joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140105d80
Capabilities:
Hash data via wincrypt

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
add rsp, 0x20
pop rdi
ret

Function at 0x140107950
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14010799c
xor eax, eax
jmp 0x1401079ec
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8002
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1401079e7
xor edx, edx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
xor eax, eax
jmp 0x1401079ec
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x140107a00
Capabilities:
Hash data via wincrypt

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
add rsp, 0x20
pop rdi
ret
Function at 0x140116630
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x1c0], 0
je 0x14011664c
mov rax, qword [rcx]
add rsp, 0x28
jmp qword [rax + 0x178]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x14011bb10
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
xor eax, eax
movzx ecx, word [rcx]
test cx, cx
je 0x14011bb3f
nop dword [rax]
movzx edx, cx
lea r8, [r8 + 2]
add edx, eax
imul eax, edx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
movzx ecx, word [r8]
test cx, cx
jne 0x14011bb20
lea ecx, [rax + rax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret

Function at 0x140121cf0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r8d, r8d
lea rdx, [rsp + 0x68]
mov rcx, rax
call fcn.140123760
test eax, eax
je 0x140121d2e
movzx edx, word [rsp + 0x68]
test dx, dx
je 0x140121d2e
mov rcx, rbx
call fcn.140121e00
mov rax, rbx
add rsp, 0x50
pop rbx
ret
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x20]
cmp ecx, 9
ja 0x140121db3
je 0x140121d9b
test ecx, ecx
je 0x140121d83
sub ecx, 5
je 0x140121d6b
cmp ecx, 1
jne 0x140121db8
lea rdx, str.Itanium
mov rcx, rbx
call fcn.1400104b0
mov rax, rbx
add rsp, 0x50
pop rbx
ret
lea rdx, [0x1403cc918]
mov rcx, rbx
call fcn.1400104b0
mov rax, rbx
add rsp, 0x50
pop rbx
ret
lea rdx, [0x1403cc8e4]
mov rcx, rbx
call fcn.1400104b0
mov rax, rbx
add rsp, 0x50
pop rbx
ret
lea rdx, [0x1403cc8e8]
mov rcx, rbx
call fcn.1400104b0
mov rax, rbx
add rsp, 0x50
pop rbx
ret
cmp ecx, 0xc
je 0x140121ddd
xor eax, eax
mov qword [rbx + 0x18], 7
mov qword [rbx], rax
mov word [rbx], ax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov rax, rbx
add rsp, 0x50
pop rbx
ret
lea rdx, str.ARM64
mov rcx, rbx
call fcn.1400104b0
mov rax, rbx
add rsp, 0x50
pop rbx
ret

Function at 0x140121ee0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x18], 8
mov rdi, rdx
mov rbx, rcx
jb 0x140121eff
mov rcx, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x140121f20
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test rdi, rdi
je 0x140121f5c
mov r8, rsi
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.140121540
cmp qword [rbx + 0x18], 8
jb 0x140121f3f
mov rbx, qword [rbx]
mov rdx, qword [rax + 8]
mov r8d, esi
mov rcx, rbx
mov rdx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rsp + 0x20]
call fcn.1401080a0
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140122570
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x14055f260]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rsi, rax
lea rdx, [0x1403c9588]
lea rcx, [rsp + 0x68]
call fcn.1400104b0
nop
xor ebp, ebp
mov qword [rsp + 0x28], rbp
lea r8d, [rbp + 2]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.14014c3b0
nop
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x68]
call fcn.14000e160
lea rdx, str.IsWow64Process2
lea rcx, [rsp + 0x38]
call fcn.1400104b0
nop
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call fcn.14014c820
mov rdi, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x38]
call fcn.14000e160
test rdi, rdi
je 0x140122664
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call rdi
mov edi, eax
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14012264e
call fcn.14014d530
nop
test edi, edi
je 0x140122674
movzx edx, word [rsp + 0x20]
mov rcx, rbx
call fcn.140121e00
jmp 0x140122711
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140122674
call fcn.14014d530
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor r8d, r8d
lea rdx, [rsp + 0x24]
call fcn.140123760
test eax, eax
je 0x140122698
movzx edx, word [rsp + 0x24]
test dx, dx
jne 0x140122657
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x38]
cmp ecx, 9
ja 0x1401226e1
je 0x1401226d8
test ecx, ecx
je 0x1401226cf
sub ecx, 5
je 0x1401226c6
cmp ecx, 1
jne 0x1401226e6
lea rdx, str.Itanium
jmp 0x140122709
lea rdx, [0x1403cc918]
jmp 0x140122709
lea rdx, [0x1403cc8e4]
jmp 0x140122709
lea rdx, [0x1403cc8e8]
jmp 0x140122709
cmp ecx, 0xc
je 0x140122702
mov qword [rbx], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
mov qword [rbx + 0x20], rbp
mov qword [rbx + 0x28], rbp
jmp 0x140122711
lea rdx, str.ARM64
mov rcx, rbx
call fcn.1400104b0
mov rax, rbx
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14036c0d0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1401231b0
Capabilities:
Get session user name
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x38]
mov rdi, rcx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1401231f4
mov r8d, ebx
lea rcx, str.username
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1401231f4
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret

Function at 0x1401398f0
Capabilities:
Check if file exists

Disassembly:
mov edx, 2
jmp fcn.14013f630

Function at 0x1401399d0
Capabilities:
Check if file exists

Disassembly:
mov edx, 1
jmp fcn.14013f630
Function at 0x14013f630
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14055f260]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov edi, edx
movzx esi, dl
and sil, 1
shr edi, 1
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140010410
nop
and dil, 1
je 0x14013f6e1
lea rcx, [rsp + 0x20]
call fcn.14016bfe0
test al, al
je 0x14013f6e1
nop dword [rax + rax]
mov rbx, qword [rsp + 0x30]
cmp rbx, 1
je 0x14013f6e1
cmp rbx, 3
jne 0x14013f6b1
lea rax, [rsp + 0x20]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x38]
cmp r8, 8
cmovae rax, rdx
cmp word [rax + 2], 0x3a
je 0x14013f6eb
jmp 0x14013f6c5
cmp rbx, 0x31
jne 0x14013f6c5
lea rcx, [rsp + 0x20]
call fcn.14013c260
test al, al
jne 0x14013f6e1
lea rdx, [rbx - 1]
lea rcx, [rsp + 0x20]
call fcn.14010c310
lea rcx, [rsp + 0x20]
call fcn.14016bfe0
test al, al
jne 0x14013f680
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
cmp r8, 8
cmovae rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14013f708
xor dil, dil
jmp 0x14013f710
test al, 0x10
jne 0x14013f710
movzx edi, sil
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x20]
call fcn.14000e160
movzx eax, dil
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14036c0d0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140149690
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x14055f260]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rdi, rcx
mov r8, rdx
lea rdx, [rsp + 0x40]
add rcx, 8
call fcn.140148e40
nop
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp rax, 2
jne 0x14014974a
lea rdx, [0x1403d0640]
lea rcx, [rsp + 0xa0]
call fcn.1400104b0
nop
lea rdx, [0x1403d0644]
lea rcx, [rsp + 0x70]
call fcn.1400104b0
nop
mov r9b, 1
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.14010b250
nop
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x70]
call fcn.14000e160
nop
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0xa0]
call fcn.14000e160
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov byte [rsp + 0x38], 0
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
mov r9, 0xffffffffffffffff
lea rdx, [rsp + 0x20]
mov rcx, qword [rdi + 8]
call fcn.14011ca00
nop
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x40]
call fcn.14000e160
mov rcx, qword [rsp + 0x20]
mov r9, qword [rdi + 0x10]
mov r8d, 1
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
nop
call fcn.14010aa30
mov rcx, qword [rsp + 0x20]
cmp rcx, rax
je 0x14014980b
mov eax, 0xffff
add word [rcx + 0x10], ax
jne 0x140149805
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x140149805
cmp byte [rbx + 0x12], 0
je 0x1401497f8
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, Ordinal_27
mov rcx, rbx
call fcn.14036c454
call fcn.14010aa30
nop
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14036c0d0
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop rdi
ret

Function at 0x14014c060
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [0x140575470]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [0x140575478], rax
add rsp, 0x28
ret
Function at 0x140159300
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
xor edi, edi
mov dword [rsp + 0x38], edi
mov rax, qword [0x140575108]
test rax, rax
jne 0x140159330
call fcn.140120770
mov qword [0x140575108], rax
mov rdx, rax
mov rcx, rsi
call fcn.1401090f0
test rax, rax
jne 0x140159381
call fcn.14010aa30
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 4
mov ecx, Ordinal_27
call fcn.14036c0f8
mov rbx, rax
mov qword [rsp + 0x38], rax
lea rax, [0x1404d41ca]
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov eax, 1
mov word [rbx + 0x10], ax
mov byte [rbx + 0x12], 0
jmp 0x1401593fb
mov rdi, qword [rsi + 0x28]
mov rsi, qword [rsi + 0x20]
cmp rdi, 0xffffffffffffffff
jne 0x1401593bb
test rsi, rsi
je 0x1401593b1
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140159394
call fcn.14010aa30
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
jmp 0x1401593d5
call fcn.14010aa30
mov rbx, rax
jmp 0x1401593fb
call fcn.14010aa30
mov rbx, rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
test rsi, rsi
je 0x1401593fb
mov ecx, Ordinal_27
call fcn.14036c0f8
mov rbx, rax
mov qword [rsp + 0x38], rax
mov qword [rax], rsi
mov qword [rax + 8], rdi
mov eax, 1
mov word [rbx + 0x10], ax
mov byte [rbx + 0x12], 0
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
call fcn.14010aa30
cmp rbx, rax
je 0x14015943e
mov eax, 0xffff
add word [rbx + 0x10], ax
jne 0x140159438
cmp byte [rbx + 0x12], 0
je 0x14015942b
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, Ordinal_27
mov rcx, rbx
call fcn.14036c454
call fcn.14010aa30
nop
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14015c6e0
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
cmp byte [rcx + 0xb8], 0
mov rsi, rcx
jne 0x14015c742
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov byte [rcx + 0xb8], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rsi + 0xa8]
lea r9, [rsi + 0x10]
mov rcx, rax
lea r8, [rsi + 0xb0]
call fcn.140189ae0
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
test eax, eax
jne 0x14015c742
lea rcx, str.SymFromAddr
add rsp, 0x20
pop rsi
jmp fcn.14018b8c0
add rsp, 0x20
pop rsi
ret
Function at 0x14018b8c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x14055f260]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rsi, rcx
call fcn.14010aa30
mov qword [rsp + 0x38], rax
call fcn.14010aa30
mov qword [rsp + 0x40], rax
mov r8, 0xffffffffffffffff
lea rdx, str.dbghelp:__s___failed:__s_r_n
lea rcx, [rsp + 0x48]
call fcn.14010f8e0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140138150
mov rdi, rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], rax
mov edx, 2
lea rcx, [rsp + 0x38]
call fcn.1401448b0
mov ecx, eax
and ecx, 6
lea rbx, str.format_specifier_doesnt_match_argument_type
cmp ecx, eax
je 0x14018b999
cmp qword [0x14055a4b8], 0
je 0x14018b999
mov qword [rsp + 0x20], rbx
lea r9, str._argtype___wxFormatString::Arg_String____argtype
lea r8, str.wxArgNormalizerWchar_class_wxString_const__::wxArgNormalizerWchar
mov edx, 0x230
lea rcx, str.C:ProjectwxWidgets_3.2.2.1includewx_strvararg.h
call fcn.140118ee0
cmp byte [0x1405750a8], 0
je 0x14018b999
mov byte [0x1405750a8], 0
int3
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.1401448b0
mov edx, eax
and edx, 6
cmp edx, eax
je 0x14018b9f0
cmp qword [0x14055a4b8], 0
je 0x14018b9f0
mov qword [rsp + 0x20], rbx
lea r9, str._argtype___wxFormatStringSpecifier_T_::value____argtype
lea r8, str.wxArgNormalizer_wchar_t_const__::wxArgNormalizer
mov edx, 0x1e4
lea rcx, str.C:ProjectwxWidgets_3.2.2.1includewx_strvararg.h
call fcn.140118ee0
cmp byte [0x1405750a8], 0
je 0x14018b9f0
mov byte [0x1405750a8], 0
int3
lea rcx, [rsp + 0x38]
call fcn.140143f20
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.140145820
mov r9, rax
mov r8, rsi
mov rdx, rbx
lea rcx, [rsp + 0x98]
call fcn.140109960
nop
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call fcn.14000e160
lea rcx, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x98]
call fcn.14000e160
nop
lea rcx, [rsp + 0x38]
call fcn.140010cb0
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.14036c0d0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14018ec00
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0xd0
call fcn.1401b29e0
lea rcx, [rbx + 0x170]
call fcn.1401b29e0
lea rcx, [rbx + 0x80]
call fcn.1401b5d30
test al, al
je 0x14018ec48
lea rcx, [rbx + 0x120]
cmp qword [rcx], 0
je 0x14018ec48
add rsp, 0x20
pop rbx
jmp fcn.1401b5d30
add rsp, 0x20
pop rbx
ret
Function at 0x1401905b0
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r15d, edx
mov r14, rcx
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rcx], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], ax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov dword [rsp + 0x30], 1
mov r8d, 0x104
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.140121540
mov rcx, qword [rax + 8]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebp, eax
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
lea rdi, [0x1404d41c8]
mov rcx, rdi
test rdx, rdx
cmovne rcx, rdx
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp word [rcx + r8*2], 0
jne 0x140190650
mov rdx, rcx
mov rcx, qword [rsp + 0x38]
call fcn.14001d300
nop
call fcn.14010aa30
mov r12d, 0xffff
mov rcx, qword [rsp + 0x40]
cmp rcx, rax
je 0x1401906b1
add word [rcx + 0x10], r12w
jne 0x1401906ab
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x1401906ab
cmp byte [rsi + 0x12], 0
je 0x14019069e
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, Ordinal_27
mov rcx, rsi
call fcn.14036c454
call fcn.14010aa30
nop
cmp ebp, 0x80004005
jne 0x14019075d
mov r8d, 0x104
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.140121540
mov rcx, qword [rax + 8]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
nop
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
test rcx, rcx
cmovne rdi, rcx
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140190700
mov r8, rbx
mov rdx, rdi
mov rcx, qword [rsp + 0x38]
call fcn.14001d300
nop
call fcn.14010aa30
mov rcx, qword [rsp + 0x40]
cmp rcx, rax
je 0x14019075d
add word [rcx + 0x10], r12w
jne 0x140190757
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140190757
cmp byte [rbx + 0x12], 0
je 0x14019074a
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, Ordinal_27
mov rcx, rbx
call fcn.14036c454
call fcn.14010aa30
nop
mov rax, r14
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1401b9970
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
cmp dword [0x140575068], 0
je 0x1401b99a7
call sub.KERNEL32.dll_GetCurrentThreadId
cmp eax, dword [0x140575068]
je 0x1401b99a7
xor ecx, ecx
call fcn.140136340
movzx edi, al
jmp 0x1401b99b5
movzx edi, byte [reloc.WS2_32.dll_accept]
mov byte [reloc.WS2_32.dll_accept], 0
mov byte [rsp + 0x50], dil
xor edx, edx
mov rcx, rsi
call fcn.1401b9c30
test al, al
jne 0x1401b99cc
xor bl, bl
jmp 0x1401b9a03
xor eax, eax
cmp qword [rbx + 0x10], rax
jne 0x1401b99d8
mov ebx, eax
jmp 0x1401b99e2
cmp qword [rbx + 0x18], 8
jb 0x1401b99e2
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
cmp dword [0x140575068], 0
je 0x1401b9a24
call sub.KERNEL32.dll_GetCurrentThreadId
cmp eax, dword [0x140575068]
je 0x1401b9a24
movzx ecx, dil
call fcn.140136340
jmp 0x1401b9a2b
mov byte [reloc.WS2_32.dll_accept], dil
movzx eax, bl
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1401c90b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
add rcx, 8
jmp fcn.140172e30

Function at 0x1401cabc0
Capabilities:
Encode data using base64

Disassembly:
push rbx
sub rsp, 0x30
mov r11, rdx
test r8, r8
je 0x1401cace8
xor r10d, r10d
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp r9, 3
jb 0x1401cac60
add r10, 4
test rcx, rcx
je 0x1401cac52
cmp r10, r11
ja 0x1401cad2e
movzx eax, byte [r8]
shr rax, 2
movzx eax, byte [rax + rbx]
mov byte [rcx], al
movzx edx, byte [r8]
movzx eax, byte [r8 + 1]
and edx, 3
shr rax, 4
shl rdx, 4
or rdx, rax
movzx eax, byte [rdx + rbx]
mov byte [rcx + 1], al
movzx edx, byte [r8 + 1]
movzx eax, byte [r8 + 2]
and edx, 0xf
shr rax, 6
shl rdx, 2
or rdx, rax
movzx eax, byte [rdx + rbx]
mov byte [rcx + 2], al
movzx eax, byte [r8 + 2]
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx + 3], al
add rcx, 4
sub r9, 3
add r8, 3
cmp r9, 3
jae 0x1401cabe2
test r9, r9
je 0x1401cacdf
add r10, 4
test rcx, rcx
je 0x1401cacdf
cmp r10, r11
ja 0x1401cad2e
cmp r9, 2
jne 0x1401cac84
movzx edx, byte [r8 + 1]
jmp 0x1401cac86
xor dl, dl
movzx eax, byte [r8]
shr rax, 2
movzx r11d, dl
movzx eax, byte [rax + rbx]
mov byte [rcx], al
mov eax, r11d
movzx edx, byte [r8]
and edx, 3
shr rax, 4
shl rdx, 4
or rdx, rax
movzx eax, byte [rdx + rbx]
mov byte [rcx + 1], al
cmp r9, 2
jne 0x1401cacd7
and r11d, 0xf
mov rax, r10
shl r11d, 2
movzx edx, byte [r11 + rbx]
mov byte [rcx + 2], dl
mov byte [rcx + 3], 0x3d
add rsp, 0x30
pop rbx
ret
mov dl, 0x3d
mov byte [rcx + 2], dl
mov byte [rcx + 3], dl
mov rax, r10
add rsp, 0x30
pop rbx
ret
cmp qword [0x14055a4b8], 0
je 0x1401cad2e
lea rax, str.NULL_input_buffer
mov edx, reloc.WS2_32.dll_send
lea r9, str._src__
mov qword [rsp + 0x20], rax
lea r8, str.wxBase64Encode
lea rcx, str.C:ProjectwxWidgets_3.2.2.1_srccommon_base64.cpp
call fcn.1401190f0
cmp byte [0x1405750a8], 0
je 0x1401cad2e
mov byte [0x1405750a8], 0
int3
mov rax, 0xffffffffffffffff
add rsp, 0x30
pop rbx
ret
Function at 0x1401ecba0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rsi, rcx
and byte [rcx + 0x228], 0xfe
xor edi, edi
lea ecx, [rdi + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
mov r14d, 4
test ax, ax
cmovs edi, r14d
lea ecx, [r14 + 0xd]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1401ecbe9
or edi, 8
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebp, 0x8000
mov ebx, edi
or ebx, 1
and ax, bp
cmove ebx, edi
mov ecx, r14d
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, ebx
or edi, 0x10
and ax, bp
cmove edi, ebx
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, edi
or ebx, 2
and ax, bp
cmove ebx, edi
lea rcx, [rsp + 0xe0]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
jne 0x1401ecc5b
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
mov dword [rsp + 0xe0], ecx
shr eax, 0x10
cwde
mov dword [rsp + 0xe4], eax
mov rdx, qword [rsi + 0x218]
lea rcx, [rsp + 0x30]
call fcn.1401dde50
mov rax, qword [rax]
sub dword [rsp + 0xe0], eax
shr rax, 0x20
sub dword [rsp + 0xe4], eax
mov edx, dword [0x140576928]
lea rcx, [rsp + 0x40]
call fcn.140223b80
nop
mov dword [rsp + 0x20], ebx
mov r9d, dword [rsp + 0xe4]
mov r8d, dword [rsp + 0xe0]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1401f1150
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1401e2b00
nop
lea rax, vtable.wxObject.0
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.140121450
nop
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret