joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005e640
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rcx
mov r14, qword [0x14021e770]
lea rdx, [0x140124e09]
call sub.VCRUNTIME140.dll_strstr
mov rsi, rax
test rax, rax
cmove rsi, rdi
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
movsxd r15, dword [r14 + 0x5c30]
and eax, 0xfffffffc
lea r12d, [rax + r15]
add r12d, 0x18
mov ebp, eax
add ebp, 0x18
mov eax, dword [r14 + 0x5c34]
cmp eax, r12d
jge 0x14005e738
test eax, eax
je 0x14005e6b8
mov r13d, eax
shr r13d, 0x1f
add r13d, eax
sar r13d, 1
add r13d, eax
jmp 0x14005e6be
mov r13d, 8
cmp r13d, r12d
cmovle r13d, r12d
cmp eax, r13d
jge 0x14005e738
movsxd rcx, r13d
inc dword [r14 + 0xf4]
mov rdx, qword [0x14021e780]
call qword [0x1402004d8]
mov rbx, rax
mov rdx, qword [r14 + 0x5c38]
test rdx, rdx
je 0x14005e72a
movsxd r8, dword [r14 + 0x5c30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [r14 + 0x5c38]
test rcx, rcx
je 0x14005e71d
mov rax, qword [0x14021e770]
test rax, rax
je 0x14005e71d
dec dword [rax + 0xf4]
mov rdx, qword [0x14021e780]
call qword [0x1402004e0]
mov qword [r14 + 0x5c38], rbx
mov dword [r14 + 0x5c34], r13d
mov dword [r14 + 0x5c30], r12d
mov rax, qword [r14 + 0x5c38]
mov dword [rax + r15], ebp
mov rax, qword [r14 + 0x5c38]
lea rbx, [rax + r15]
add rbx, 4
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rax + r15 + 4], xmm0
test rdi, rdi
je 0x14005e7d2
lea rax, [rdi - 1]
lea rcx, [rsi + 2]
mov edx, 0xffffffff
lea r8, [0x1401236b0]
mov r10d, 0xffffffff
jmp 0x14005e7b2
mov r9d, r10d
shr r9d, 8
movzx r10d, r10b
xor r10d, r11d
xor r9d, dword [r8 + r10*4]
inc rcx
mov r10d, r9d
add rax, 0xffffffffffffffff
jae 0x14005e847
movzx r11d, byte [rcx - 2]
cmp r11d, 0x23
jne 0x14005e790
cmp rax, 2
jb 0x14005e790
cmp byte [rcx - 1], 0x23
jne 0x14005e790
cmp byte [rcx], 0x23
cmove r10d, edx
jmp 0x14005e790
movzx r8d, byte [rsi]
test r8b, r8b
je 0x14005e841
lea rax, [rsi + 2]
mov ecx, 0xffffffff
lea rdx, [0x1401236b0]
mov r10d, 0xffffffff
jmp 0x14005e824
movzx r8d, r8b
mov r9d, r10d
shr r9d, 8
movzx r10d, r10b
xor r10d, r8d
xor r9d, dword [rdx + r10*4]
inc rax
mov r8d, r11d
mov r10d, r9d
test r11b, r11b
je 0x14005e847
movzx r11d, byte [rax - 1]
cmp r8b, 0x23
jne 0x14005e800
cmp r11b, 0x23
jne 0x14005e800
cmp byte [rax], 0x23
cmove r10d, ecx
mov r11b, 0x23
jmp 0x14005e800
mov r9d, 0xffffffff
not r9d
mov dword [rbx], r9d
lea rcx, [rbx + 0x10]
inc rdi
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140073160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
vmovaps xmmword [rsp + 0x30], xmm7
vmovaps xmmword [rsp + 0x20], xmm6
mov rsi, rdx
movzx eax, word [rsp + 0x88]
movsxd rdx, dword [rcx + 0x18]
cmp rax, rdx
jae 0x140073197
mov rdx, qword [rcx + 0x20]
movzx eax, word [rdx + rax*2]
cmp rax, 0xffff
jne 0x1400731a5
mov rbx, qword [rcx + 0x38]
test rbx, rbx
jne 0x1400731ba
jmp 0x14007330c
lea rbx, [rax + rax*4]
shl rbx, 3
add rbx, qword [rcx + 0x30]
test rbx, rbx
je 0x14007330c
mov eax, dword [rbx]
test al, 2
je 0x14007330c
mov edx, dword [rsp + 0x80]
mov edi, edx
or edi, 0xffffff
test al, 1
cmove edi, edx
vxorps xmm0, xmm0, xmm0
vucomiss xmm2, xmm0
jae 0x1400731ec
vmovss xmm7, dword [0x14011de30]
jmp 0x1400731f1
vdivss xmm7, xmm2, dword [rcx + 0x14]
vmovsd xmm0, qword [r9]
vroundps xmm6, xmm0, 0xb
mov rcx, rsi
mov edx, 6
mov r8d, 4
call fcn.140062010
mov eax, dword [rbx + 0x24]
mov edx, dword [rbx + 0x20]
mov r8d, dword [rbx + 0x1c]
mov ecx, dword [rbx + 0x18]
vmovsldup xmm1, xmm7
vmovsd xmm0, qword [rbx + 8]
vmovsd xmm2, qword [rbx + 0x10]
vmulps xmm0, xmm0, xmm1
vaddps xmm0, xmm0, xmm6
mov r9d, dword [rsi + 0x34]
mov r10, qword [rsi + 0x50]
lea r11d, [r9 + 1]
lea ebx, [r9 + 2]
mov word [r10], r9w
mov r10, qword [rsi + 0x50]
mov word [r10 + 2], r11w
mov r10, qword [rsi + 0x50]
mov word [r10 + 4], bx
mov r10, qword [rsi + 0x50]
mov word [r10 + 6], r9w
add r9d, 3
vmulps xmm1, xmm2, xmm1
vaddps xmm1, xmm1, xmm6
mov r10, qword [rsi + 0x50]
mov word [r10 + 8], bx
mov r10, qword [rsi + 0x50]
mov word [r10 + 0xa], r9w
mov r9, qword [rsi + 0x48]
vmovlps qword [r9], xmm0
mov r9, qword [rsi + 0x48]
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], r8d
mov r9, qword [rsi + 0x48]
mov dword [r9 + 0x10], edi
mov r9, qword [rsi + 0x48]
vmovss dword [r9 + 0x14], xmm1
vextractps dword [r9 + 0x18], xmm0, 1
mov r9, qword [rsi + 0x48]
mov dword [r9 + 0x1c], edx
mov dword [r9 + 0x20], r8d
mov r8, qword [rsi + 0x48]
mov dword [r8 + 0x24], edi
mov r8, qword [rsi + 0x48]
vmovlps qword [r8 + 0x28], xmm1
mov r8, qword [rsi + 0x48]
mov dword [r8 + 0x30], edx
mov dword [r8 + 0x34], eax
mov rdx, qword [rsi + 0x48]
mov dword [rdx + 0x38], edi
mov rdx, qword [rsi + 0x48]
vblendps xmm0, xmm0, xmm1, 2
vmovlps qword [rdx + 0x3c], xmm0
mov rdx, qword [rsi + 0x48]
mov dword [rdx + 0x44], ecx
mov dword [rdx + 0x48], eax
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x4c], edi
add qword [rsi + 0x48], 0x50
add dword [rsi + 0x34], 4
add qword [rsi + 0x50], 0xc
vmovaps xmm6, xmmword [rsp + 0x20]
vmovaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400936f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov r14d, edx
mov edi, edx
sar edi, 0x1f
and edi, edx
dec edi
mov ebp, 0x8000
jmp 0x140093741
call fcn.140093db0
or r15b, bl
and r15b, r12b
xor bl, 1
movzx ecx, r15b
movzx edx, bl
test al, al
cmove edx, ecx
movzx ecx, dl
test ecx, ecx
jne 0x1400937b1
mov rax, r14
test eax, eax
jle 0x1400937b4
lea r14, [rax - 1]
xor ecx, ecx
test r14d, r14d
je 0x14009373d
mov edx, dword [rsi + 0xe88]
and edx, ebp
jne 0x14009373d
add eax, 0xfffffffe
mov r12, qword [rsi + 0x20]
movzx ecx, word [r12 + rax*2]
mov r15b, 1
cmp ecx, 9
je 0x140093781
cmp ecx, 0x20
je 0x140093781
cmp ecx, 0x3000
je 0x140093781
xor r15d, r15d
call fcn.140093db0
mov ebx, eax
mov eax, r14d
movzx ecx, word [r12 + rax*2]
xor r12d, r12d
cmp ecx, 9
je 0x140093720
cmp ecx, 0x20
je 0x140093720
cmp ecx, 0x3000
je 0x140093720
mov r12b, 1
jmp 0x140093720
mov edi, r14d
xor eax, eax
test edi, edi
cmovg eax, edi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400937d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov edi, edx
mov rbx, rcx
mov rax, qword [rcx]
cmp byte [rax + 0x79], 0
mov esi, dword [rcx + 0xc]
je 0x140093895
inc edi
cmp edi, esi
jge 0x140093948
mov r14d, dword [rbx + 0xe88]
jmp 0x140093838
or r15b, al
call fcn.140093db0
movzx ecx, r15b
movzx edx, bpl
test al, al
cmove edx, ecx
cmp dl, 1
jne 0x140093948
inc edi
cmp esi, edi
je 0x140093941
test r14w, r14w
js 0x14009382e
mov r12d, edi
dec r12d
js 0x14009382e
mov r13, qword [rbx + 0x20]
mov eax, edi
movzx ecx, word [r13 + rax*2]
xor r15d, r15d
cmp ecx, 9
je 0x14009386a
cmp ecx, 0x20
je 0x14009386a
cmp ecx, 0x3000
je 0x14009386a
mov r15b, 1
call fcn.140093db0
mov ebp, eax
mov eax, r12d
movzx ecx, word [r13 + rax*2]
mov al, 1
cmp ecx, 9
je 0x140093810
cmp ecx, 0x20
je 0x140093810
cmp ecx, 0x3000
je 0x140093810
xor eax, eax
jmp 0x140093810
lea r14d, [rdi + 1]
cmp esi, r14d
cmovg r14d, esi
mov r15d, 0x8000
jmp 0x1400938d3
call fcn.140093db0
or r12b, bpl
and r12b, r13b
xor bpl, 1
movzx ecx, r12b
movzx edx, bpl
test al, al
cmove edx, ecx
movzx ecx, dl
test ecx, ecx
jne 0x140093948
mov eax, edi
lea edi, [rax + 1]
cmp edi, esi
jge 0x140093945
xor ecx, ecx
test eax, eax
js 0x1400938cf
mov edx, dword [rbx + 0xe88]
and edx, r15d
jne 0x1400938cf
mov r13, qword [rbx + 0x20]
mov eax, eax
movzx ecx, word [r13 + rax*2]
mov r12b, 1
cmp ecx, 9
je 0x140093911
cmp ecx, 0x20
je 0x140093911
cmp ecx, 0x3000
je 0x140093911
xor r12d, r12d
call fcn.140093db0
mov ebp, eax
mov eax, edi
movzx ecx, word [r13 + rax*2]
xor r13d, r13d
cmp ecx, 9
je 0x1400938b0
cmp ecx, 0x20
je 0x1400938b0
cmp ecx, 0x3000
je 0x1400938b0
mov r13b, 1
jmp 0x1400938b0
mov edi, esi
jmp 0x140093948
mov edi, r14d
cmp edi, esi
cmovl esi, edi
mov eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140097e10
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov r8, rdx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea rdx, str.open
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
add rsp, 0x38
ret
Function at 0x1400b1cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov r10, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
mov qword [rcx], r8
mov qword [r10], rax
mov rsi, qword [rcx]
cmp rsi, r9
je 0x1400b1e8e
mov r11, qword [rsp + 0x60]
cmp rax, r11
je 0x1400b1e8e
nop word cs:[rax + rax]
movzx edi, byte [rsi]
test dil, dil
js 0x1400b1d20
inc rsi
mov qword [rcx], rsi
jmp 0x1400b1e60
cmp dil, 0xbf
jbe 0x1400b1ea4
cmp dil, 0xdf
ja 0x1400b1d3c
and edi, 0x1f
mov ebx, 1
mov ebp, edi
jmp 0x1400b1d80
cmp dil, 0xef
ja 0x1400b1d4e
and edi, 0xf
mov ebx, 2
mov ebp, edi
jmp 0x1400b1d80
cmp dil, 0xf7
ja 0x1400b1d60
and edi, 7
mov ebx, 3
mov ebp, edi
jmp 0x1400b1d80
mov ebp, edi
and ebp, 3
xor ebx, ebx
cmp dil, 0xfc
setb bl
xor ebx, 5
nop word cs:[rax + rax]
mov rax, r9
sub rax, rsi
lea edi, [rbx + 1]
cmp rax, rdi
jl 0x1400b1e8e
lea rax, [rsi + 1]
mov qword [rcx], rax
movzx edi, byte [rsi + 1]
mov eax, 2
cmp dil, 0xbf
jg 0x1400b1e96
shl ebp, 6
and edi, 0x3f
or edi, ebp
lea r14, [rsi + 2]
mov qword [rcx], r14
cmp ebx, 2
jb 0x1400b1e60
movzx ebp, byte [r14]
cmp bpl, 0xbf
jg 0x1400b1e96
mov r14d, edi
shl r14d, 6
and ebp, 0x3f
mov edi, ebp
or edi, r14d
lea r14, [rsi + 3]
mov qword [rcx], r14
cmp ebx, 3
jb 0x1400b1e60
movzx ebp, byte [r14]
cmp bpl, 0xbf
jg 0x1400b1e96
mov r14d, edi
shl r14d, 6
and ebp, 0x3f
mov edi, ebp
or edi, r14d
lea r14, [rsi + 4]
mov qword [rcx], r14
cmp ebx, 4
jb 0x1400b1e60
movzx ebp, byte [r14]
cmp bpl, 0xbf
jg 0x1400b1e96
mov r14d, edi
shl r14d, 6
and ebp, 0x3f
mov edi, ebp
or edi, r14d
lea r14, [rsi + 5]
mov qword [rcx], r14
cmp ebx, 5
jb 0x1400b1e60
movzx ebx, byte [r14]
cmp bl, 0xbf
jg 0x1400b1e96
shl edi, 6
and ebx, 0x3f
or edi, ebx
add rsi, 6
jmp 0x1400b1d0b
cmp byte [rdx], 0
jne 0x1400b1e68
mov byte [rdx], 1
cmp edi, 0x10ffff
ja 0x1400b1e9d
mov rax, qword [r10]
lea rsi, [rax + 2]
mov qword [r10], rsi
mov word [rax], di
mov rsi, qword [rcx]
cmp rsi, r9
je 0x1400b1e8e
cmp qword [r10], r11
jne 0x1400b1d00
xor eax, eax
cmp rsi, r8
sete al
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov eax, 2
jmp 0x1400b1e96
inc rsi
mov qword [rcx], rsi
mov eax, 2
jmp 0x1400b1e96
Function at 0x1400b2010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
mov rcx, r8
cmp r8, r9
je 0x1400b219b
mov rax, qword [rsp + 0x48]
mov rcx, r8
test rax, rax
je 0x1400b219b
movzx r10d, byte [rdx]
dec rax
mov rcx, r8
nop dword [rax + rax]
movzx ebx, byte [rcx]
movzx r11d, bl
test r11b, r11b
js 0x1400b2060
lea rsi, [rcx + 1]
jmp 0x1400b2160
cmp bl, 0xc0
jb 0x1400b219b
cmp bl, 0xdf
ja 0x1400b2079
and r11d, 0x1f
mov edi, 1
jmp 0x1400b20b0
cmp bl, 0xef
ja 0x1400b2089
and r11d, 0xf
mov edi, 2
jmp 0x1400b20b0
cmp bl, 0xf7
ja 0x1400b2099
and r11d, 7
mov edi, 3
jmp 0x1400b20b0
and r11d, 3
xor edi, edi
cmp bl, 0xfc
setb dil
xor edi, 5
nop dword [rax]
mov ebx, r11d
mov r11, r9
sub r11, rcx
lea esi, [rdi + 1]
cmp r11, rsi
jl 0x1400b219b
movzx r11d, byte [rcx + 1]
cmp r11b, 0xbf
jg 0x1400b219b
lea esi, [rdi - 1]
add rsi, rcx
add rsi, 2
shl ebx, 6
and r11d, 0x3f
or r11d, ebx
cmp edi, 2
jb 0x1400b2160
movzx ebx, byte [rcx + 2]
cmp bl, 0xbf
jg 0x1400b219b
mov ebp, r11d
shl ebp, 6
and ebx, 0x3f
mov r11d, ebx
or r11d, ebp
cmp edi, 3
jb 0x1400b2160
movzx ebx, byte [rcx + 3]
cmp bl, 0xbf
jg 0x1400b219b
mov ebp, r11d
shl ebp, 6
and ebx, 0x3f
mov r11d, ebx
or r11d, ebp
cmp edi, 4
jb 0x1400b2160
movzx ebx, byte [rcx + 4]
cmp bl, 0xbf
jg 0x1400b219b
mov ebp, r11d
shl ebp, 6
and ebx, 0x3f
mov r11d, ebx
or r11d, ebp
cmp edi, 5
jb 0x1400b2160
movzx edi, byte [rcx + 5]
cmp dil, 0xbf
jg 0x1400b219b
shl r11d, 6
and edi, 0x3f
or r11d, edi
test r10b, r10b
je 0x1400b2170
cmp r11d, 0x10ffff
jbe 0x1400b217f
jmp 0x1400b219b
mov byte [rdx], 1
mov r10b, 1
cmp r11d, 0x10ffff
ja 0x1400b219b
cmp rsi, rcx
je 0x1400b219b
add rax, 0xffffffffffffffff
jae 0x1400b2198
mov rcx, rsi
cmp rsi, r9
jne 0x1400b2040
jmp 0x1400b219b
mov rcx, rsi
sub rcx, r8
cmp rcx, 0x7fffffff
mov eax, 0x7fffffff
cmovl rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400b6570
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov rcx, qword [0x14021d0a8]
test rcx, rcx
je 0x1400b67ff
cmp dword [0x14021d0b0], 0
je 0x1400b67ff
mov edx, 0x13a8
add rdx, qword [rsi + 0x48]
mov qword [rsp + 0x20], 0
lea r8, [0x1402257a8]
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400b67ff
mov eax, dword [0x1402257a8]
cmp eax, 0xffffffff
je 0x1400b67ff
shr rax, 9
lea rdi, [rax*8 + 0x10]
mov ecx, 8
call fcn.1401189c0
mov qword [rbp - 0x38], rax
lea rcx, [rax + 8]
mov qword [rbp - 0x28], rcx
mov qword [rax], rdi
mov qword [rbp - 0x30], rcx
lea rcx, [0x14021d0e0]
call fcn.140021320
lea rcx, [0x14021d0a0]
lea r8, [rbp - 0x38]
mov rdx, rax
call fcn.14001ae10
mov qword [0x1402257b0], rax
test rax, rax
je 0x1400b67ff
mov rcx, qword [0x14021d0a8]
test rcx, rcx
je 0x1400b67ff
cmp dword [0x14021d0b0], 0
je 0x1400b67ff
mov edx, dword [0x1402257a8]
and edx, 0x1ff
imul rdx, rdx, 0x78
add rax, rdx
mov qword [rsp + 0x20], 0
lea r8, [0x1402257b8]
mov r9d, 8
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400b67ff
lea rcx, [0x1402257c0]
lea rdx, [0x1402257b8]
call fcn.14001a190
test al, al
je 0x1400b67ff
cmp byte [0x14021dc30], 0
jne 0x1400b66c9
vmovss xmm0, dword [rsi + 0x104]
vxorps xmm1, xmm1, xmm1
vucomiss xmm0, xmm1
ja 0x1400b67ff
cmp byte [0x14021dc20], 0
je 0x1400b6713
mov rcx, qword [0x14021d0a8]
test rcx, rcx
je 0x1400b6713
cmp dword [0x14021d0b0], 0
je 0x1400b6713
mov edx, 0x2290
add rdx, qword [rsi + 0x48]
mov qword [rsp + 0x20], 0
lea r8, [rbp - 0x20]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rbp - 0x20], 0
je 0x1400b67ff
cmp byte [0x14018e2f9], 0
je 0x1400b6747
mov eax, dword [rsi + 0xf0]
cmp eax, dword [0x1402258b0]
setne al
cmp dword [0x1402258a0], 0
setg cl
and cl, al
mov byte [0x1402258d8], cl
cmp cl, 1
je 0x1400b675b
jmp 0x1400b67ff
cmp dword [0x1402258a0], 0
setg byte [0x1402258d8]
jle 0x1400b67ff
mov eax, dword [0x1402258e8]
mov ecx, dword [0x1402263a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x28]
jg 0x1400b6807
lea rcx, [rbp - 0x10]
call fcn.1400b68b0
movsxd rax, dword [str.ZZ_]
mov rcx, qword [rbp - 0x10]
sub rcx, qword [0x1402258e0]
imul rax, rax, 0xf4240
cmp rcx, rax
jl 0x1400b67ff
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1400b67f4
mov qword [rsp + 0x20], 0
mov ecx, 2
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_mouse_event]
lea rdx, [0x1400b6510]
lea rsi, [rbp - 0x20]
mov rcx, rsi
call fcn.1400b6990
mov rcx, rsi
call fcn.1400b6a40
cmp dword [rbp - 0x18], 0
jne 0x1400b683d
mov rax, qword [rbp - 0x10]
mov qword [0x1402258e0], rax
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1402258e8]
call fcn.140118940
cmp dword [0x1402258e8], 0xffffffff
jne 0x1400b6780
lea rcx, [0x1402258e0]
call fcn.1400b68b0
lea rcx, [0x1402258e8]
call fcn.1401188d4
jmp 0x1400b6780
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
Function at 0x1400b6990
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov ecx, 8
call fcn.1401189c0
mov rbx, rax
mov qword [rax], rdi
lea rdi, [rsi + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
lea r8, [0x1400b6c50]
xor ecx, ecx
xor edx, edx
mov r9, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x1400b69f4
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 8], rbx
mov dword [rdi], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1401102d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov ebx, dword [rcx + 0x14]
mov rsi, rcx
call fcn.140110000
mov rcx, rsi
mov byte [rsp + 0x40], al
call fcn.140110000
mov rdx, qword [rsi]
mov byte [rsp + 0x41], al
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
test al, al
je 0x14011045b
xor eax, eax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r14
cmp ebx, 2
mov qword [rsp + 0x20], r15
lea r14, [rsp + 0x40]
setne al
lea r15, [rsp + 0x40]
add r14, rax
xor rax, 1
add r15, rax
movzx edi, byte [r14]
movzx eax, byte [r15]
shl edi, 8
or edi, eax
lea eax, [rdi - 0xdc00]
cmp eax, 0x3ff
ja 0x140110365
lea rcx, [rsi + 0x18]
mov edx, 0xfffd
call fcn.1401100a0
jmp 0x14011044c
lea eax, [rdi - 0xd800]
mov qword [rsp + 0x48], rbp
cmp eax, 0x3ff
ja 0x140110439
mov rcx, rsi
call fcn.140110000
mov rcx, rsi
mov byte [rsp + 0x40], al
call fcn.140110000
mov rdx, qword [rsi]
mov byte [rsp + 0x41], al
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
lea rbp, [rsi + 0x18]
test al, al
je 0x140110419
nop
movzx eax, byte [r15]
movzx ebx, byte [r14]
shl ebx, 8
or ebx, eax
lea eax, [rbx - 0xdc00]
cmp eax, 0x3ff
jbe 0x140110420
lea rbp, [rsi + 0x18]
mov edx, 0xfffd
mov rcx, rbp
call fcn.1401100a0
lea eax, [rbx - 0xd800]
cmp eax, 0x7ff
ja 0x14011043d
mov rcx, rsi
mov edi, ebx
call fcn.140110000
mov rcx, rsi
mov byte [rsp + 0x40], al
call fcn.140110000
mov rdx, qword [rsi]
mov byte [rsp + 0x41], al
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
test al, al
jne 0x1401103b0
mov edx, 0xfffd
jmp 0x14011043f
and edi, 0x3ff
and ebx, 0x3ff
shl edi, 0xa
or edi, ebx
add edi, 0x10000
jmp 0x14011043d
lea rbp, [rsi + 0x18]
mov edx, edi
mov rcx, rbp
call fcn.1401100a0
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
Function at 0x1401191f4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14011923e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14011923e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14011923e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14011923e
cmp dword [rcx + 0x84], 0xe
jbe 0x14011923e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140119240
xor al, al
add rsp, 0x28
ret

Function at 0x140119db0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140119dea
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140119def
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140119e38
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140131ae0]
cmp byte [rcx + rax], 0
je 0x140119e38
dec r8
sub rdx, 1
jne 0x140119e1e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14001138e
Capabilities:
Terminate process

Disassembly:
jmp 0x140017b90
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011483
Capabilities:
Parse pe header

Disassembly:
jmp 0x140018ee0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140018f00
xor al, al
jmp 0x140018f81
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140018f13
xor al, al
jmp 0x140018f81
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140018f3d
xor al, al
jmp 0x140018f81
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018f51
xor al, al
jmp 0x140018f81
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140018f63
xor al, al
jmp 0x140018f81
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140018f7f
xor al, al
jmp 0x140018f81
mov al, 1
add rsp, 0x38
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140005460]
mov dword [rax], 1
mov rax, qword [0x140005470]
mov dword [rax], 1
mov rax, qword [0x140005480]
mov dword [rax], 1
mov rax, qword [0x140005420]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001a70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140002742
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140009168]
test eax, eax
je 0x1400027da
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140009170]
mov qword [rbp - 8], rax
jmp 0x1400027be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400027b2
cmp qword [rbp - 0x10], 0
je 0x1400027b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002778
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400027db
nop
add rsp, 0x30
pop rbp
ret