qword [rsp + 0x490]
add rsp, 0x480
pop rdi
ret
lea rcx, [rsp + 0x60]
call fcn.140041a50
cmp al, bl
je 0x140059b4b
lea rcx, [rsp + 0x60]
call fcn.140041e40
cmp al, bl
jmp 0x140059b78

Function at 0x140059c40
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xcd0
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov bpl, bl
call fcn.1400158f0
lea rcx, [rsp + 0x30]
call fcn.140041e40
cmp al, bl
je 0x140059c85
lea rdx, [0x140098e40]
lea rcx, [rsp + 0x30]
call fcn.1400180f4
lea rax, [rsp + 0xac0]
lea r9, [rsp + 0x8b0]
lea r8, [rsp + 0x490]
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.1400198dc
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dil, 1
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140059d46
cmp dil, 1
jne 0x140059d46
test byte [rsp + 0x240], 0x10
jne 0x140059d2c
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x30]
mov bpl, dil
call fcn.140018120
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x30]
call fcn.1400180f4
lea rdx, [rsp + 0x26c]
lea rcx, [rsp + 0x30]
call fcn.1400180f4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x140059d49
lea rdx, [rsp + 0x240]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, ebx
jne 0x140059cd3
mov dil, bl
jmp 0x140059cd3
mov bl, bpl
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0xcd0]
mov al, bl
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14005aa60
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov cl, dl
mov esi, r8d
mov bpl, dl
call qword [sym.imp.USER32.dll_VkKeyScanA]
mov rcx, rbx
movsx edi, ax
cmp edi, 0xffffffff
jne 0x14005aa9a
mov dl, bpl
call fcn.14005a990
jmp 0x14005aad1
mov edx, edi
call fcn.1400519f0
mov edx, dword [rbx + 0x60]
mov rcx, rbx
call fcn.1400517b0
test esi, esi
je 0x14005aac6
movzx edi, dil
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call fcn.140051540
sub esi, 1
jne 0x14005aab4
mov edx, dword [rbx + 0x60]
mov rcx, rbx
call fcn.140051580
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14005af50
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x220
mov rbx, rcx
mov rcx, qword [rcx + 0x88]
mov edx, 0x3e9
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edi, edi
cmp rax, rdi
je 0x14005afe5
lea rdx, [rsp + 0x20]
mov r8d, 0x100
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
test byte [rbx + 0x10], 1
je 0x14005afa4
cmp word [rsp + 0x20], di
jne 0x14005afa4
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
jmp 0x14005afe5
movsd xmm0, qword [rbx + 0x18]
comisd xmm0, xmmword [0x14009e910]
jbe 0x14005afc5
mov rcx, qword [rbx + 0x88]
mov edx, 0x40a
call qword [sym.imp.USER32.dll_KillTimer]
lea rcx, [rbx + 0x48]
lea rdx, [rsp + 0x20]
call fcn.140011cb0
mov rcx, qword [rbx + 0x88]
mov edx, 1
call qword [sym.imp.USER32.dll_EndDialog]
mov rbx, qword [rsp + 0x230]
add rsp, 0x220
pop rdi
ret

Function at 0x14005c1b0
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx]
mov r12, rdx
lea r9, [rax + 0x18]
lea r8, [rax + 0x20]
mov edx, 0xb0
call qword [sym.imp.USER32.dll_SendMessageW]
mov r11d, dword [rsp + 0x50]
cmp dword [rsp + 0x58], r11d
jne 0x14005c1ef
xor al, al
jmp 0x14005c26e
mov rcx, qword [rbp]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
mov rsi, rax
cmp eax, ebx
je 0x14005c1eb
lea ecx, [rax + 0x101]
lea eax, [rbx + 2]
mul rcx
lea rcx, [rbx - 1]
cmovo rax, rcx
mov rcx, rax
call fcn.140017e04
mov rcx, qword [rbp]
lea r8d, [rsi + 1]
lea edx, [rbx + 0xd]
mov r9, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, rbx
je 0x14005c264
cmp dword [rsp + 0x50], esi
je 0x14005c252
mov eax, dword [rsp + 0x50]
mov word [rdi + rax*2], bx
mov eax, dword [rsp + 0x58]
mov rcx, r12
lea rdx, [rdi + rax*2]
call fcn.140011cb0
mov bl, 1
mov rcx, rdi
call fcn.1400185f4
mov al, bl
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret