joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140048f44
Capabilities:
Query environment variable

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edi, edx
mov rbx, rcx
mov edx, 0x20a
lea rcx, [rsp + 0x20]
call fcn.140063580
nop
mov esi, 0x20
mov rax, qword [rsp + 0x20]
mov word [rax], si
xor ecx, ecx
mov rax, qword [rsp + 0x20]
mov word [rax + 2], cx
mov rdx, qword [rsp + 0x20]
add rdx, 2
mov r8d, 0x208
lea rcx, [0x14013f8a8]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, str.System32OnShutdown.wcs
lea rcx, [rsp + 0x20]
call fcn.140063600
lea r11, str.unknown
test sil, dil
lea rax, [0x1401468d8]
cmove rax, r11
test dil, 0x10
lea rcx, str.reboot
cmove rcx, rax
test dil, 2
lea rax, str.logout
cmove rax, rcx
test dil, 4
lea rcx, str.suspend
cmove rcx, rax
test dil, 8
lea rax, str.hiber
cmove rax, rcx
test dil, 0x40
lea rcx, str.poweroff
cmove rcx, rax
test dil, 0x80
lea rdx, str.lock
cmove rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140063600
lea rdx, [0x140146d20]
lea rcx, [rsp + 0x20]
call fcn.140063600
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140063600
mov rdx, qword [rsp + 0x20]
lea rcx, [0x14019c170]
call fcn.140047384
lea r11, [rsp + 0x30]
mov rax, qword [str._25INDATA]
mov qword [r11], rax
mov rax, qword [0x14014b0d0]
mov qword [r11 + 8], rax
mov rax, qword [0x14014b0d8]
mov qword [r11 + 0x10], rax
test dil, 0x70
je 0x1400490ab
lea rdx, [rsp + 0x30]
lea rcx, [0x14019c170]
call fcn.140047384
nop
lea rcx, [rsp + 0x20]
call fcn.14005b520
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14010bcc0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1400490d4
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov ebx, edx
mov edi, ecx
and edx, 0xfffffffe
mov rcx, r8
call fcn.140048f44
lea rcx, str.SeShutdownPrivilege
mov esi, ebx
mov edx, 2
and esi, 0x4000
call fcn.14002e788
lea rcx, str.SeRemoteShutdownPrivilege
mov edx, 2
call fcn.14002e788
call fcn.14002c054
test bl, 1
jne 0x140049150
cmp eax, 0x60002
jb 0x140049150
xor eax, eax
test edi, edi
lea rdx, [0x14014f7a8]
setne al
xor r8d, r8d
xor ecx, ecx
mov r9d, 1
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
and qword [rsp + 0x68], 0
test esi, esi
jne 0x140049189
lea rax, [rsp + 0x68]
lea edx, [rsi + 0x16]
lea r8d, [rsi + 1]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov ecx, 0xffff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov ecx, edi
call fcn.14002c488
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400491a0
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [0x140195894]
mov ebx, 0
lea edx, [rbx + 0x20]
mov eax, ecx
and eax, 4
shl eax, 0xc
test cl, 1
cmovne ebx, edx
test cl, 8
mov edx, 0x40
cmovne ebx, edx
test ecx, ecx
lea edi, [rdx - 0x3e]
cmove ebx, edi
test cl, 0x42
lea edx, [rdi + 0xe]
cmovne ebx, edx
test eax, eax
jne 0x1400491f1
call fcn.14002c4cc
mov ecx, dword [0x140195894]
or ebx, eax
lea r8, [0x14014f7a8]
and ecx, edi
or ebx, 1
mov edx, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400490d4
Function at 0x14004a88c
Capabilities:
Set current directory

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp word [rcx], 0x40
jne 0x14004a8c6
add rcx, 2
call fcn.14002e004
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
call fcn.14002a8c0
jmp 0x14004a91a
cmp word [rcx], 0x23
jne 0x14004a8d9
add rcx, 2
xor edx, edx
call fcn.140048940
jmp 0x14004a91a
xor ebx, ebx
cmp word [rcx], bx
je 0x14004a8e7
call fcn.14003a9e4
jmp 0x14004a91c
lea rcx, [rsp + 0x30]
lea rdx, str.PATH____SystemRoot_SYSTEM32
mov r8d, 0x42
call fcn.14010cd30
lea rdx, [rsp + 0x30]
lea rcx, [0x14019c170]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call fcn.14004d38c
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14010bcc0
add rsp, 0x90
pop rbx
ret
Function at 0x14005b5a0
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x28
cmp byte [rcx], 0
je 0x14005b5c1
and byte [0x14019c661], 0xfb
lea rcx, str.SeDebugPrivilege
mov edx, 4
call fcn.14002e788
add rsp, 0x28
ret
Function at 0x14005cd10
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [0x14019c430], 0
mov rbx, rcx
jne 0x14005d03c
movzx eax, byte [0x14019c661]
mov qword [rsp + 0x30], 0
test al, 4
jne 0x14005cd54
or al, 8
lea rcx, str.SeDebugPrivilege
mov edx, 2
mov byte [0x14019c661], al
call fcn.14002e788
lea r9, [rsp + 0x30]
lea r8, [0x14019c428]
lea rdx, str.WS2_32.DLL
lea rcx, str.WSAStartup
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c438]
lea rdx, str.WS2_32.DLL
lea rcx, str.shutdown
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c440]
lea rdx, str.WS2_32.DLL
lea rcx, str.closesocket
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c448]
lea rdx, str.WS2_32.DLL
lea rcx, str.connect
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c450]
lea rdx, str.WS2_32.DLL
lea rcx, str.send
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c458]
lea rdx, str.WS2_32.DLL
lea rcx, str.select
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c460]
lea rdx, str.WS2_32.DLL
lea rcx, str.recvfrom
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c468]
lea rdx, str.WS2_32.DLL
lea rcx, str.sendto
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c470]
lea rdx, str.WS2_32.DLL
lea rcx, str.bind
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c478]
lea rdx, str.WS2_32.DLL
lea rcx, str.listen
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c480]
lea rdx, str.WS2_32.DLL
lea rcx, str.accept
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c490]
lea rdx, str.WS2_32.DLL
lea rcx, str.getsockname
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c488]
lea rdx, str.WS2_32.DLL
lea rcx, str.getpeername
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c498]
lea rdx, str.WS2_32.DLL
lea rcx, str.ioctlsocket
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c4a0]
lea rdx, str.WS2_32.DLL
lea rcx, str.setsockopt
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c4a8]
lea rdx, str.WS2_32.DLL
lea rcx, str.ntohl
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c4b0]
lea rdx, str.WS2_32.DLL
lea rcx, str.htonl
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c4b8]
lea rdx, str.WS2_32.DLL
lea rcx, str.htons
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c4c0]
lea rdx, str.WS2_32.DLL
lea rcx, str.inet_addr
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c4c8]
lea rdx, str.WS2_32.DLL
lea rcx, str.gethostbyname
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c4d0]
lea rdx, str.WS2_32.DLL
lea rcx, str.inet_ntoa
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c4d8]
lea rdx, str.WS2_32.DLL
lea rcx, str.WSAGetLastError
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c4e0]
lea rdx, str.WS2_32.DLL
lea rcx, str.__WSAFDIsSet
call fcn.14005c580
lea r9, [rsp + 0x30]
lea r8, [0x14019c430]
lea rdx, str.WS2_32.DLL
lea rcx, str.socket
call fcn.14005c580
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14005d8c0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14005d960
cmp rdi, rsi
je 0x14005d960
mov rcx, qword [0x14019c630]
cmp rcx, rdi
je 0x14005d960
mov qword [rsp + 0x30], rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14005d92c
mov rcx, qword [0x14019c630]
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor r8d, r8d
mov ecx, eax
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor edx, edx
mov rcx, rdi
mov qword [0x14019c630], rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, 1
mov ecx, eax
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14005e210
Capabilities:
Find taskbar

Disassembly:
sub rsp, 0x28
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
lea r8, str.TrayNotifyWnd
xor r9d, r9d
mov rcx, rax
xor edx, edx
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_FindWindowExA]

Function at 0x14005e760
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
movsxd r8, dword [rcx + 0x10]
mov rbx, rcx
lea eax, [r8 + 1]
mov r9, r8
mov r8, qword [rcx + 8]
mov dword [rcx + 0x10], eax
movzx eax, byte [rdx]
mov byte [r9 + r8], al
mov r8d, dword [rcx + 0x10]
cmp r8d, 0x1000
jl 0x14005e7b1
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rbx + 0x10], 0
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x14005e7c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x14]
test r9, r9
lea rdi, [rsp + 0x40]
cmovne rdi, r9
xor ebp, ebp
cmp dword [rcx + 0x10], eax
mov rsi, rdx
mov rbx, rcx
jl 0x14005e81d
mov rdx, qword [rcx + 8]
mov dword [rcx + 0x10], ebp
mov rcx, qword [rcx]
lea r9, [rsp + 0x40]
mov r8d, 0x1000
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, dword [rsp + 0x40]
mov dword [rbx + 0x14], r11d
movsxd rcx, dword [rbx + 0x10]
cmp ecx, dword [rbx + 0x14]
jge 0x14005e843
lea eax, [rcx + 1]
mov dword [rbx + 0x10], eax
mov rax, qword [rbx + 8]
movzx ecx, byte [rcx + rax]
mov eax, 1
mov byte [rsi], cl
mov dword [rdi], 1
jmp 0x14005e847
mov dword [rdi], ebp
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14005eb10
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x140], rax
movzx ebx, cx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints_
lea rcx, [rsp + 0x20]
mov r8d, 0x82
call fcn.14010cd30
lea rcx, [rsp + 0xb0]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2_
mov r8d, 0x84
call fcn.14010cd30
lea rdx, [rsp + 0x20]
mov rcx, 0xffffffff80000001
mov word [rsp + 0x9e], bx
mov word [rsp + 0x130], bx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [rsp + 0xb0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14010bcc0
add rsp, 0x150
pop rbx
ret

Function at 0x14005ec10
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dil, 0x41
mov ebx, eax
test eax, eax
je 0x14005ec50
test bl, 1
je 0x14005ec49
movsx edx, dil
mov rcx, rsi
mov word [rsi], dx
call fcn.1400cf470
test eax, eax
jne 0x14005ec62
inc dil
shr ebx, 1
jne 0x14005ec31
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
movzx eax, dil
add rsp, 0x20
pop rdi
ret

Function at 0x14005ee50
Capabilities:
Get disk size

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
lea rax, [r11 + 0x10]
xor ebp, ebp
mov rsi, rdx
mov qword [r11 - 0x20], rbp
mov qword [r11 - 0x28], rax
lea rax, [r11 + 0x18]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7405c
mov dword [rsp + 0x28], 8
mov rdi, rcx
mov dword [rsp + 0x68], ebp
mov qword [r11 - 0x38], rax
mov qword [r11 + 0x18], rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rsp + 0x38], rbp
mov ebx, eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, rdi
mov dword [rsp + 0x28], 0x18
mov qword [rsi], rbp
mov qword [rsi + 0x18], rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test ebx, ebx
je 0x14005eeea
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [rsi + 0x10]
mov eax, dword [rsi + 0x14]
mov rbx, qword [rsp + 0x60]
imul rax, rcx
mov ecx, dword [rsi + 0xc]
imul rax, rcx
imul rax, qword [rsi]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005f290
Capabilities:
Get disk information via ioctl

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rsi, r8
mov rbx, rcx
mov dword [r8], 0
xor edx, edx
mov rcx, rdi
mov r8d, 0xc0
call fcn.14010c6c0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70050
mov rcx, rbx
mov dword [rsp + 0x28], 0x100000
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x58], 0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14005f311
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov eax, dword [rdi + 4]
mov rbx, qword [rsp + 0x50]
mov dword [rsi], eax
mov rsi, qword [rsp + 0x60]
mov rax, rdi
add rsp, 0x40
pop rdi
ret

Function at 0x14005f690
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14005f714
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0x2000
lea eax, [rax + rax + 2]
movsxd rbx, eax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.14010cd30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret

Function at 0x14005ff50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x30
xor ebp, ebp
mov r12, r9
mov edi, r8d
mov r13, rdx
mov r15, rcx
mov ebx, r8d
mov dword [r9], ebp
mov esi, 0x80
test r8d, r8d
je 0x14006002f
mov qword [rsp + 0x60], r14
mov r14, qword [rsp + 0x80]
nop word [rax + rax]
lea r9, [rsp + 0x70]
mov r8d, ebx
mov rdx, r13
mov rcx, r15
mov dword [rsp + 0x70], ebp
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14005ffeb
mov ecx, dword [rsp + 0x70]
test ecx, ecx
jne 0x14005ffde
test esi, esi
jg 0x14005ffdc
add dword [r12], ebx
mov eax, ebx
mov ecx, ebx
add r13, rax
sub edi, ebx
jmp 0x140060022
dec esi
add dword [r12], ecx
mov eax, ecx
add r13, rax
sub edi, ecx
jmp 0x140060022
mov esi, ebp
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x70
jne 0x14006002a
cmp ebx, 0x200
jbe 0x14006002a
cmp edi, 0x200
jbe 0x140060020
add ebx, 0x1ff
shr ebx, 1
cmp ebx, 0x200
jbe 0x140060022
and ebx, 0xfffffe00
jmp 0x140060022
mov ebx, edi
test edi, edi
jne 0x14005ffa0
mov r14, qword [rsp + 0x60]
cmp dword [r12], ebp
mov rbx, qword [rsp + 0x68]
seta bpl
mov eax, ebp
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400600c0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
test byte [0x14019c660], 1
movzx ebx, cl
je 0x140060124
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [0x14019c664]
movzx edx, byte [0x14019c660]
dec r11d
movzx eax, dl
or al, bl
mov dword [0x14019c664], r11d
test al, 0xfe
je 0x140060117
or dl, 0x10
mov byte [0x14019c660], dl
test r11d, r11d
jg 0x140060117
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add rsp, 0x20
pop rbx
ret

Function at 0x140060140
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x138
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0x20]
mov dword [0x14019c67c], 0
call qword [sym.imp.USER32.dll_GetKeyboardState]
test byte [rsp + 0x31], 0x80
mov eax, dword [0x14019c67c]
je 0x140060184
or eax, 2
mov dword [0x14019c67c], eax
test byte [rsp + 0x30], 0x80
je 0x140060194
or eax, 4
mov dword [0x14019c67c], eax
test byte [rsp + 0x32], 0x80
je 0x1400601a4
or eax, 1
mov dword [0x14019c67c], eax
test byte [rsp + 0x7b], 0x80
je 0x1400601b4
or eax, 8
mov dword [0x14019c67c], eax
test byte [rsp + 0x7c], 0x80
je 0x1400601c4
or eax, 8
mov dword [0x14019c67c], eax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14010bcc0
add rsp, 0x138
ret
Function at 0x140061330
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
call fcn.140061290
lea rcx, [rbx + 4]
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
Function at 0x1400619a0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x60]
lea r10, [rdx + r9]
mov rdi, r9
mov r9, r10
mov qword [rsp + 0x28], rax
xor edx, edx
shr r9, 0x20
mov ebx, r8d
mov dword [rsp + 0x20], r10d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
test rax, rax
jne 0x1400619ef
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
and ebx, 4
mov r8, rdi
mov r9d, edi
or ebx, 8
mov rcx, rax
shr r8, 0x20
shr ebx, 1
mov qword [rsp + 0x20], 0
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140061fb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r15
sub rsp, 0x38
mov eax, dword [rsp + 0x88]
mov rbx, rdx
mov rdi, r9
mov edx, eax
movzx esi, ax
mov r15d, ecx
and edx, 0x1000000
test esi, esi
jne 0x140062002
mov eax, dword [rsp + 0x80]
lea edx, [rsi + 8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r9
mov r9d, r8d
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add rsp, 0x38
pop r15
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r13
movsxd rbp, r8d
movzx r12d, sil
xor r13d, r13d
add rbp, rbx
xor r12b, 0xa
mov qword [rsp + 0x30], r14
movsxd r14, edx
cmp rbx, rbp
jae 0x1400620c5
mov r8, rbx
cmp rbx, rbp
jae 0x140062050
nop dword [rax + rax]
movzx eax, byte [rbx]
inc rbx
cmp r12b, al
je 0x140062050
cmp rbx, rbp
jb 0x140062040
mov rax, r8
cmp r8, rbx
jae 0x14006206b
nop dword [rax + rax]
xor byte [rax], sil
inc rax
cmp rax, rbx
jb 0x140062060
mov eax, dword [rsp + 0x80]
mov r9d, ebx
mov edx, 8
sub eax, r13d
sub r9d, r8d
mov ecx, r15d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jg 0x14006209f
test r14, r14
je 0x1400620bc
xor eax, eax
jmp 0x1400620c8
add r13d, eax
sub eax, 1
js 0x1400620bc
nop word [rax + rax]
xor word [rdi], si
add rdi, 2
sub eax, 1
jns 0x1400620b0
cmp rbx, rbp
jb 0x140062033
mov eax, r13d
mov r13, qword [rsp + 0x70]
mov r12, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop rdi
pop rsi
pop rbx
ret

Function at 0x140062bb0
Capabilities:
Get file size

Disassembly:
sub rsp, 0x28
lea rdx, [rsp + 0x3c]
mov qword [rsp + 0x38], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x38]
add rsp, 0x28
ret
Function at 0x140063ce0
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp word [rcx], 0x7a
mov rsi, r8
mov ebp, edx
mov rdi, rcx
jbe 0x140063dee
cmp word [rcx + 2], 0x3a
jne 0x140063dee
cmp word [rcx + 4], 0
jne 0x140063dee
mov qword [rsp + 0x240], r12
xor r12d, r12d
mov word [rsp + 0x20], r12w
test r9, r9
je 0x140063d3e
mov qword [r9], r12
lea rdx, [rsp + 0x20]
mov ecx, 0x104
mov qword [rsp + 0x248], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
movzx r11d, word [rsp + 0x20]
cmp word [rdi], r11w
jne 0x140063dbe
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [rax + 1]
cmp ebx, 4
jbe 0x140063dbe
cmp ebp, ebx
jae 0x140063da6
mov eax, ebx
mov rbx, qword [rsp + 0x248]
mov r12, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14010bcc0
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
movsxd r8, ebx
lea rdx, [rsp + 0x20]
mov rcx, rsi
add r8, r8
call fcn.14010cd30
lea eax, [rbx - 1]
jmp 0x140063d7b
cmp ebp, 4
jae 0x140063dca
mov eax, 4
jmp 0x140063d7b
movzx eax, word [rdi]
mov word [rsi + 6], r12w
mov word [rsi], ax
mov eax, 0x3a
mov word [rsi + 2], ax
mov eax, 0x5c
mov word [rsi + 4], ax
mov eax, 3
jmp 0x140063d7b
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x140063d8b
Function at 0x1400653c0
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor esi, esi
mov rax, rdx
mov rdi, rcx
mov rbx, rsi
test rdx, rdx
jne 0x140065455
mov qword [rsp + 0x30], rsi
lea r8d, [rax + 3]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
cmove rax, rsi
mov rbx, rax
test rax, rax
jne 0x140065455
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 3]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
cmove rax, rsi
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140065500
test rax, rax
je 0x140065500
xor ecx, ecx
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x48]
mov dword [rsp + 0x5c], ecx
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x64], ecx
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x6c], ecx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x74], ecx
mov dword [rsp + 0x78], ecx
mov dword [rsp + 0x7c], ecx
lea rcx, [rsp + 0x40]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x28], 0x28
mov qword [rsp + 0x20], rcx
mov edx, 0x2d1400
mov rcx, rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x4c], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x5c], 0x28
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [rsp + 0x74]
test rbx, rbx
je 0x1400654fc
cmp rbx, 0xffffffffffffffff
je 0x1400654fc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x140065517
test rbx, rbx
je 0x140065514
cmp rbx, 0xffffffffffffffff
je 0x140065514
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14010bcc0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret