joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140166180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov ebx, r11d
mov r14, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x140166289
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
lea r12, str.main
mov qword [rsp + 0x20], r15
lea r15, [0x140207e60]
nop
mov rax, qword [rsi + 0x20]
mov r10d, ebx
xor r10d, 1
cmp ebx, 2
cmovge r10d, ebx
movsxd rcx, r10d
shl rcx, 5
mov rbp, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x140166201
mov r8, qword [rcx + rax]
mov r9, rdi
sub r9, r8
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x14016623c
test ecx, ecx
jne 0x14016624a
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
call fcn.1401c5f20
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x140166220
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x1401661c0
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r15]
movzx ecx, byte [rcx + r15]
cmp ecx, edx
jne 0x14016624f
inc r8
jmp 0x1401661f0
test r10d, r10d
jne 0x140166219
mov r9, rdi
mov rax, r12
sub r9, r12
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x140166275
test edx, edx
je 0x140166201
inc rax
jmp 0x140166260
movzx r8d, byte [rcx + r15]
movzx edx, byte [rdx + r15]
cmp edx, r8d
jne 0x140166219
inc rax
jmp 0x140166260
mov rax, r11
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140170ed0
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14d, dword [rsp + 0x70]
mov ebx, r8d
mov dword [rax - 0x18], r14d
mov rbp, r9
mov qword [rax - 0x20], r9
mov rdi, rdx
mov r9, rdx
mov byte [rcx + 0x1c], 1
mov r8, rdx
mov dword [rax - 0x28], ebx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rsi, rcx
call fcn.140166c30
test ebx, ebx
jne 0x140170f39
mov r9, rbp
mov dword [rsp + 0x20], r14d
mov r8, rdi
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, rsi
call fcn.140166c30
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1401861f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rsi, r8
mov rbp, rdx
call fcn.1401cd740
mov rbx, rax
test rax, rax
jne 0x14018622e
lea eax, [rbx + 7]
jmp 0x1401862bb
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140186286
mov rax, qword [0x14023d860]
test rax, rax
je 0x140186252
mov ecx, 0xc8
call qword [case.0x1400faf48.0]
test eax, eax
jne 0x140186286
lea rax, [rbx + 8]
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x28], rax
lea r8, [0x1401c98e0]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rbx + 0x18], rsi
xor ecx, ecx
call fcn.1400c4c10
mov qword [rbx], rax
test rax, rax
jne 0x140186296
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x10], 0
jne 0x1401862b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 8], eax
mov rcx, rsi
mov rax, rbp
call qword [case.0x1400faf48.0]
mov qword [rbx + 0x20], rax
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1401aaab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [rcx + 0x11], 0
mov r9, rcx
jne 0x1401aab07
movzx eax, byte [rcx + 0x10]
test al, al
je 0x1401aab07
cmp al, 1
jne 0x1401aaac9
test edx, edx
jne 0x1401aab07
mov r10, qword [rcx + 8]
test r8, r8
je 0x1401aaae2
mov rax, qword [r10 + 0x18]
mov rcx, qword [rax + 0x50]
mov eax, dword [rcx + 0x28]
bswap eax
mov dword [r8], eax
test edx, edx
je 0x1401aab04
mov rax, qword [r9]
mov rcx, qword [r10]
mov edx, dword [rax + 0x2f0]
cmp edx, dword [rcx + 0x80]
jle 0x1401aab04
cmp byte [rcx + 0xa], 0
jne fcn.1401b4a10
xor eax, eax
ret
jmp fcn.1401aab20
Function at 0x1401b5390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test byte [rcx + 0x34], 4
mov rdx, qword [rcx + 0x28]
je 0x1401b53b2
mov eax, dword [rcx + 0x30]
cmp dword [rdx + 0x20], eax
jb 0x1401b53b2
cmp dword [rdx + 0x80], 0
jne fcn.1401b7400
xor eax, eax
ret
mov eax, dword [rdx + 0x30]
test eax, eax
jne 0x1401b53d0
mov eax, dword [rdx + 0xc8]
cmp dword [rdx + 0xb8], eax
ja fcn.1401b53e0
jmp fcn.1401b5670
ret
Function at 0x1401c9a30
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov ebx, ecx
call fcn.1400fc3e0
test eax, eax
jne 0x1401c9c68
cmp byte [reloc.WS2_32.dll_accept], al
mov qword [rsp + 0x30], rbp
jne 0x1401c9a5d
xor ebp, ebp
jmp 0x1401c9a87
mov rax, qword [0x14023d740]
mov ecx, 5
call qword [case.0x1400faf48.0]
mov rbp, rax
test rax, rax
je 0x1401c9a87
mov rcx, rax
mov rax, qword [0x14023d750]
call qword [case.0x1400faf48.0]
test ebx, ebx
jle 0x1401c9c44
test rdi, rdi
je 0x1401c9c44
cmp dword [0x140247110], 0
mov qword [rsp + 0x38], rsi
jne 0x1401c9bc9
call fcn.1400fc3e0
test eax, eax
je 0x1401c9ac3
movups xmm0, xmmword [str.expand_32_byte_kh]
movaps xmmword [0x140247110], xmm0
jmp 0x1401c9b3c
cmp byte [reloc.WS2_32.dll_accept], 0
jne 0x1401c9ad5
mov rsi, qword [0x140246e50]
jmp 0x1401c9b29
mov rax, qword [0x14023d740]
mov ecx, 2
mov qword [rsp + 0x40], r14
call qword [case.0x1400faf48.0]
mov r14, rax
test rax, rax
je 0x1401c9b1d
mov rcx, rax
mov rax, qword [0x14023d750]
call qword [case.0x1400faf48.0]
mov rax, qword [0x14023d760]
mov rcx, r14
mov rsi, qword [0x140246e50]
call qword [case.0x1400faf48.0]
jmp 0x1401c9b24
mov rsi, qword [0x140246e50]
mov r14, qword [rsp + 0x40]
movups xmm0, xmmword [str.expand_32_byte_kh]
movaps xmmword [0x140247110], xmm0
test rsi, rsi
jne 0x1401c9b5e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x140247120], xmm0
mov qword [0x140247140], rax
movups xmmword [0x140247130], xmm0
mov dword [0x140247148], eax
jmp 0x1401c9ba9
mov eax, dword [0x14023d880]
test eax, eax
je 0x1401c9b90
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [0x140247120], xmm0
mov dword [0x140247120], eax
movups xmmword [0x140247130], xmm0
mov qword [0x140247140], rcx
mov dword [0x140247148], ecx
jmp 0x1401c9ba9
mov rax, qword [rsi + 0x68]
lea r8, [0x140247120]
mov edx, 0x2c
mov rcx, rsi
call qword [case.0x1400faf48.0]
mov eax, dword [0x140247140]
xor cl, cl
mov byte [0x140247190], cl
mov dword [0x14024714c], eax
mov dword [0x140247140], 0
jmp 0x1401c9bd0
movzx ecx, byte [0x140247190]
movzx eax, cl
lea rsi, [0x140247150]
cmp ebx, eax
jle 0x1401c9c21
nop
test cl, cl
je 0x1401c9bff
movzx r8d, cl
mov rdx, rsi
mov rcx, rdi
call fcn.1400b4460
movzx ecx, byte [0x140247190]
sub ebx, ecx
add rdi, rcx
inc dword [0x140247140]
lea rdx, [0x140247110]
mov rcx, rsi
call fcn.1401c9c80
mov cl, 0x40
mov byte [0x140247190], cl
cmp ebx, 0x40
jg 0x1401c9be0
movzx eax, cl
mov rcx, rdi
sub eax, ebx
movsxd r8, ebx
movsxd rdx, eax
add rdx, rsi
call fcn.1400b4460
sub byte [0x140247190], bl
mov rsi, qword [rsp + 0x38]
jmp 0x1401c9c4e
mov dword [0x140247110], 0
test rbp, rbp
je 0x1401c9c63
mov rax, qword [0x14023d760]
mov rcx, rbp
call qword [case.0x1400faf48.0]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1419acee4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1419aceee
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1419acf17
pop rbp
sub rbp, 0x33
sub rbp, 0x19acee4
sub rsp, 0x20
jmp 0x1419acf36
mov rax, 0x19acee4
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x1d4d54be
xor byte [rax], dl
inc rax
dec rcx
jne 0x1419acf55
jmp 0x1419acf6c
div byte [rdi]
push rdi
xor eax, 0xbebe8237
mov esi, 0xb67f3ff6
mov edi, 0xbff6bebe
push rdi
idiv byte [rcx + 0x7e]
mov esi, 0xf657bff6
jns 0x1419ad000
mov ch, 0xbe
mov esi, 0x7c79f6be
xchg esi, eax
mov esi, 0x49f6bebe
pop rsp
idiv byte [rdi - 0x4dc0ca81]
mov esi, 0xf65c49f6
mov edi, 0xb23f357f
mov esi, 0xbff6bebe
push rsi
out dx, al
out dx, al
test byte [rsi], 0x82
mov ebx, 0xbebebe94
mov esi, 0x1b07f6be
ja 0x1419acf7b
mov edi, 0xbebebebe
idiv byte [rdi - 0x2cfb09a9]
invalid
mov ebx, 0x57bebebe
test al, 0xbe
mov esi, 0xbc567fbe
invalid
mov esi, 0x567fbebe
mov esp, 0x3ff6af8f
scasd eax, dword [rdi]
idiv byte [rdi]
jg 0x1419acf8c
mov esi, 0x41f6bebe
jbe 0x1419acf8a
cmp edx, dword [rax + 0x41]
jge 0x1419acfc6
in al, 0xec
out dx, al
test byte [rsi], 0x82
mov ebx, 0xbebebe94
mov esi, 0x1b07f6be
ja 0x1419acfc0
mov edi, 0xbebebebe
idiv byte [rdi - 0x4144a9a9]
mov esi, 0xbc3357be
mov esi, 0xc356ecbe
xor edi, dword [rsi + rdi*4 - 0x3ca91342]
mov esi, 0xe9e4bebe
div byte [rdi]
imul esi, esi, 0x8ff6778f
insb byte [rdi], dx
cmp eax, 0x41f6bb56
jbe 0x1419acfcd
cmp bl, dl
mov esi, 0x36b1bebe
loopne 0x1419acfe3
mov esi, 0xa235d8be
xchg dword [rsi], edi
push r14
mov cl, 0x3a
movabs byte [0x3ab157453ebebebe], al
lodsd eax, dword [rsi]
mov esi, 0x3fd8bebe
wait
mov cl, 0x3a
movabs eax, dword [0x76577f41f6bebebe]
xchg r15d, eax
xacquire xchg dword [rdi - 0x4480c00a], edi
mov esi, 0x3ff6bebe
push rsi
mov edx, 0x57bebebe
cmovno eax, dword [rcx + 0x41]
xchg edi, eax
invalid
Function at 0x180004bb0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
sub rsp, 0x98
cmp byte [0x18016dcbf], 0
je 0x180004e65
mov qword [rax + 8], rbx
mov ecx, 0x20
mov qword [rax + 0x18], rsi
mov qword [rax - 8], rdi
movaps xmmword [rax - 0x18], xmm6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor edi, edi
movabs rsi, 0xd80958fc74e988a6
xorps xmm6, xmm6
test ax, ax
je 0x180004c66
mov dword [0x180112698], edi
mov dword [0x1801126a8], edi
mov qword [0x180170400], rsi
call fcn.180028a70
movss xmm0, dword [0x1800cf330]
xorps xmm3, xmm3
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x68], 1
mov edx, dword [rax]
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x48], 1
movss dword [rsp + 0x40], xmm6
movss dword [rsp + 0x38], xmm6
movss dword [rsp + 0x30], xmm6
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x20], xmm6
call fcn.18001bc00
movabs rax, 0xd24d37cc275948cc
mov dword [0x1801126a8], edi
mov qword [0x180170400], rax
lea rax, str.GADGET_PARACHUTE
mov qword [0x180112770], rax
mov dword [0x180112698], 1
call fcn.180028a70
mov qword [0x180170400], rsi
mov ebx, dword [rax]
mov dword [0x180112698], edi
mov dword [0x1801126a8], edi
call fcn.180028a70
mov edx, ebx
mov ecx, dword [rax]
call fcn.18001ba30
mov dword [0x180112698], edi
mov dword [0x1801126a8], edi
mov qword [0x180170400], rsi
call fcn.180028a70
mov qword [rsp + 0xa8], rdi
mov ecx, dword [rax]
movabs rax, 0x886e37ec497200b6
mov dword [rsp + 0xa8], ecx
mov qword [0x180170400], rax
mov rax, qword [rsp + 0xa8]
mov qword [0x180112770], rax
mov dword [0x1801126a8], edi
mov dword [0x180112698], 1
call fcn.180028a70
mov rbx, qword [rsp + 0xa0]
cmp dword [rax], edi
je 0x180004e4d
mov dword [0x180112698], edi
mov dword [0x1801126a8], edi
mov qword [0x180170400], rsi
call fcn.180028a70
mov qword [rsp + 0xa8], rdi
mov ecx, dword [rax]
movabs rax, 0x47e4e977581c5b55
mov dword [rsp + 0xa8], ecx
mov qword [0x180170400], rax
mov rax, qword [rsp + 0xa8]
mov qword [0x180112770], rax
mov dword [0x1801126a8], edi
mov dword [0x180112698], 1
call fcn.180028a70
cmp dword [rax], edi
jne 0x180004e4d
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180004dce
mov dword [0x180112698], edi
mov dword [0x1801126a8], edi
mov qword [0x180170400], rsi
call fcn.180028a70
movss xmm1, dword [0x1800cf1a4]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov ecx, dword [rax]
call fcn.180018640
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180004e10
mov dword [0x180112698], edi
mov dword [0x1801126a8], edi
mov qword [0x180170400], rsi
call fcn.180028a70
movss xmm2, dword [0x1800cf280]
xorps xmm3, xmm3
movss xmm1, dword [0x1800cf1a4]
mov ecx, dword [rax]
call fcn.180018640
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180004e4d
mov dword [0x180112698], edi
mov dword [0x1801126a8], edi
mov qword [0x180170400], rsi
call fcn.180028a70
movss xmm1, dword [0x1800cf280]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov ecx, dword [rax]
call fcn.180018640
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x180008110
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0xa8
cmp byte [0x18016dca1], 0
je 0x18000835f
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000835f
mov qword [rsp + 0xb0], rbx
movabs rbx, 0xd80958fc74e988a6
mov qword [rsp + 0xa0], rdi
xor edi, edi
mov dword [0x180112698], edi
mov dword [0x1801126a8], edi
mov qword [0x180170400], rbx
call fcn.180028a70
mov qword [rsp + 0xb8], rdi
mov ecx, dword [rax]
movabs rax, 0x997abd671d25ca0b
mov dword [rsp + 0xb8], ecx
mov qword [0x180170400], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xb8], rdi
mov qword [0x180112770], rax
mov dword [rsp + 0xb8], 1
mov rax, qword [rsp + 0xb8]
mov qword [0x180112778], rax
mov dword [0x1801126a8], edi
mov dword [0x180112698], 2
call fcn.180028a70
cmp dword [rax], edi
je 0x18000834f
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm7
mov dword [0x180112698], edi
mov dword [0x1801126a8], edi
mov qword [0x180170400], rbx
call fcn.180028a70
mov qword [rsp + 0xb8], rdi
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0xb8], ecx
mov qword [0x180170400], rax
mov rax, qword [rsp + 0xb8]
mov qword [0x180112770], rax
mov dword [0x1801126a8], edi
mov qword [0x180112778], rdi
mov dword [0x180112698], 2
call fcn.180028a70
mov qword [rsp + 0xb8], rdi
mov ebx, dword [rax]
movabs rax, 0x866a4a5fae349510
mov qword [0x180170400], rax
mov dword [rsp + 0xb8], ebx
mov rax, qword [rsp + 0xb8]
mov qword [0x180112770], rax
mov dword [0x1801126a8], edi
mov dword [0x180112698], 1
call fcn.180028a70
mov qword [rsp + 0xb8], rdi
xorps xmm6, xmm6
mov dword [rsp + 0xb8], ebx
movss xmm7, dword [rax]
movabs rax, 0x8bb4ef4214e0e6d5
mov qword [0x180170400], rax
addss xmm7, xmm6
mov rax, qword [rsp + 0xb8]
mov qword [0x180112770], rax
mov dword [0x1801126a8], edi
mov dword [0x180112698], 1
call fcn.180028a70
movss xmm0, dword [0x1800cf2b4]
mov edx, ebx
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x68], 1
movss xmm3, dword [rax]
mov dword [rsp + 0x58], 1
addss xmm3, xmm6
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x48], 1
movss dword [rsp + 0x40], xmm6
movss dword [rsp + 0x38], xmm6
movss dword [rsp + 0x30], xmm6
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x20], xmm7
call fcn.18001bc00
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov rbx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xa0]
add rsp, 0xa8
ret
Function at 0x180008df0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
cmp byte [0x18016dc98], 0
je 0x180008f57
mov ecx, 0xa0
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
movabs rcx, 0xd80958fc74e988a6
mov qword [0x180170400], rcx
mov dword [0x180112698], ebx
mov dword [0x1801126a8], ebx
test ax, ax
je 0x180008ec5
call fcn.180028a70
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0x38], ecx
mov qword [0x180170400], rax
mov rax, qword [rsp + 0x38]
mov qword [0x180112770], rax
mov dword [0x1801126a8], ebx
mov qword [0x180112778], rbx
mov dword [0x180112698], 2
call fcn.180028a70
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x222ff6a823d122e2
mov dword [rsp + 0x38], ecx
mov qword [0x180170400], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x38], 1
mov qword [0x180112770], rax
mov rax, qword [rsp + 0x38]
mov qword [0x180112778], rax
jmp 0x180008f3d
call fcn.180028a70
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0x38], ecx
mov qword [0x180170400], rax
mov rax, qword [rsp + 0x38]
mov qword [0x180112770], rax
mov dword [0x1801126a8], ebx
mov qword [0x180112778], rbx
mov dword [0x180112698], 2
call fcn.180028a70
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x222ff6a823d122e2
mov dword [rsp + 0x38], ecx
mov qword [0x180170400], rax
mov rax, qword [rsp + 0x38]
mov qword [0x180112770], rax
mov qword [0x180112778], rbx
mov dword [0x1801126a8], ebx
mov dword [0x180112698], 2
call fcn.180028a70
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x18000b360
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0xa8
cmp byte [0x18016dc6e], 0
je 0x18000b63b
mov ecx, 0x75
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x18000b63b
movabs rax, 0x1bede233e6cd2a1f
mov qword [rsp + 0xb0], rbx
mov qword [0x180170400], rax
mov qword [rsp + 0xa0], rdi
xor edi, edi
mov qword [rsp + 0xb8], rdi
mov dword [rsp + 0xb8], 8
mov rax, qword [rsp + 0xb8]
mov qword [0x180112770], rax
mov dword [0x1801126a8], edi
mov dword [0x180112698], 1
call fcn.180028a70
mov qword [rsp + 0xb8], rdi
mov ebx, dword [rax]
movabs rax, 0xa6db27d19ecbb7da
mov qword [0x180170400], rax
mov dword [rsp + 0xb8], ebx
mov rax, qword [rsp + 0xb8]
mov qword [0x180112770], rax
mov dword [0x1801126a8], edi
mov dword [0x180112698], 1
call fcn.180028a70
cmp dword [rax], edi
je 0x18000b62b
movaps xmmword [rsp + 0x90], xmm6
movabs rax, 0x586afe3ff72d996e
movaps xmmword [rsp + 0x80], xmm7
mov qword [rsp + 0xb8], rdi
mov qword [0x180170400], rax
movaps xmmword [rsp + 0x70], xmm8
mov dword [rsp + 0xb8], ebx
mov rax, qword [rsp + 0xb8]
mov qword [0x180112770], rax
movaps xmmword [rsp + 0x60], xmm9
mov dword [0x1801126a8], edi
mov dword [0x180112698], 1
call fcn.180028a70
movabs rbx, 0xd80958fc74e988a6
mov qword [0x180170400], rbx
movups xmm7, xmmword [rax]
movsd xmm9, qword [rax + 0x10]
mov dword [0x180112698], edi
mov dword [0x1801126a8], edi
call fcn.180028a70
mov qword [rsp + 0xb8], rdi
mov ecx, dword [rax]
movabs rax, 0x997abd671d25ca0b
mov dword [rsp + 0xb8], ecx
mov qword [0x180170400], rax
mov rax, qword [rsp + 0xb8]
mov qword [0x180112770], rax
mov dword [0x1801126a8], edi
mov qword [0x180112778], rdi
mov dword [0x180112698], 2
call fcn.180028a70
movss xmm6, dword [0x1800cf4ac]
movaps xmm8, xmm7
shufps xmm8, xmm7, 0xaa
cmp dword [rax], edi
je 0x18000b5cb
mov dword [0x180112698], edi
mov dword [0x1801126a8], edi
mov qword [0x180170400], rbx
call fcn.180028a70
mov qword [rsp + 0xb8], rdi
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0xb8], ecx
mov qword [0x180170400], rax
mov rax, qword [rsp + 0xb8]
mov qword [0x180112770], rax
mov dword [0x1801126a8], edi
mov qword [0x180112778], rdi
mov dword [0x180112698], 2
call fcn.180028a70
mov dword [0x180112698], edi
mov dword [0x1801126a8], edi
mov qword [0x180170400], rbx
call fcn.180028a70
movaps xmm0, xmm9
movaps xmm3, xmm8
movaps xmm2, xmm7
addss xmm0, xmm6
addss xmm3, xmm6
movabs rcx, 0x9afeff481a85ab2e
mov edx, dword [rax]
addss xmm2, xmm6
movss dword [rsp + 0x20], xmm0
call fcn.18001c240
mov dword [0x180112698], edi
mov dword [0x1801126a8], edi
mov qword [0x180170400], rbx
call fcn.180028a70
addss xmm9, xmm6
mov dword [rsp + 0x38], 1
addss xmm8, xmm6
mov dword [rsp + 0x30], edi
addss xmm7, xmm6
mov ecx, dword [rax]
movaps xmm3, xmm9
movaps xmm2, xmm8
movaps xmm1, xmm7
call fcn.18001bf60
movaps xmm9, xmmword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov rbx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xa0]
add rsp, 0xa8
ret
Function at 0x180018cb0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0xc50
mov rax, qword [0x1800f8408]
xor rax, rsp
mov qword [rsp + 0xc40], rax
mov rdi, rcx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x440]
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
lea edx, [rbp + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x180018dee
mov qword [rsp + 0xc68], rbx
lea rdx, [rsp + 0x440]
mov r8d, 0x3ff
mov qword [rsp + 0xc70], rsi
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs]
cmp qword [0x1801702e8], 0x10
lea rcx, [0x1801702d0]
cmovae rcx, qword [0x1801702d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
xorps xmm0, xmm0
lea rsi, [0x18016d3c0]
mov rbx, rax
lea r8, [0x1800adfd8]
xor eax, eax
lea edx, [rbp + 0x45]
mov rcx, rsi
mov dword [0x18016d400], eax
mov byte [0x18016d404], al
movups xmmword [0x18016d3c0], xmm0
movups xmmword [0x18016d3d0], xmm0
movups xmmword [0x18016d3e0], xmm0
movups xmmword [0x18016d3f0], xmm0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea r8, [rsp + 0x40]
mov rcx, rsi
lea edx, [rbp + 0x45]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov r8, rbx
lea edx, [rbp + 0x45]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov rbx, qword [rsp + 0xc68]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbp
mov r8, 0xffffffffffffffff
mov qword [rdi + 0x18], rbp
nop dword [rax]
inc r8
cmp byte [rsi + r8], bpl
jne 0x180018dd0
mov rdx, rsi
mov rcx, rdi
call fcn.18001b6c0
mov rsi, qword [rsp + 0xc70]
jmp 0x180018e00
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 0xf
mov rax, rdi
mov rcx, qword [rsp + 0xc40]
xor rcx, rsp
call fcn.18009e870
mov rbp, qword [rsp + 0xc78]
add rsp, 0xc50
pop rdi
ret
Function at 0x18001ee30
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
lea rdx, [0x1800b88b0]
lea rcx, [rsp + 0xa0]
call fcn.18001b7d0
mov rbx, rax
lea rcx, [rsp + 0x80]
call fcn.180018cb0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.18001f990
nop
lea r8, [0x180115f58]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.180019ae0
nop
lea rcx, [rsp + 0x60]
call fcn.1800031e0
nop
lea rcx, [rsp + 0x80]
call fcn.1800031e0
nop
lea rcx, [rsp + 0xa0]
call fcn.1800031e0
lea rcx, [rsp + 0x40]
call fcn.18001a790
mov qword [rsp + 0xd0], rax
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.18001f9b0
nop
lea rcx, [rsp + 0x20]
call fcn.180021ad0
movzx ebx, al
lea rcx, [rsp + 0x20]
call fcn.180021890
test bl, bl
je 0x18001ef06
lea rcx, [rsp + 0x40]
call fcn.18001a790
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.180021ed0
lea rcx, str.Cleaning_up_hooks
call fcn.180022a10
call fcn.18001f060
mov rsi, rax
call fcn.18001f070
mov rbx, rax
cmp rax, rsi
je 0x18001ef6f
nop dword [rax]
mov rdi, qword [rbx]
mov rcx, rdi
call fcn.180095bc8
test eax, eax
jne 0x18001ef4d
lea rcx, str.Successfully_disabled_hooks
call fcn.180022a10
jmp 0x18001ef66
mov ecx, eax
call fcn.180095bd0
mov r8, rax
mov rdx, rdi
lea rcx, str.Failed_to_disable_hookS__p___s_
call fcn.180022a10
add rbx, 8
cmp rbx, rsi
jne 0x18001ef30
mov dword [rsp + 0xd0], 0x32
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xd8]
call fcn.1800033b0
mov rcx, rax
call fcn.1800033c0
call fcn.18001f060
mov rsi, rax
call fcn.18001f070
mov rbx, rax
cmp rax, rsi
je 0x18001f000
nop dword [rax]
mov rdi, qword [rbx]
mov rcx, rdi
call fcn.180095984
test eax, eax
jne 0x18001efde
call fcn.1800987f0
lea rcx, str.Successfully_Cleaning_up_hooks
call fcn.180022a10
lea rcx, str.Project_Ice_Successfully_unloaded.
call fcn.180022a10
jmp 0x18001eff7
mov ecx, eax
call fcn.180095bd0
mov r8, rax
mov rdx, rdi
lea rcx, str.Failed_to_unhook__p___s_
call fcn.180022a10
add rbx, 8
cmp rbx, rsi
jne 0x18001efb0
mov dword [rsp + 0xd0], 0x190
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xd8]
call fcn.1800033b0
mov rcx, rax
call fcn.1800033c0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor edx, edx
mov rcx, qword [0x18016dd80]
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]