joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006aa0
Capabilities:
Write file on windows

Disassembly:
test r8d, r8d
je 0x140006d26
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x140040010]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x20]
call fcn.14000dec0
lea edx, [r14 + 3]
lea r8d, [r14 + 1]
lea rcx, [rbp + 0x20]
call fcn.140007d90
nop
mov r8d, ebx
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.140007fd0
lea r8d, [r14 + 0x10]
lea rdx, [rbp - 8]
lea rcx, [0x140042bb8]
call fcn.140009c20
nop
lea rax, [rbp - 0x50]
mov qword [rsp + 0x78], rax
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x50]
call fcn.1400081e0
mov rbx, rax
lea rax, [rsp + 0x58]
mov qword [rbp - 0x80], rax
lea rdx, [0x140040bf8]
cmp qword [0x140040c10], 0x10
cmovae rdx, qword [0x140040bf8]
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], r14b
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140006b80
lea rcx, [rsp + 0x58]
call fcn.140008800
nop
lea rax, [rsp + 0x38]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x30], 4
mov rcx, qword [rbp + 0xa8]
test cl, 2
jne 0x140006bec
mov rax, qword [rbp + 0x78]
mov r8, qword [rax]
test r8, r8
je 0x140006bec
mov rax, qword [rbp + 0x58]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0xa0]
cmovb r8, qword [rbp + 0xa0]
sub r8, rdx
jmp 0x140006c14
test cl, 4
jne 0x140006c1f
mov rax, qword [rbp + 0x70]
mov rcx, qword [rax]
test rcx, rcx
je 0x140006c1f
mov rax, qword [rbp + 0x50]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x88]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
lea rcx, [rsp + 0x38]
call fcn.140008800
nop
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x70]
lea rcx, [0x140042bb8]
call fcn.140009f40
nop
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
mov rcx, rax
call fcn.140008940
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140006c8d
inc rdx
mov rcx, qword [rbp - 0x70]
call fcn.140004a10
mov dword [rbp - 0x30], r14d
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x30]
mov r8d, dword [rbp - 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140006ccb
inc rdx
mov rcx, qword [rbp - 0x28]
call fcn.140004a10
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x140006cf1
inc rdx
mov rcx, qword [rbp - 8]
call fcn.140004a10
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], 0xf
mov byte [rbp - 8], 0
lea rcx, [rbp + 0x20]
call fcn.140006990
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.14000a750
add rsp, 0x230
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140006aa9
Capabilities:
Write file on windows

Disassembly:
test r8d, r8d
je 0x140006d26
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x140040010]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x20]
call fcn.14000dec0
lea edx, [r14 + 3]
lea r8d, [r14 + 1]
lea rcx, [rbp + 0x20]
call fcn.140007d90
nop
mov r8d, ebx
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.140007fd0
lea r8d, [r14 + 0x10]
lea rdx, [rbp - 8]
lea rcx, [0x140042bb8]
call fcn.140009c20
nop
lea rax, [rbp - 0x50]
mov qword [rsp + 0x78], rax
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x50]
call fcn.1400081e0
mov rbx, rax
lea rax, [rsp + 0x58]
mov qword [rbp - 0x80], rax
lea rdx, [0x140040bf8]
cmp qword [0x140040c10], 0x10
cmovae rdx, qword [0x140040bf8]
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], r14b
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140006b80
lea rcx, [rsp + 0x58]
call fcn.140008800
nop
lea rax, [rsp + 0x38]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x30], 4
mov rcx, qword [rbp + 0xa8]
test cl, 2
jne 0x140006bec
mov rax, qword [rbp + 0x78]
mov r8, qword [rax]
test r8, r8
je 0x140006bec
mov rax, qword [rbp + 0x58]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0xa0]
cmovb r8, qword [rbp + 0xa0]
sub r8, rdx
jmp 0x140006c14
test cl, 4
jne 0x140006c1f
mov rax, qword [rbp + 0x70]
mov rcx, qword [rax]
test rcx, rcx
je 0x140006c1f
mov rax, qword [rbp + 0x50]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x88]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
lea rcx, [rsp + 0x38]
call fcn.140008800
nop
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x70]
lea rcx, [0x140042bb8]
call fcn.140009f40
nop
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
mov rcx, rax
call fcn.140008940
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140006c8d
inc rdx
mov rcx, qword [rbp - 0x70]
call fcn.140004a10
mov dword [rbp - 0x30], r14d
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x30]
mov r8d, dword [rbp - 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140006ccb
inc rdx
mov rcx, qword [rbp - 0x28]
call fcn.140004a10
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x140006cf1
inc rdx
mov rcx, qword [rbp - 8]
call fcn.140004a10
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], 0xf
mov byte [rbp - 8], 0
lea rcx, [rbp + 0x20]
call fcn.140006990
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.14000a750
add rsp, 0x230
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x100002454
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x100004758], rdi
je 0x1000024a2
cmp rax, rdi
jne 0x100002495
mov edi, 1
mov r12d, edi
jmp 0x1000024a7
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100002479
mov edi, 1
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x1000024bd
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x10000251a
mov eax, dword [0x100004750]
test eax, eax
jne 0x100002514
mov dword [0x100004750], edi
lea r13, [0x100001290]
lea rsi, [0x100001278]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x100002506
test eax, eax
jne 0x100002506
mov rcx, qword [rsi]
test rcx, rcx
je 0x1000024fb
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x1000024e4
test eax, eax
je 0x10000251a
mov eax, 0xff
jmp 0x1000025ec
mov dword [0x100004184], edi
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x100002541
lea rdx, [0x100001270]
lea rcx, [0x100001260]
call sub.msvcrt.dll__initterm
mov dword [0x100004750], 2
test r12d, r12d
jne 0x10000254f
xor eax, eax
xchg qword [0x100004758], rax
cmp qword [0x100004760], 0
je 0x100002578
lea rcx, [0x100004760]
call fcn.10000284c
test eax, eax
je 0x100002578
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100004760]
mov r8, qword [0x100004168]
mov rdx, qword [0x100004170]
mov ecx, dword [0x100004160]
call fcn.100001b54
mov dword [0x100004180], eax
cmp dword [0x100004164], 0
jne 0x1000025a8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100004184], 0
jne 0x1000025bd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100004180]
jmp 0x1000025ec
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.100169000
add rsp, 0x28
jmp 0x100002454
Function at 0x140034720
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rcx, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x140034759
movzx eax, byte [r9 + rdx]
movabs r10, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, r10
cmp r9, r8
jb 0x14003473b
mov rax, rcx
shr rax, 0x20
xor eax, ecx
ret

Function at 0x140034ec4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x14011aa00]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r12, rcx
mov rbp, rdx
cmp rdx, r8
je 0x140034f77
cmp rsi, qword [rsp + 0x80]
je 0x140034f81
movzx r14d, word [rbx]
add rbx, 2
movzx r15d, word [rsi]
add rsi, 2
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x68], rbx
call fcn.1400348d4
mov rcx, rax
movzx edx, r14w
mov rax, qword [rax]
mov rax, qword [rax + 0x40]
call qword [0x1400c51a0]
mov rcx, qword [rsp + 0x88]
movzx r14d, ax
call fcn.1400348d4
mov rcx, rax
movzx edx, r15w
mov rax, qword [rax]
mov rax, qword [rax + 0x40]
call qword [0x1400c51a0]
cmp r14w, ax
jne 0x140034f88
cmp rbx, rdi
jne 0x140034f07
cmp rsi, qword [rsp + 0x80]
jne 0x140034f8e
lea rax, [rsp + 0x68]
jmp 0x140034fa7
mov qword [r12], rbp
jmp 0x140034fae
cmp byte [rsp + 0x90], 0
je 0x140034fa2
lea rax, [rsp + 0x68]
cmp rbx, rdi
je 0x140034fa7
lea rax, [rsp + 0x20]
mov rax, qword [rax]
mov qword [r12], rax
mov rax, r12
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400afd50
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x140035b18
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14011aa00]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ebx, ebx
cmp qword [0x140114298], rbx
jne 0x140035ba3
lea r9, [rsp + 0x20]
xor r8d, r8d
mov edx, 0x8000
lea rcx, [0x1400d8938]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x140035b98
mov rdx, qword [rsp + 0x20]
cmp word [rdx], bx
je 0x140035b70
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], bx
jne 0x140035b64
mov rbx, rax
mov r8, rbx
lea rcx, [0x140114288]
call fcn.140005bf4
mov r8d, 0x18
lea rdx, str.MicrosoftUEVTemplates
lea rcx, [0x140114288]
call fcn.140005d18
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rax, [0x140114288]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400afd50
add rsp, 0x30
pop rbx
ret
Function at 0x14003b94c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
cmp qword [rdx + 0x18], 8
mov r9, qword [rdx + 0x10]
jb 0x14003b963
mov rdx, qword [rdx]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
add r9, r9
je 0x14003b993
movzx eax, byte [rdx + r8]
movabs r10, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, r10
cmp r8, r9
jb 0x14003b975
mov rax, rcx
mov edx, 0x1f31d
shr rax, 0x20
xor ecx, eax
btr ecx, 0x1f
call qword [sym.imp.msvcrt.dll_ldiv]
mov qword [rsp + 0x30], rax
shr rax, 0x20
imul ecx, eax, 0x41a7
imul eax, dword [rsp + 0x30], 0xb14
sub ecx, eax
jns 0x14003b9cc
add ecx, 0x7fffffff
movsxd rax, ecx
add rsp, 0x28
ret
Function at 0x1400afd20
Capabilities:
Access peb ldr_data

Disassembly:
push rcx
push r11
push r13
sub rcx, rcx
add rcx, 0x60
mov r11, qword gs:[rcx]
push r10

Function at 0x1400b0130
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400b017c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400b0174
cmp dword [rcx + 0x3c], edx
jl 0x1400b0174
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400b0174
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400b017c
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140006280
Capabilities:
Write clipboard data

Disassembly:
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x2c], 0
mov rdi, rcx
jne 0x1400062ac
call fcn.140006620
test eax, eax
jne 0x1400062ac
lea rdx, str.Cant_open_clipboard_for_writing.
mov rcx, rdi
add rsp, 0x20
pop rdi
jmp 0x1400063d0
mov qword [rsp + 0x38], rsi
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x1400062fa
cmp dword [rdi + 0x2c], eax
je 0x1400062e1
xor esi, esi
cmp qword [rdi + 0x10], rsi
je 0x1400062d5
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rdi + 0x10], rsi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rdi + 0x2c], esi
mov qword [rdi], rsi
lea rdx, str.EmptyClipboard
mov rcx, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1400063d0
mov rcx, qword [rdi + 8]
xor esi, esi
test rcx, rcx
je 0x14000633d
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x140006371
cmp word [rax], si
mov qword [rsp + 0x30], rbx
sete bl
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test bl, bl
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 0x18], rsi
mov dword [rdi + 0x28], esi
je 0x140006371
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 8], rax
cmp dword [rdi + 0x2c], esi
je 0x140006361
cmp qword [rdi + 0x10], rsi
je 0x140006355
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rdi + 0x10], rsi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rdi + 0x2c], esi
mov qword [rdi], rsi
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rdx, qword [rdi + 8]
mov ecx, SafeArrayGetElemsize
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
je 0x14000638b
mov qword [rdi + 8], rsi
jmp 0x14000633d
cmp dword [rdi + 0x2c], esi
je 0x1400063af
cmp qword [rdi + 0x10], rsi
je 0x1400063a3
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rdi + 0x10], rsi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rdi + 0x2c], esi
mov qword [rdi], rsi
lea rdx, str.SetClipboardData
mov rcx, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1400063d0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rdx
mov rbx, rcx
cmp dword [rcx + 0x2c], esi
je 0x14000640b
cmp qword [rcx + 0x10], rsi
je 0x1400063ff
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rbx + 0x2c], esi
mov qword [rbx], rsi
cmp qword [rbx + 0x18], rsi
je 0x140006422
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rbx + 0x18], rsi
mov dword [rbx + 0x28], esi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140006435
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbx + 8], rax
cmp word [rdi], si
je 0x14000645f
lea r8, [0x1400e246c]
lea rcx, [0x140119170]
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140040620
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001b2b0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx edi, cl
movzx ebx, dl
lea rsi, sym.MZ_mQi__2AXcFXq_ppj624W7rH_FhFt_bkZW__Vxfp1Vv
lea eax, [rdi - 0x13]
cmp eax, 0x92
ja case.0x14001b2ee.45
cdqe
movzx eax, byte [rsi + rax + 0x1b4c0]
mov ecx, dword [rsi + rax*4 + 0x1b454]
add rcx, rsi
jmp rcx
mov eax, 0x2a
jmp 0x14001b3b9
mov eax, 0x136
jmp 0x14001b3b9
mov eax, 0x1d
jmp 0x14001b3b9
mov eax, 0x11d
jmp 0x14001b3b9
mov eax, gethostname
jmp 0x14001b3b9
mov eax, 0x138
jmp 0x14001b3b9
mov eax, 0x15b
jmp 0x14001b3b9
mov eax, 0x15c
jmp 0x14001b3b9
mov eax, 0x45
jmp 0x14001b3b9
mov eax, 0x52
jmp 0x14001b3b9
mov eax, 0x4f
jmp 0x14001b3b9
mov eax, 0x50
jmp 0x14001b3b9
mov eax, 0x51
jmp 0x14001b3b9
mov eax, 0x4b
jmp 0x14001b3b9
mov eax, 0x4c
jmp 0x14001b3b9
mov eax, 0x4d
jmp 0x14001b3b9
mov eax, 0x47
jmp 0x14001b3b9
mov eax, 0x48
jmp 0x14001b3b9
mov eax, 0x49
jmp 0x14001b3b9
mov eax, 0x53
jmp 0x14001b3b9
mov eax, 0x145
jmp 0x14001b3b9
mov eax, 0x135
jmp 0x14001b3b9
mov eax, gethostname
jmp 0x14001b3b9
mov eax, 0x4a
jmp 0x14001b3b9
mov eax, 0x4e
jmp 0x14001b3b9
mov eax, 0x137
test bl, bl
jne 0x14001b40f
movzx eax, ax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r11d, eax
test ax, ax
je 0x14001b40f
lea eax, [rdi - 3]
cmp eax, 0xb4
ja case.0x14001b400.5
cdqe
movzx eax, byte [rsi + rax + 0x1b560]
mov ecx, dword [rsi + rax*4 + 0x1b554]
add rcx, rsi
jmp rcx
mov ecx, 0x100
or r11w, cx
test bl, bl
je 0x14001b440
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, r11w
test bl, bl
je 0x14001b444
mov ecx, 0x100
or eax, ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, r11w
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001b620
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cx
mov r8d, ebx
mov eax, ebx
cmp ebx, 0x11c
jg 0x14001b706
cmp eax, 0x11c
je 0x14001b6fe
sub eax, 0x1d
cmp eax, 0x36
ja case.0x14001b72b.286
lea rdx, sym.MZ_mQi__2AXcFXq_ppj624W7rH_FhFt_bkZW__Vxfp1Vv
cdqe
movzx eax, byte [rdx + rax + 0x1b7f8]
mov ecx, dword [rdx + rax*4 + 0x1b7ac]
add rcx, rdx
jmp rcx
mov al, 0xa0
add rsp, 0x20
pop rbx
ret
mov al, 0xa2
add rsp, 0x20
pop rbx
ret
mov al, 0xa4
add rsp, 0x20
pop rbx
ret
mov al, 0x6a
add rsp, 0x20
pop rbx
ret
mov al, 0x6d
add rsp, 0x20
pop rbx
ret
mov al, 0x6b
add rsp, 0x20
pop rbx
ret
mov al, 0x2e
add rsp, 0x20
pop rbx
ret
mov al, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
add rsp, 0x20
pop rbx
ret
mov al, 0x2d
add rsp, 0x20
pop rbx
ret
mov al, 0x26
add rsp, 0x20
pop rbx
ret
mov al, 0x28
add rsp, 0x20
pop rbx
ret
mov al, 0x25
add rsp, 0x20
pop rbx
ret
mov al, 0x27
add rsp, 0x20
pop rbx
ret
mov al, 0x24
add rsp, 0x20
pop rbx
ret
mov al, reloc.OLEAUT32.dll_SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, 0x21
add rsp, 0x20
pop rbx
ret
mov al, SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, reloc.OLEAUT32.dll_SafeArrayGetLBound
add rsp, 0x20
pop rbx
ret
mov al, 0xd
add rsp, 0x20
pop rbx
ret
sub eax, 0x11d
cmp eax, 0x40
ja case.0x14001b72b.286
lea rdx, sym.MZ_mQi__2AXcFXq_ppj624W7rH_FhFt_bkZW__Vxfp1Vv
cdqe
movzx eax, byte [rdx + rax + 0x1b858]
mov ecx, dword [rdx + rax*4 + 0x1b830]
add rcx, rdx
jmp rcx
mov al, 0xa1
add rsp, 0x20
pop rbx
ret
mov al, 0xa3
add rsp, 0x20
pop rbx
ret
mov al, 0xa5
add rsp, 0x20
pop rbx
ret
mov al, 0x5b
add rsp, 0x20
pop rbx
ret
mov al, 0x5c
add rsp, 0x20
pop rbx
ret
mov al, 0x90
add rsp, 0x20
pop rbx
ret
mov al, 0x6f
add rsp, 0x20
pop rbx
ret
mov al, 0x5d
add rsp, 0x20
pop rbx
ret
mov al, 0x2c
add rsp, 0x20
pop rbx
ret
mov eax, 0x100
test ax, bx
je 0x14001b798
movzx ecx, r8b
mov edx, 1
or ecx, 0xe000
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
jne 0x14001b7a6
movzx ecx, bl
mov edx, 1
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
add rsp, 0x20
pop rbx
ret

Function at 0x14001b8a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x1401165c0], ecx
mov edx, 1
lea r8, [0x1401165c4]
nop word [rax + rax]
mov eax, dword [r8 - 4]
add r8, 4
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul ecx, ecx, 0x6c078965
add ecx, edx
inc edx
mov dword [r8 - 4], ecx
cmp edx, 0x270
jl 0x14001b8c0
mov dword [0x140111a04], 1
mov dword [0x140118400], 1
ret
Function at 0x14001b900
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x140118400], 0
lea rbx, [0x1401165c0]
jne 0x14001b95f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
lea r8, [0x1401165c4]
mov dword [0x1401165c0], eax
nop
mov eax, dword [r8 - 4]
add r8, 4
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul ecx, ecx, 0x6c078965
add ecx, edx
inc edx
mov dword [r8 - 4], ecx
cmp edx, 0x270
jl 0x14001b930
mov dword [0x140118400], 1
mov dword [0x140111a04], 0x270
mov qword [0x1401165b8], rbx
mov r8d, 0xe3
nop word [rax + rax]
mov eax, dword [rbx + 4]
mov ecx, eax
and al, 1
xor ecx, dword [rbx]
and ecx, 0x7ffffffe
xor ecx, dword [rbx]
shr ecx, 1
neg al
sbb eax, eax
add rbx, 4
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [rbx + 0x630]
dec r8d
mov dword [rbx - 4], ecx
jne 0x14001b980
mov r8d, 0x18c
nop word [rax + rax]
mov eax, dword [rbx + 4]
lea rdx, [rbx + 4]
mov ecx, eax
and al, 1
xor ecx, dword [rbx]
and ecx, 0x7ffffffe
xor ecx, dword [rbx]
shr ecx, 1
neg al
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [rbx - 0x38c]
dec r8d
mov dword [rbx], ecx
mov rbx, rdx
jne 0x14001b9c0
mov eax, dword [0x1401165c0]
mov ecx, dword [rdx]
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
xor ecx, dword [rdx]
shr ecx, 1
neg al
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [rdx - 0x38c]
mov dword [rdx], ecx
add rsp, 0x20
pop rbx
ret

Function at 0x14001ba30
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
dec dword [0x140111a04]
jne 0x14001ba41
call fcn.14001b900
mov rax, qword [0x1401165b8]
add rax, 4
mov ecx, dword [rax - 4]
mov qword [0x1401165b8], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
add rsp, 0x28
ret

Function at 0x14001ba90
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
dec dword [0x140111a04]
jne 0x14001baa1
call fcn.14001b900
mov rax, qword [0x1401165b8]
pxor xmm0, xmm0
add rax, 4
mov ecx, dword [rax - 4]
mov qword [0x1401165b8], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x140100ec8]
add rsp, 0x28
ret

Function at 0x14001c010
Capabilities:
Write clipboard data

Disassembly:
sub rsp, 0x38
movzx eax, byte [rcx + 0x23]
test al, al
jne 0x14001c038
mov rcx, qword [rcx + 0x10]
xor r9d, r9d
or r8, 0xffffffffffffffff
xor edx, edx
mov byte [rsp + 0x20], 1
call fcn.1400b0840
add rsp, 0x38
ret
cmp al, 2
jne 0x14001c04e
lea rcx, [0x1400e246c]
xor edx, edx
add rsp, 0x38
jmp fcn.140006100
cmp qword [0x140112480], 2
jae 0x14001c07d
cmp qword [rcx + 0x18], 2
jae 0x14001c07d
lea r8, [0x1400e246c]
lea rdx, str.Memory_limit_reached__see_MaxMem_in_the_help_file_.
lea rcx, [0x140119170]
add rsp, 0x38
jmp fcn.140040620
xor r8d, r8d
lea edx, [r8 + 3]
call fcn.1400b0ef0
mov eax, 1
add rsp, 0x38
ret