joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140055a30
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r14
mov rbp, rsp
sub rsp, 0x70
cmp dword [rdx + 0xe4], 4
mov esi, dword [rcx + 0x90]
mov r14b, r9b
mov r13b, r8b
mov r12, rdx
mov rbx, rcx
jne 0x140055a68
bts esi, 0x17
mov eax, dword [rdx + 0xe0]
mov r10, qword [rdx + 0x60]
and qword [rsp + 0x38], 0
mov r9, qword [rdx + 0x40]
movzx r8d, word [rdx + 0xe8]
and dword [rsp + 0x30], 0
mov rdx, qword [rdx + 0x20]
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r10
call qword [sym.imp.WININET.dll_InternetConnectW]
mov qword [rbx], rax
test rax, rax
jne 0x140055ac1
lea edx, [rax + 0xb]
xor r9d, r9d
mov r8d, 0xdeadbeef
mov rcx, rbx
call fcn.14004bbc0
jmp 0x140055bfd
and qword [rsp + 0x38], 0
mov r8, qword [r12 + 0xc0]
mov dword [rsp + 0x30], esi
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov rcx, rax
call qword [sym.imp.WININET.dll_HttpOpenRequestW]
mov rcx, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov qword [rbp - 0x28], rcx
mov rdi, rax
mov qword [rbp - 0x30], rax
test rax, rax
jne 0x140055b0c
lea edx, [rax + 0xc]
jmp 0x140055bdf
test r13b, r13b
je 0x140055b1f
mov r8, r12
mov rdx, rax
mov rcx, rbx
call fcn.14004be00
bt esi, 0xc
jae 0x140055b5e
mov r12d, 4
lea r9, [rbp + 0x38]
lea r8, [rbp + 0x30]
lea esi, [r12 + 0x1b]
mov rcx, rdi
mov dword [rbp + 0x38], r12d
mov edx, esi
call qword [sym.imp.WININET.dll_InternetQueryOptionW]
bts dword [rbp + 0x30], 8
lea r8, [rbp + 0x30]
mov r9d, r12d
mov edx, esi
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetSetOptionW]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x140055bda
mov rcx, rdi
call fcn.140038da0
cmp eax, 0xc8
jne 0x140055bda
and dword [rbp + 0x30], 0
lea rax, [rbp + 0x30]
lea r9, [rbp + 0x38]
lea r8, [rbp - 0x20]
mov edx, 5
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x38], reloc.OLEAUT32.dll_RegisterActiveObject
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
lea rcx, [rbp - 0x20]
call fcn.140015924
mov rcx, rbx
mov qword [rbx + 0x18], rax
test r14b, r14b
je 0x140055bd0
mov rdx, rdi
call fcn.14004bdf0
jmp 0x140055bf0
xor r8d, r8d
mov r9b, 1
xor edx, edx
jmp 0x140055beb
mov edx, reloc.WSOCK32.dll_listen
mov rcx, rbx
mov r8d, 0xdeadbeef
xor r9d, r9d
call fcn.14004bbc0
lea rcx, [rbp - 0x30]
mov bl, al
call fcn.140038cf0
mov al, bl
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x140056100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x100
mov rdi, rcx
lea rcx, [rsp + 0x20]
mov ebx, r8d
mov esi, edx
call fcn.14004c6d0
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.14004c600
test esi, esi
je 0x14005614a
mov ebx, esi
lea rcx, [rsp + 0x20]
call fcn.14004c690
xor byte [rdi], al
inc rdi
dec rbx
jne 0x140056136
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140056440
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
dec dword [reloc.WSOCK32.dll_accept]
jne 0x140056451
call fcn.14004c8a0
mov rax, qword [0x1400c39f0]
pxor xmm0, xmm0
mov ecx, dword [rax]
add rax, 4
mov qword [0x1400c39f0], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x1400a1a08]
add rsp, 0x28
ret

Function at 0x1400564b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
dec dword [reloc.WSOCK32.dll_accept]
jne 0x1400564c1
call fcn.14004c8a0
mov rax, qword [0x1400c39f0]
mov ecx, dword [rax]
add rax, 4
mov qword [0x1400c39f0], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
add rsp, 0x28
ret

Function at 0x140056880
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x58], 0
mov rdi, rcx
je 0x1400568e8
mov eax, dword [rcx + 0x60]
mov ebp, 0x1f6
xchg dword [rcx + 0x60], eax
cmp eax, ebp
je 0x1400568e8
add rcx, 0x28
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x58]
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rdi + 0x58]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [rdi + 0x58]
call fcn.140039c80
xchg dword [rdi + 0x60], ebp
lea rcx, [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140056900
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x58], 0
mov rbx, rcx
jne 0x140056937
lea rax, [rsp + 0x40]
mov r9, rcx
lea r8, [0x140056820]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x58], rax
add rsp, 0x30
pop rbx
ret
Function at 0x140056e30
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov esi, edx
mov edi, ecx
lea rdx, str.SeShutdownPrivilege
lea rcx, [rsp + 0x30]
call fcn.14004da30
lea rcx, [rsp + 0x30]
call fcn.14003f2a0
xor ebx, ebx
test al, al
je 0x140056ebf
cmp edi, 0x20
je 0x140056eae
cmp edi, 0x40
je 0x140056eb3
test dil, 0xb
jne 0x140056e80
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x140056ebd
test dil, 0x14
mov r9d, ebx
mov eax, 1
cmovne r9d, eax
test dil, 2
mov dword [rsp + 0x28], esi
cmovne ebx, eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
jmp 0x140056ebd
mov ebx, 1
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetSystemPowerState]
mov ebx, eax
lea rcx, [rsp + 0x30]
call fcn.140050af0
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x140056ee0
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov bl, dl
lea rdx, [rsp + 0x60]
call fcn.1400135c0
lea rcx, [rsp + 0x60]
call fcn.14003b270
xor edi, edi
test al, al
je 0x140056f7a
lea rcx, [rsp + 0x60]
test bl, bl
jne 0x140056f2c
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x140056f7a
call fcn.140014cc4
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rdi
mov word [rsp + rax*2 + 0x62], di
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x30], rax
mov eax, 0x614
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140056f90
Capabilities:
Copy file
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rbx, rdx
lea rdx, [rbp + 0x170]
mov dil, r8b
call fcn.1400135c0
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1400135c0
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ebx, ebx
test eax, eax
jne 0x14005701b
test dil, dil
je 0x140057014
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x170]
call fcn.1400158dc
test eax, eax
je 0x14005700d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov al, 1
jmp 0x1400570c3
xor al, al
jmp 0x1400570c3
lea rcx, [rbp + 0x170]
call fcn.14003b270
test al, al
je 0x140057014
lea rcx, [rsp + 0x60]
call fcn.14003b270
test al, al
je 0x1400570d8
test dil, dil
je 0x140057014
lea rdx, str..
lea rcx, [rbp + 0x170]
call fcn.140014ce8
lea rcx, [rbp + 0x170]
call fcn.140014cc4
lea rcx, [rsp + 0x60]
mov word [rbp + rax*2 + 0x172], bx
call fcn.140014cc4
lea rcx, [rsp + 0x20]
mov word [rsp + rax*2 + 0x62], bx
lea rax, [rbp + 0x170]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x38], rax
mov eax, 0x614
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 2
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
lea rcx, [rsp + 0x60]
call fcn.14003adf0
test al, al
je 0x140057014
lea rcx, [rsp + 0x60]
call fcn.14003b270
test al, al
jmp 0x140057040
Function at 0x140057100
Capabilities:
Copy file
Delete file
Enumerate files on windows
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1028]
mov eax, 0x1100
call fcn.140024730
sub rsp, rax
mov rbx, rdx
lea rdx, [rbp + 0x360]
xor edi, edi
mov r13b, r9b
mov r14b, r8b
mov sil, dil
call fcn.1400135c0
lea rdx, [rbp + 0x570]
mov rcx, rbx
call fcn.1400135c0
lea rdx, [rbp + 0x570]
lea rcx, [rbp + 0x360]
call fcn.14003b1c0
lea rcx, [rbp + 0x360]
mov r15b, al
call fcn.14003b270
test al, al
je 0x14005718e
lea rdx, str..
lea rcx, [rbp + 0x360]
call fcn.140014ce8
lea rcx, [rbp + 0x570]
call fcn.14003b270
test al, al
je 0x1400571b1
lea rdx, str..
lea rcx, [rbp + 0x570]
call fcn.140014ce8
lea rax, [rbp + 0xdf0]
lea r9, [rbp + 0x9d0]
lea r8, [rbp + 0xbe0]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x360]
mov qword [rsp + 0x20], rax
call fcn.14001633c
lea rdx, [rbp + 0x780]
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12b, 1
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14005733f
cmp r12b, 1
jne 0x14005733f
test byte [rbp + 0x780], 0x10
jne 0x140057312
lea rax, [rbp + 0x150]
lea r9, [rbp + 0x570]
lea r8, [rbp + 0xdf0]
lea rdx, [rbp + 0x9d0]
lea rcx, [rbp + 0x7ac]
mov qword [rsp + 0x20], rax
call fcn.14003b000
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140014d14
lea rdx, [rbp + 0xbe0]
lea rcx, [rsp + 0x40]
call fcn.140014ce8
lea rdx, [rbp + 0x7ac]
lea rcx, [rsp + 0x40]
call fcn.140014ce8
lea rcx, [rbp + 0x150]
call fcn.14003b2e0
test al, al
je 0x1400572b1
test r14b, r14b
je 0x140057332
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400572d0
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x40]
cmp r13b, 1
jne 0x140057302
test r15b, r15b
jne 0x1400572e8
call qword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x14005730b
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x140057342
jmp 0x14005730f
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140057332
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14005730b
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140057332
mov sil, 1
lea rdx, [rbp + 0x780]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140057200
mov r12b, dil
jmp 0x140057200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x14005734e
mov dil, sil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, dil
lea r11, [rsp + 0x1100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140057370
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x9c0]
sub rsp, 0xac0
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov r12b, bl
call fcn.1400135c0
lea rcx, [rsp + 0x30]
call fcn.14003b270
test al, al
je 0x1400573bb
lea rdx, str..
lea rcx, [rsp + 0x30]
call fcn.140014ce8
lea rax, [rbp + 0x7b0]
lea r9, [rbp + 0x5a0]
lea r8, [rbp + 0x390]
lea rdx, [rbp + 0x9e8]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.14001633c
lea rdx, [rbp + 0x140]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dil, 1
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140057472
cmp dil, 1
jne 0x140057472
test byte [rbp + 0x140], 0x10
jne 0x140057459
lea rdx, [rbp + 0x9e8]
lea rcx, [rsp + 0x30]
mov r12b, dil
call fcn.140014d14
lea rdx, [rbp + 0x390]
lea rcx, [rsp + 0x30]
call fcn.140014ce8
lea rdx, [rbp + 0x16c]
lea rcx, [rsp + 0x30]
call fcn.140014ce8
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x140057475
lea rdx, [rbp + 0x140]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140057404
mov dil, bl
jmp 0x140057404
mov bl, r12b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0xac0]
mov al, bl
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x1400576d0
Capabilities:
Check for time delay via queryperformancecounter
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x150
mov dil, byte [rdx]
mov sil, byte [rdx + 7]
movzx r12d, word [rdx + 8]
xor r13d, r13d
mov rbp, rdx
mov rbx, rcx
cmp qword [rcx + 0x28], r13
je 0x1400577c0
cmp dil, 0x14
je 0x1400577c0
cmp dil, 0x90
je 0x1400577c0
cmp dil, 0x91
je 0x1400577c0
mov rcx, rdx
call fcn.14003c450
test al, al
je 0x14005782b
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x14005775b
movzx eax, dil
lea rcx, [rsp + 0x50]
xor byte [rsp + rax + 0x50], 0x80
call qword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, sil
mov rcx, rbp
shl eax, 0x10
movsxd rsi, eax
mov eax, 0xc0000001
or rsi, rax
call fcn.14004e870
cmp al, 1
jne 0x14005777e
bts rsi, 0x18
cmp byte [rbx + 0x1b], r13b
jne 0x140057790
cmp byte [rbx + 0x21], r13b
jne 0x140057790
cmp dil, 0x12
jne 0x1400577a8
cmp byte [rbx + 0x1a], r13b
jne 0x1400577a8
cmp byte [rbx + 0x20], r13b
jne 0x1400577a8
bts rsi, 0x1d
mov edx, 0x105
jmp 0x1400577ad
mov edx, 0x101
mov rcx, qword [rbx + 0x28]
mov r9, rsi
movzx r8d, dil
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14005782b
mov rcx, rdx
call fcn.14003c450
test al, al
je 0x1400577f4
mov rcx, rbp
call fcn.14004e870
mov r8b, sil
mov dl, dil
mov rcx, rbx
mov r9d, 3
cmp al, 1
je 0x1400577ed
mov r9d, 2
call fcn.14003c2c0
jmp 0x14005782b
mov r8d, SafeArrayCreateEx
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 1
lea ecx, [r8 - 0x27]
mov word [rsp + 0x28], r13w
mov word [rsp + 0x2a], r12w
mov qword [rsp + 0x2c], 6
mov qword [rsp + 0x38], r13
call qword [sym.imp.USER32.dll_SendInput]
mov rcx, rbx
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
jmp fcn.14003c350
Function at 0x140057850
Capabilities:
Check for time delay via queryperformancecounter
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x150
mov dil, byte [rdx]
mov r12b, byte [rdx + 7]
movzx esi, word [rdx + 8]
xor r13d, r13d
mov rbp, rdx
mov rbx, rcx
cmp qword [rcx + 0x28], r13
je 0x140057953
cmp dil, 0x14
je 0x140057953
cmp dil, 0x90
je 0x140057953
cmp dil, 0x91
je 0x140057953
mov rcx, rdx
call fcn.14003c450
test al, al
je 0x140057938
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x1400578da
movzx eax, dil
lea rcx, [rsp + 0x50]
or byte [rsp + rax + 0x50], 0x80
call qword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, r12b
mov rcx, rbp
shl eax, 0x10
movsxd rsi, eax
or rsi, 1
call fcn.14004e870
cmp al, 1
jne 0x1400578f9
bts rsi, 0x18
cmp byte [rbx + 0x1b], r13b
jne 0x14005790b
cmp byte [rbx + 0x21], r13b
jne 0x14005790b
cmp dil, 0x12
jne 0x14005792a
cmp byte [rbx + 0x1a], r13b
jne 0x14005792a
cmp byte [rbx + 0x20], r13b
jne 0x14005792a
bts rsi, 0x1d
movzx r8d, dil
mov edx, 0x104
mov r9, rsi
jmp 0x140057947
movzx r8d, dil
mov r9, rsi
mov edx, 0x100
jmp 0x140057947
movzx r8d, si
mov edx, 0x102
mov r9d, 1
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400579bc
mov rcx, rdx
call fcn.14003c450
test al, al
je 0x140057986
mov rcx, rbp
call fcn.14004e870
mov r8b, r12b
mov dl, dil
mov rcx, rbx
cmp al, 1
jne 0x14005797c
mov r9d, 1
jmp 0x14005797f
xor r9d, r9d
call fcn.14003c2c0
jmp 0x1400579bc
mov r8d, SafeArrayCreateEx
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 1
lea ecx, [r8 - 0x27]
mov word [rsp + 0x28], r13w
mov word [rsp + 0x2a], si
mov qword [rsp + 0x2c], 4
mov qword [rsp + 0x38], r13
call qword [sym.imp.USER32.dll_SendInput]
mov rcx, rbx
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
jmp fcn.14003c330

Function at 0x1400579e0
Capabilities:
Check for time delay via queryperformancecounter
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140057850
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400576d0

Function at 0x140057a10
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov byte [rcx + 7], 0
mov word [rcx], 0xff
mov dword [rcx + 2], 0
mov byte [rcx + 6], 0
movzx edi, dx
mov rbx, rcx
mov byte [rcx + 0xa], 0
mov word [rcx + 8], dx
call fcn.14003c440
test al, al
jne 0x140057a49
xor al, al
jmp 0x140057a8b
movzx ecx, di
call qword [sym.imp.USER32.dll_VkKeyScanW]
cmp ax, 0xffff
je 0x140057a45
movzx edi, ax
movzx ecx, al
xor edx, edx
sar di, 8
mov byte [rbx], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [rbx + 7], al
mov al, 1
test al, dil
je 0x140057a79
mov byte [rbx + 1], al
test dil, 2
je 0x140057a82
mov byte [rbx + 3], al
test dil, 4
je 0x140057a8b
mov byte [rbx + 4], al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140057aa0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov dil, dl
mov rbx, rcx
mov word [rcx + 8], si
mov byte [rcx + 7], sil
mov dword [rcx + 1], esi
mov word [rcx + 5], si
mov byte [rcx + 0xa], sil
mov byte [rcx], dl
call fcn.14003c450
test al, al
je 0x140057ae6
movzx ecx, dil
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [rbx + 7], al
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14005f010
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rax - 0x1f8]
sub rsp, 0x2e0
lea rcx, [rsp + 0x48]
call fcn.140001ca0
mov rax, qword [rsp + 0x50]
mov r11, qword [rsp + 0x48]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x58]
lea rdx, [0x14009f560]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
inc dword [rax]
mov qword [rsp + 0x68], r11
mov qword [rbp - 0x80], rax
call fcn.14000fa50
mov rcx, qword [rsp + 0x48]
lea rdx, [rbp - 0x70]
mov bl, 1
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x14005f1c1
mov sil, byte [rbp + 0x228]
mov rdi, qword [rbp + 0x220]
mov rcx, qword [rbp + 0x200]
call fcn.14004c4c0
cmp eax, 1
je 0x14005f1ba
cmp eax, 0xb
jne 0x14005f0cb
lea ecx, [rax - 1]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14005f0a6
lea rdx, [0x140098df4]
lea rcx, [rbp - 0x44]
call fcn.1400158dc
test eax, eax
je 0x14005f1a1
lea rdx, [0x14009f568]
lea rcx, [rbp - 0x44]
call fcn.1400158dc
test eax, eax
je 0x14005f1a1
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.140010950
lea rdx, [rbp - 0x44]
lea rcx, [rsp + 0x48]
call fcn.14000fa50
test byte [rbp - 0x70], 0x10
je 0x14005f17b
test sil, sil
je 0x14005f126
inc qword [rdi]
cmp byte [rbp + 0x230], 0
je 0x14005f1a1
lea rdx, [0x140099b9c]
lea rcx, [rsp + 0x48]
call fcn.14000fa50
mov al, byte [rbp + 0x230]
mov r9, qword [rbp + 0x218]
mov r8, qword [rbp + 0x210]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rbp + 0x200]
mov byte [rsp + 0x30], al
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x20], rdi
call fcn.14005f010
mov bl, al
test al, al
je 0x14005f1bc
jmp 0x14005f1a1
mov eax, dword [rbp - 0x50]
mov ecx, dword [rbp - 0x54]
shl rcx, 0x20
or rcx, rax
mov rax, qword [rbp + 0x210]
add qword [rax], rcx
test sil, sil
je 0x14005f1a1
mov rax, qword [rbp + 0x218]
inc qword [rax]
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14005f0a6
jmp 0x14005f1bc
xor bl, bl
mov rax, qword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x68]
call fcn.1400024f0
lea rcx, [rsp + 0x48]
call fcn.1400024f0
mov al, bl
mov rbx, qword [rsp + 0x308]
add rsp, 0x2e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005f320
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x378]
sub rsp, 0x450
xor edi, edi
mov r15, r8
mov r14, rdx
lea ebx, [rdi + 1]
mov rsi, rcx
mov r13d, edi
mov r12b, bl
mov r9, qword [rsi]
lea rcx, [rsp + 0x20]
mov r8d, 4
mov rdx, rbx
call fcn.1400179f0
lea rcx, [rsp + 0x20]
mov edx, 4
mov r8d, 0x18ee
call fcn.140056100
lea rdx, str.FILE
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x24], dil
call fcn.140017a20
test eax, eax
jne 0x14005f4e7
mov r9, qword [rsi]
lea edx, [rax + 4]
lea rcx, [rbp + 0x398]
mov r8, rbx
add r13d, ebx
call fcn.1400179f0
mov edi, dword [rbp + 0x398]
mov r9, qword [rsi]
xor edi, 0xadbc
lea rcx, [rsp + 0x30]
mov edx, 1
lea ebx, [rdi + rdi]
movsxd r8, ebx
call fcn.1400179f0
lea r8d, [rdi + 0xb33f]
lea rcx, [rsp + 0x30]
mov edx, ebx
call fcn.140056100
movsxd r11, edi
xor eax, eax
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x140]
mov word [rsp + r11*2 + 0x30], ax
call fcn.140014d14
mov r9, qword [rsi]
mov edx, 4
lea r8d, [rdx - 3]
lea rcx, [rbp + 0x398]
call fcn.1400179f0
mov edi, dword [rbp + 0x398]
mov r9, qword [rsi]
xor edi, 0xf820
lea rcx, [rsp + 0x30]
mov edx, 1
lea ebx, [rdi + rdi]
movsxd r8, ebx
call fcn.1400179f0
lea r8d, [rdi + 0xf479]
lea rcx, [rsp + 0x30]
mov edx, ebx
call fcn.140056100
movsxd r11, edi
lea rdx, [rsp + 0x30]
xor edi, edi
mov rcx, r15
mov word [rsp + r11*2 + 0x30], di
call fcn.140014d14
lea rcx, [rbp + 0x140]
mov rdx, r14
call fcn.1400158dc
test eax, eax
je 0x14005f519
lea rdx, [0x14009c8a0]
mov rcx, r14
call fcn.1400158dc
test eax, eax
jne 0x14005f4a4
test r13d, r13d
je 0x14005f519
mov rcx, qword [rsi]
mov ebx, 1
mov r8d, ebx
mov edx, ebx
call fcn.140017e40
mov r9, qword [rsi]
lea edx, [rbx + 3]
lea rcx, [rsp + 0x28]
mov r8d, ebx
call fcn.1400179f0
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsi]
xor edx, 0x87bc
mov r8d, ebx
mov dword [rsp + 0x28], edx
add edx, 0x18
call fcn.140017e40
jmp 0x14005f4ea
mov r12b, dil
cmp r12b, bl
je 0x14005f35a
mov eax, 6
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor eax, eax
jmp 0x14005f4f8