joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001ba0
Capabilities:
Encode data using xor
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x190
mov rax, qword [0x180018018]
xor rax, rsp
mov qword [rsp + 0x180], rax
movsxd rbp, edx
mov rdi, rcx
lea rdx, [rsp + 0x70]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor ebx, ebx
test eax, eax
je 0x180001d1c
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
lea rcx, [rsp + 0x70]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180001d1c
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x180001cd6
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea r8, [0x180019c50]
lea rdx, [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
movzx ecx, word [0x180019c50]
movzx edx, word [0x180019c56]
movzx r11d, word [0x180019c5a]
movzx eax, word [0x180019c58]
movzx r9d, word [0x180019c52]
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rcx, [0x180019bd0]
lea r8, str._02d__02d__d___02d:_02d
mov edx, 0x80
call fcn.180001780
movzx r11d, word [0x180019c50]
cmp word [0x180019c52], r11w
jbe 0x180001cd6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.1800038c8
int3
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rsi
cmp eax, 0x800
jae 0x180001d01
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or ecx, 0xffffffff
call fcn.1800038c8
int3
cmp dword [rsp + 0x40], ebx
jbe 0x180001d16
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or ecx, 0xffffffff
call fcn.1800038c8
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
jle 0x180001d35
movzx eax, byte [rbx + rdi]
inc rbx
xor al, 0x13
rol al, 3
cmp rbx, rbp
mov byte [rbx + rdi - 1], al
jl 0x180001d20
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.180002890
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800023f0
Capabilities:
Set console window title

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x180018018]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
test eax, eax
je 0x180002466
lea r9, [rsp + 0x20]
lea r8, [0x1800135d8]
lea rcx, [rsp + 0x130]
mov edx, 0x104
call fcn.180001780
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
test eax, eax
jne 0x180002466
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.SetConsoleTitle_failed___d__n
mov edx, eax
call fcn.1800029fc
cmp rbx, 0x64
jle 0x180002478
mov rcx, qword [0x180019a80]
call fcn.1800022a0
cmp dword [0x180019a88], 0
jne 0x180002495
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x180019a88], 0
je 0x180002481
mov eax, 1
mov dword [0x180019a88], 0
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180002890
add rsp, 0x250
pop rbx
ret

Function at 0x1800038c8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.180009264
nop
cmp dword [0x180019e08], 1
je 0x180003874
mov dword [0x180019e04], 1
mov byte [0x180019e00], r12b
test ebx, ebx
jne 0x180003860
mov rcx, qword [0x18001be48]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18000384d
mov rcx, qword [0x18001be40]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x1800037ec
call fcn.180005878
cmp qword [rdi], rax
jne 0x1800037ec
jmp 0x1800037d2
cmp rdi, rsi
jb 0x18000384d
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.180005878
mov qword [rdi], rax
call rbx
mov rcx, qword [0x18001be48]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x18001be40]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x18000382b
cmp r13, rax
je 0x18000384b
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x1800037d2
lea rdx, [0x180013448]
lea rcx, [0x180013430]
call fcn.18000361c
lea rdx, [0x180013458]
lea rcx, [0x180013450]
call fcn.18000361c
nop
test r12d, r12d
je 0x180003883
mov ecx, 8
call fcn.180009164
test r12d, r12d
jne 0x1800038ae
mov dword [0x180019e08], 1
lea ecx, [r12 + 8]
call fcn.180009164
mov ecx, r15d
call fcn.1800035b0
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x18000373c

Function at 0x1800038d4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x18000373c
Function at 0x1800062a7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180018018]
jne 0x1800028aa
rol rcx, 0x10
test cx, 0xffff
jne 0x1800028a6
repz ret
ror rcx, 0x10
jmp 0x180006200
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180019ee0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x180019fd8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180006285
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180019ee0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1800062a7
mov rax, qword [rsp + 0x88]
mov qword [0x180019fd8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180019f78], rax
mov rax, qword [0x180019fd8]
mov qword [0x180019e50], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180019f60], rax
mov dword [0x180019e40], 0xc0000409
mov dword [0x180019e44], 1
mov rax, qword [0x180018018]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180018020]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180019ed8], eax
mov ecx, 1
call fcn.18000c644
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800147a0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180019ed8], 0
jne 0x18000632e
mov ecx, 1
call fcn.18000c644
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x18000c7d0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.180005878
xor ebx, ebx
mov rdi, rax
cmp qword [0x18001aae0], rbx
jne 0x18000c8d6
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x18000c9ab
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000c9ab
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18001aae0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18001aae8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x18001aaf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x18001ab00], rax
test rax, rax
je 0x18000c8cd
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x18001aaf8], rax
jmp 0x18000c8dd
mov rax, qword [0x18001aaf8]
jmp 0x18000c8e4
mov rax, qword [0x18001aaf8]
mov r11, qword [0x18001ab00]
cmp rax, rdi
je 0x18000c94c
cmp r11, rdi
je 0x18000c94c
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x18001ab00]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x18000c94c
test rax, rax
je 0x18000c94c
call rsi
test rax, rax
je 0x18000c946
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18000c946
test byte [rsp + 0x38], 1
jne 0x18000c94c
bts ebp, 0x15
jmp 0x18000c98a
mov rcx, qword [0x18001aae8]
cmp rcx, rdi
je 0x18000c98a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18000c98a
call rax
mov rbx, rax
test rax, rax
je 0x18000c98a
mov rcx, qword [0x18001aaf0]
cmp rcx, rdi
je 0x18000c98a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18000c98a
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18001aae0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18000c9ab
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x18000c9ad
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14002943c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001cb04
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001cb04
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002958c
cmp rax, 0xffffffffffffffff
je 0x14002958c
xor edi, edi
test rbp, rbp
jle 0x140029537
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f430
mov rbx, rax
test rax, rax
jne 0x1400294c4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002952d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a438
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d7e0
cmp eax, 0xffffffff
je 0x14002950d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400294d4
mov edx, r15d
mov ecx, r14d
call fcn.14001a438
jmp 0x14002952d
cmp byte [rsi + 0x38], dil
je 0x140029524
cmp dword [rsi + 0x34], 5
jne 0x140029524
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002952d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b1cc
jmp 0x1400295a0
jns 0x1400295a0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001cb04
cmp rax, 0xffffffffffffffff
jne 0x140029558
cmp byte [rsi + 0x30], dil
je 0x1400295a0
mov edi, dword [rsi + 0x2c]
jmp 0x1400295a0
mov ecx, r14d
call fcn.1400188f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400295a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400295a0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029599
mov eax, dword [rsi + 0x2c]
jmp 0x14002959e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001cb04
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x181f73000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x181f7300a
jmp 0x181f7500f
jmp fcn.1819c4058
Function at 0x140134b18
Capabilities:
Write file on windows

Disassembly:
jmp 0x14020ff50
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1405fbe44]
call fcn.14013b9db
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14020ffa8
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1402100ba
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x140210053
cmp qword [rbp + 0x28], 0
jle 0x140210053
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14020fff1
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.14013b1d9
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x1402100a9
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x1402100a9
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x14013545f
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1401cee60
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1405fb3ff]
call fcn.14013b9db
nop
mov qword [rbp + 8], 0
jmp 0x1401cee9f
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x1401ceef5
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x1401cee94
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140137070
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140191890
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x1405fb2b2]
call fcn.14013b9db
nop
xor eax, eax
test eax, eax
je 0x1401918cb
movsx eax, byte [rbp + 0xf8]
or eax, 0x20
mov dword [rbp + 0xc0], eax
jmp 0x1401918d8
movsx eax, byte [rbp + 0xf8]
mov dword [rbp + 0xc0], eax
mov eax, dword [rbp + 0xc0]
mov ecx, dword [rbp + 0xf0]
xor ecx, eax
mov eax, ecx
imul eax, eax, 0x1000193
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret
Function at 0x140138308
Capabilities:
Terminate process

Disassembly:
jmp 0x14039e7c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140138cb3
Capabilities:
Write file on windows

Disassembly:
jmp 0x140240bb0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1405fc10a]
call fcn.14013b9db
nop
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x140138d4e
Capabilities:
Get geographical location

Disassembly:
jmp 0x140399cb0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x140399ced
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.14013b981
add rsp, 0x58
ret
Function at 0x14013908c
Capabilities:
Read file on windows

Disassembly:
jmp 0x140240b30
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1405fc10a]
call fcn.14013b9db
nop
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1401390be
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x140242a90
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x1405fc10a]
call fcn.14013b9db
nop
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x1403d47e0]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x140242bd6
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x140242b2a
mov dword [rbp + 0x160], 1
jmp 0x140242b34
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x140242bd1
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x140242bab
cmp qword [rbp + 0x198], 2
jb 0x140242bab
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140242bab
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140242bab
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x140242af5
jmp 0x140242c70
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x140242c70
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x140242c47
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140242c47
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140242c47
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x140242bd6
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x14013935c
Capabilities:
Parse pe header

Disassembly:
jmp 0x1403a0360
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1403a0380
xor al, al
jmp 0x1403a0401
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1403a0393
xor al, al
jmp 0x1403a0401
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1403a03bd
xor al, al
jmp 0x1403a0401
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1403a03d1
xor al, al
jmp 0x1403a0401
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1403a03e3
xor al, al
jmp 0x1403a0401
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1403a03ff
xor al, al
jmp 0x1403a0401
mov al, 1
add rsp, 0x38
ret
Function at 0x14013a176
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x140376c40
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x1405fc86a]
call fcn.14013b9db
nop
mov ecx, dword [0x1405cf1ac]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140376d11
movzx eax, byte [0x1405d652c]
test eax, eax
jne 0x140376d0f
mov byte [0x1405d652c], 1
mov rax, qword [rbp + 0xf0]
movzx eax, byte [rax + 0x18]
test eax, eax
jne 0x140376cab
mov dword [rbp + 0xc0], 1
jmp 0x140376cb5
mov dword [rbp + 0xc0], 0
mov rax, qword [rbp + 0xf0]
movzx ecx, byte [rbp + 0xc0]
mov byte [rax + 0x18], cl
mov rax, qword [rbp + 0xf0]
movzx eax, byte [rax + 0x18]
test eax, eax
je 0x140376cf3
mov r8d, 0x80000a8
mov edx, 0xffffffec
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
nop
jmp 0x140376d0f
mov r8d, 0x80800a8
mov edx, 0xffffffec
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
nop
jmp 0x140376d18
mov byte [0x1405d652c], 0
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret
Function at 0x14013b08f
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x140242970
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x1405fc10a]
call fcn.14013b9db
nop
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x1403d47e0]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1402429f0
mov dword [rbp + 0x120], 1
jmp 0x1402429fa
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x140242a43
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x1402429bb
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret