joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009400
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x140009520
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x140009460
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x140009460
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x140009460
Function at 0x140038940
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x140038975
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x140038950
and r10, 0xf
je 0x1400389a5
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x140038980
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140038999
mov rax, r8
repz ret

Function at 0x1400389b0
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x1400389ed
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x1400389c0
pxor xmm1, xmm1
and r10, 0xf
je 0x140038a23
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x1400389fb
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140038a17
mov rax, r8
repz ret
Function at 0x140089260
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor r14d, r14d
mov ebx, r14d
mov rax, qword [rcx + 0x168]
sub rax, qword [rcx + 0x160]
sar rax, 3
test rax, rax
je 0x1400892d7
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], r14
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0xa0]
call fcn.1400898a0
inc ebx
mov rcx, qword [rdi + 0x168]
sub rcx, qword [rdi + 0x160]
sar rcx, 3
movsxd rax, ebx
cmp rax, rcx
jb 0x1400892a0
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov esi, r14d
mov r9, qword [rdi + 0x168]
mov rdx, qword [rdi + 0x160]
mov r8, rdx
mov rax, r9
sub rax, rdx
sar rax, 3
test rax, rax
je 0x14008934f
mov rbx, r14
nop dword [rax + rax]
mov rax, qword [rdi + 0x160]
mov rcx, qword [rbx + rax]
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
inc esi
lea rbx, [rbx + 8]
mov r9, qword [rdi + 0x168]
mov rdx, qword [rdi + 0x160]
mov r8, rdx
mov rcx, r9
sub rcx, rdx
sar rcx, 3
movsxd rax, esi
cmp rax, rcx
jb 0x140089310
mov ebp, r14d
sub r9, rdx
sar r9, 3
test r9, r9
je 0x1400893a6
mov rsi, r14
mov rbx, qword [rsi + rdx]
test rbx, rbx
je 0x140089380
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.140398020
inc ebp
add rsi, 8
mov rdx, qword [rdi + 0x160]
mov r8, rdx
mov rcx, qword [rdi + 0x168]
sub rcx, rdx
sar rcx, 3
movsxd rax, ebp
cmp rax, rcx
jb 0x140089361
mov qword [rdi + 0x168], rdx
test rdx, rdx
je 0x1400893fe
mov rdx, qword [rdi + 0x170]
sub rdx, r8
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1400893e1
add rdx, 0x27
mov rcx, qword [r8 - 8]
sub r8, rcx
lea rax, [r8 - 8]
cmp rax, 0x1f
ja 0x140089445
mov r8, rcx
mov rcx, r8
call fcn.140398020
mov qword [rdi + 0x160], r14
mov qword [rdi + 0x168], r14
mov qword [rdi + 0x170], r14
lea rcx, [rdi + 0x138]
call fcn.1400897d0
lea rcx, [rdi + 0xf0]
call fcn.140374374
lea rcx, [rdi + 0xa0]
call fcn.1403747e8
lea rcx, [rdi + 0x50]
call fcn.140374374
mov rcx, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
jmp fcn.1403747e8
call fcn.1403a7ee4
int3
Function at 0x140089550
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
mov rax, qword [0x14058f6b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbp, rdx
xor r14d, r14d
mov rdi, qword [0x1405b87a8]
test rdi, rdi
jne 0x14008968c
lea rsi, [0x1405b89b8]
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], r14d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rdi, qword [0x1405b87a8]
test rdi, rdi
jne 0x140089683
mov ecx, 0x178
call fcn.1403982c8
mov rdi, rax
mov qword [rsp + 0x50], rax
xor edx, edx
mov r8d, 0x178
mov rcx, rax
call fcn.14039b120
lea edx, [r14 + 2]
mov rcx, rdi
call fcn.1403747fc
nop
lea rcx, [rdi + 0x50]
call fcn.140374384
nop
mov dword [rdi + 0x98], r14d
mov dword [rdi + 0x9c], 2
lea rbx, [rdi + 0xa0]
mov qword [rsp + 0x30], rbx
lea edx, [r14 + 2]
mov rcx, rbx
call fcn.1403747fc
nop
lea rcx, [rbx + 0x50]
call fcn.140374384
nop
add rbx, 0x98
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x20], r14
lea ecx, [r14 + 0x10]
call fcn.1403982c8
mov qword [rax + 8], r14
mov qword [rbx], rax
mov qword [rax], rbx
mov qword [rdi + 0x160], r14
mov qword [rdi + 0x168], r14
mov qword [rdi + 0x170], r14
mov qword [0x1405b87a8], rdi
lea rcx, [0x1400899d0]
call fcn.140089060
mov rdi, qword [0x1405b87a8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rax, [0x140095b20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbp
lea rdx, [rsp + 0x30]
lea rcx, [rdi + 0xa0]
call fcn.1400898a0
mov eax, dword [rdi + 0x98]
cmp eax, dword [rdi + 0x9c]
jge 0x140089792
lea rcx, [rdi + 0xa0]
call fcn.14037482c
test eax, eax
jne 0x1400897ba
mov rbx, qword [rdi + 0x158]
lea rcx, [rdi + 0xa0]
call fcn.140374850
test rbx, rbx
je 0x140089792
lock inc dword [rdi + 0x98]
mov ecx, reloc.WS2_32.dll_recv
call fcn.1403982c8
mov rbx, rax
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1403982c8
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, vtable.mmRunnableMemberFunction0_class_ThreadPool_.0
mov qword [rax], rcx
mov qword [rax + 8], rdi
lea rcx, [0x140089450]
mov qword [rax + 0x10], rcx
lea rcx, [rbx + 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140089230]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx], rax
mov qword [rsp + 0x50], rbx
lea rcx, [rdi + 0x160]
mov rdx, qword [rdi + 0x168]
cmp rdx, qword [rdi + 0x170]
je 0x140089788
mov qword [rdx], rbx
add qword [rcx + 8], 8
jmp 0x140089792
lea r8, [rsp + 0x50]
call fcn.140089a10
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140398000
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov ecx, eax
call fcn.140374520
int3
Function at 0x140092090
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
cmp dword [rcx + 0x48], 0
mov esi, edx
mov rbx, rcx
jne 0x1400920c4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, esi
mov rcx, rbx
add eax, esi
mov dword [rbx + 0x48], eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.140092140
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [rbx + 0x48], eax
jae 0x1400920e3
xor edx, edx
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.140092140
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea edi, [rsi + rax]
cmp edi, dword [rbx + 0x48]
jae 0x140092122
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rbx + 0x48]
sub ecx, eax
cmp ecx, 0x64
jbe 0x140092122
mov rcx, qword [rbx + 0x40]
mov edx, 0x458
call qword [sym.imp.USER32.dll_KillTimer]
mov edx, esi
mov dword [rbx + 0x48], edi
mov rcx, rbx
call fcn.140092140
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x140092360
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r14, rcx
mov edx, 0x458
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_KillTimer]
mov dword [r14 + 0x48], 0
lea r13, [r14 + 0x18]
mov qword [rsp + 0x20], r13
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
movabs r13, 0x6666666666666667
nop dword [rax + rax]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r15d, eax
mov rsi, qword [r14]
mov rdx, qword [r14 + 8]
cmp rsi, rdx
je 0x1400924b4
lea rbp, [rsi + 0x28]
nop
mov ecx, dword [rsi]
cmp ecx, r15d
ja 0x14009244e
mov rax, qword [0x1405a2990]
test rax, rax
jne 0x140092425
mov ecx, 0x110
call fcn.1403982c8
mov rdi, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x110
mov rcx, rax
call fcn.14039b120
mov rcx, rdi
call fcn.14008db90
nop
mov qword [0x1405a2990], rax
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.14008f0e0
mov r8, qword [r14 + 8]
sub r8, rbp
mov rdx, rbp
mov rcx, rsi
call fcn.14039b2e0
add qword [r14 + 8], 0xffffffffffffffd8
mov rdx, qword [r14 + 8]
jmp 0x1400924a8
mov eax, ecx
sub eax, r15d
cmp eax, 0x1499700
jbe 0x140092493
mov rax, qword [0x1405a2990]
test rax, rax
jne 0x140092425
mov ecx, 0x110
call fcn.1403982c8
mov rdi, rax
mov qword [rsp + 0x38], rax
xor edx, edx
mov r8d, 0x110
mov rcx, rax
call fcn.14039b120
mov rcx, rdi
call fcn.14008db90
nop
jmp 0x14009241e
test ebx, ebx
jne 0x14009249b
mov ebx, ecx
jmp 0x1400924a0
cmp ecx, ebx
cmovb ebx, ecx
add rsi, 0x28
add rbp, 0x28
cmp rsi, rdx
jne 0x1400923e0
mov rsi, qword [r14]
sub rdx, rsi
mov rax, r13
imul rdx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1400924fd
test ebx, ebx
je 0x1400924fd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub ebx, eax
mov edx, 0x64
cmp ebx, edx
cmova edx, ebx
mov rcx, r14
call fcn.140092090
inc r12d
mov dword [rsp + 0x28], r12d
cmp r12d, 1
jl 0x1400923c0
mov rcx, qword [rsp + 0x20]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140094740
Capabilities:
Clear file content
Get file size
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x30
mov esi, dword [rdx + 8]
mov rbp, qword [rdx]
call fcn.140124930
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140094768
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x50], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor ebx, ebx
cmp qword [rsp + 0x58], rbx
jle 0x1400947d7
lea rdx, [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rdi
cmp qword [rsp + 0x68], rbx
jge 0x1400947b9
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400947d7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x1400947d7
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400947d1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 1
je 0x1400947d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], ebx
test rdi, rdi
je 0x140094803
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rbx
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140094803
mov ebx, dword [rsp + 0x60]
jmp 0x140094809
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x14009dd08
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
lea ecx, [rdi + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
lea ecx, [rdi + 8]
mov ebx, edi
test ax, ax
cmovs ebx, ecx
lea ecx, [rdi + 2]
call qword [sym.imp.USER32.dll_GetKeyState]
lea ecx, [rdi + 1]
test ax, ax
jns 0x14009dd3b
or ebx, ecx
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14009dd49
or ebx, 2
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14009dd5c
or ebx, 4
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14009dd6f
or ebx, 0x20
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b2038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rdx, rcx
jmp 0x1400b2040
movabs rcx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [r8 + rdx]
movabs r9, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, r9
cmp r8, 8
jb 0x1400b204d
mov rax, rcx
ret

Function at 0x1400b57b0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x14058f6b8]
xor rax, rsp
mov qword [rsp + 0x140], rax
and qword [rcx + 8], 0
lea rax, vtable.DuiLib::CTxtWinHost.0
mov qword [rcx], rax
mov rbx, rcx
mov word [rcx + 0x18a], 1
mov byte [rcx + 0x18c], 0
add rcx, 0x190
call fcn.14009bfa4
lea rcx, [rbx + 0x1a0]
call fcn.14009bfa4
lea rcx, [rbx + 0x1b0]
call fcn.14009bfa4
lea rcx, [rbx + 0x10]
mov byte [rbx + 0x1c0], 1
xor edx, edx
mov r8d, 0x1b8
call fcn.14039b120
or dword [rbx + 0x184], 0xffffffff
lea rcx, [rsp + 0x20]
xor edx, edx
mov dword [rbx + 0x2c], 0x7fff
mov r8d, 0x114
mov byte [rbx + 0x18a], 1
call fcn.14039b120
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1400b5875
cmp dword [rsp + 0x24], 5
seta cl
mov byte [rbx + 0x18b], cl
mov byte [rbx + 0x1c0], 1
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140398000
add rsp, 0x150
pop rbx
ret

Function at 0x1400b7474
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor r14d, r14d
mov rbp, r9
mov rdi, r8
mov esi, edx
mov rbx, rcx
cmp qword [rcx + 0xc00], r14
je 0x1400b752d
cmp edx, 0x100
jne 0x1400b7504
cmp di, 0xd
jne 0x1400b7504
call fcn.1400b6dd4
test al, al
jne 0x1400b7504
cmp byte [rcx + 0xc0a], r14b
je 0x1400b74e0
lea ecx, [r14 + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400b7504
cmp byte [rbx + 0xc0b], r14b
jne 0x1400b7504
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x1400b7500
xor r9d, r9d
mov qword [rsp + 0x20], r14
lea r8, str.return
mov rdx, rbx
call fcn.1400a2b70
xor eax, eax
jmp 0x1400b7532
mov rax, qword [rbx + 0xc00]
mov r9, rbp
mov r8, rdi
mov edx, esi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx]
mov r10, qword [rax + 0x18]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call r10
jmp 0x1400b7532
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400b9a60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1403982c8
mov rdi, rax
mov qword [rsp + 0x40], rax
lea rax, vtable.DuiLib::ResLoaderZip.0
mov qword [rdi], rax
lea r8, [0x140514b30]
mov edx, 0x69
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x1400b9b07
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x1400b9afd
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x1400b9afd
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rdi + 0x10], rbx
mov r8d, 3
mov edx, esi
mov rcx, rax
call fcn.1400e04c8
mov qword [rdi + 8], rax
jmp 0x1400b9b07
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
nop
mov qword [0x1405a29d8], rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400c4e14
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x10]
mov rbx, rcx
mov r10d, eax
mov ecx, eax
and r10d, 7
je 0x1400c4e4d
cmp eax, r10d
jge 0x1400c4e3f
mov rcx, rbx
call fcn.1400c4764
mov eax, dword [rbx + 0x10]
mov ecx, r10d
shr dword [rbx + 0x14], cl
sub eax, r10d
mov dword [rbx + 0x10], eax
mov ecx, eax
xor edx, edx
test eax, eax
jle 0x1400c4e79
mov r8d, dword [rbx + 0x14]
lea r9, [rsp + 0x30]
mov al, byte [rbx + 0x14]
inc edx
shr r8d, 8
sub ecx, 8
mov byte [r9], al
inc r9
mov dword [rbx + 0x14], r8d
test ecx, ecx
jg 0x1400c4e5c
mov dword [rbx + 0x10], ecx
movsxd rcx, edx
jmp 0x1400c4e9a
mov rax, qword [rbx]
cmp rax, qword [rbx + 8]
jb 0x1400c4e8b
xor dl, dl
jmp 0x1400c4e93
mov dl, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x1400c4e7e
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
je 0x1400c4ed4
call fcn.140076000
jmp 0x1400c4f18
mov rcx, qword [rbx]
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
ja 0x1400c4ecd
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x1400c4efd
mov rcx, rbx
call fcn.1400c486c
test eax, eax
je 0x1400c4f18
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.14039b2e0
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400de498
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, ecx
test rdx, rdx
jne 0x1400de4a9
xor eax, eax
jmp 0x1400de515
lea rbx, [0x1404d5410]
not r9d
cmp r8d, 8
jb 0x1400de4ed
mov r10d, r8d
shr r10, 3
mov r11d, 8
movzx ecx, byte [rdx]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc rdx
xor r9d, dword [rbx + rax*4]
sub r11, 1
jne 0x1400de4c6
add r8d, 0xfffffff8
sub r10, 1
jne 0x1400de4c0
test r8d, r8d
je 0x1400de50f
movzx ecx, byte [rdx]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc rdx
xor r9d, dword [rbx + rax*4]
add r8d, 0xffffffff
jne 0x1400de4f2
not r9d
mov eax, r9d
mov rbx, qword [rsp + 8]
ret

Function at 0x1400def58
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
imul r8d, edx
mov rdi, r9
cmp byte [r9], 0
mov rsi, rdx
mov r10, rcx
je 0x1400def9f
and qword [rax - 0x18], 0
lea r9, [rax + 0x10]
mov rdx, rcx
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400def99
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
jmp 0x1400defcb
mov edx, dword [r9 + 0x24]
mov ecx, dword [r9 + 0x20]
sub ecx, edx
lea eax, [rdx + r8]
cmp eax, dword [r9 + 0x20]
cmovbe ecx, r8d
add rdx, qword [r9 + 0x18]
mov ebx, ecx
mov r8d, ecx
mov rcx, r10
call fcn.14039b2e0
add dword [rdi + 0x24], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400dff2c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx], 0
mov ebp, r9d
mov r14d, r8d
mov rsi, rdx
mov rdi, rcx
jne 0x1400dffc4
cmp dword [rcx + 8], 0xffffffff
jne 0x1400dffc4
lea rbx, [rcx + 0x13c]
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [0x1405138a4]
mov rcx, rbx
call fcn.1403b4994
cmp ebp, 1
jne 0x1400dff93
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, ebp
je 0x1400dff93
mov eax, 0x2000000
jmp 0x1400dffc9
lea r9, [rsp + 0x40]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.1400dece8
test rax, rax
jne 0x1400dffb1
mov eax, dword [rsp + 0x40]
jmp 0x1400dffc9
mov rcx, rax
call fcn.1400df2e4
mov qword [rdi], rax
mov eax, dword [0x1405b5b80]
jmp 0x1400dffc9
mov eax, 0x1000000
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400e1294
Capabilities:
Get graphical window text

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rdi
mov rax, qword [0x14058f6b8]
xor rax, rbp
mov qword [rbp], rax
cmp byte [rcx + 0x38], 0
mov rbx, rcx
je 0x1400e1353
cmp qword [rcx + 0x28], 0
je 0x1400e1353
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea r8d, [rax + 1]
movsxd rax, r8d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400e12f4
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140398e10
sub rsp, rcx
lea rdi, [rsp + 0x30]
test rdi, rdi
je 0x1400e1353
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
add rcx, 0x4c0
call fcn.14009c660
mov rcx, qword [rbx + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x48]
and qword [rsp + 0x20], 0
lea r8, str.textchanged
mov rdx, qword [rbx + 0x28]
mov rcx, rax
xor r9d, r9d
call fcn.1400a2b70
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.140398000
mov rbx, qword [rbp + 0x20]
mov rdi, qword [rbp + 0x28]
lea rsp, [rbp + 0x10]
pop rbp
ret