joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140073e80
Capabilities:
Log keystrokes

Disassembly:
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 8]
mov rdi, rcx
movsxd rdx, dword [rax + 4]
mov rcx, qword [rdx + rcx + 0x10]
test rcx, rcx
je 0x140073fb0
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jb 0x140073fb0
mov rax, qword [rdi + 8]
mov edx, 0xfffffff0
movsxd rcx, dword [rax + 4]
mov rcx, qword [rcx + rdi + 0x10]
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1d
jae 0x140073eea
mov rax, qword [rdi + 8]
mov edx, 9
movsxd rcx, dword [rax + 4]
mov rcx, qword [rcx + rdi + 0x10]
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x30], 0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x140073f80
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x30], eax
je 0x140073f80
mov qword [rsp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, 1
mov ecx, esi
mov edx, eax
mov ebp, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, qword [rdi + 8]
mov ebx, eax
movsxd rcx, dword [rcx + 4]
mov rcx, qword [rcx + rdi + 0x10]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [rdi + 8]
movsxd rcx, dword [rcx + 4]
mov rcx, qword [rcx + rdi + 0x10]
call qword [sym.imp.USER32.dll_BringWindowToTop]
test ebx, ebx
mov rbx, qword [rsp + 0x38]
je 0x140073f93
xor r8d, r8d
mov edx, ebp
mov ecx, esi
call qword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x140073f93
mov rax, qword [rdi + 8]
movsxd rcx, dword [rax + 4]
mov rcx, qword [rcx + rdi + 0x10]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rax, qword [rdi + 8]
movsxd rcx, dword [rax + 4]
mov rcx, qword [rcx + rdi + 0x10]
call qword [sym.imp.USER32.dll_SetActiveWindow]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140083950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x10]
mov rbx, rcx
mov r10d, edx
mov ecx, edx
and r10d, 7
je 0x1400839b6
mov r8d, dword [rbx + 0x14]
cmp edx, r10d
jge 0x1400839a4
mov r9, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r9
jb 0x140083980
xor cl, cl
jmp 0x140083989
movzx ecx, byte [rax]
inc rax
mov qword [rbx], rax
movzx eax, cl
mov ecx, edx
shl eax, cl
add edx, 8
or eax, r8d
mov dword [rbx + 0x10], edx
mov dword [rbx + 0x14], eax
mov r8d, eax
cmp edx, 0x18
jle 0x140083974
mov ecx, r10d
shr r8d, cl
sub edx, r10d
mov dword [rbx + 0x14], r8d
mov dword [rbx + 0x10], edx
mov ecx, edx
xor r9d, r9d
test edx, edx
jle 0x1400839ee
mov edx, dword [rbx + 0x14]
lea r8, [rsp + 0x30]
nop word [rax + rax]
movzx eax, byte [rbx + 0x14]
inc r9d
shr edx, 8
sub ecx, 8
mov byte [r8], al
lea r8, [r8 + 1]
mov dword [rbx + 0x14], edx
test ecx, ecx
jg 0x1400839d0
mov dword [rbx + 0x10], ecx
movsxd rcx, r9d
cmp rcx, 4
jge 0x140083a22
mov r8, qword [rbx + 8]
nop dword [rax + rax]
mov rax, qword [rbx]
cmp rax, r8
jb 0x140083a0c
xor dl, dl
jmp 0x140083a15
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x140083a00
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
je 0x140083a65
lea rax, str.zlib_corrupt
mov qword [0x14012de60], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x140083a94
lea rax, str.read_past_buffer
mov qword [0x14012de60], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x140083aae
mov rcx, rbx
call fcn.140087280
test eax, eax
je 0x140083a87
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.1400ddd9e
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret

Function at 0x140095620
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
lea ecx, [rbx + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 8
test ax, ax
cmovs ebx, ecx
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14009564f
or ebx, 2
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140095662
or ebx, 1
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140095675
or ebx, 4
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140095688
or ebx, 0x20
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140099f10
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
cmp byte [rcx + 0x1ad], 0
movzx esi, r9b
movzx ebp, r8b
movzx ebx, dl
mov rdi, rcx
je 0x140099f60
test dl, dl
je 0x140099f60
mov byte [rcx + 0x1ae], 1
xor r8d, r8d
mov rcx, qword [rcx + 0x88]
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x14009a10c
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
mov r9d, 0x80000023
mov rax, qword [rcx + 0x130]
mov byte [rsp + 0x50], bl
mov byte [rsp + 0x52], sil
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x40], rax
test bpl, bpl
je 0x140099f9a
test bl, bl
mov eax, 0x80000033
cmove r9d, eax
mov rcx, qword [rcx + 0x128]
lea r8, [rsp + 0x40]
lea rdx, [0x14009af00]
mov rax, qword [rcx]
call qword [rax + 0x340]
test rax, rax
jne 0x14009a0f3
test bpl, bpl
jne 0x14009a0a9
mov rcx, qword [rdi + 0x88]
call qword [sym.imp.USER32.dll_GetParent]
mov rbp, rax
test rax, rax
je 0x14009a0a9
cmp qword [rdi + 0x130], 0
je 0x14009a0a9
xor ebx, ebx
mov qword [rsp + 0x70], 0x14
xorps xmm0, xmm0
mov qword [rsp + 0x80], rbx
movdqu xmmword [rsp + 0x8c], xmm0
mov qword [rsp + 0x9c], rbx
mov dword [rsp + 0xa4], ebx
mov qword [rsp + 0x78], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 0x130]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x88], eax
mov rax, qword [rcx]
call qword [rax + 0x360]
mov rdx, qword [rdi + 0x130]
lea r8, str.killfocus
mov byte [rsp + 0x30], 1
xor r9d, r9d
mov byte [rsp + 0x28], bl
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call fcn.140099730
lea ecx, [rbx + 0x10]
mov qword [rdi + 0x130], rbx
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 1
mov edx, 0x8002
test ax, ax
cmovns ebx, ecx
mov rcx, rbp
mov r8d, ebx
or r8, 2
test sil, sil
cmove r8, rbx
xor r9d, r9d
call qword [sym.imp.USER32.dll_PostMessageW]
xor al, al
jmp 0x14009a10e
test bl, bl
je 0x14009a0e9
mov rcx, qword [rdi + 0x128]
lea r8, [rsp + 0x58]
xor eax, eax
lea rdx, [0x14009af00]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x68], bl
mov r9d, 0x80000023
mov byte [rsp + 0x6a], sil
mov rax, qword [rcx]
call qword [rax + 0x340]
jmp 0x14009a0ee
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x14009a105
movzx r9d, sil
mov r8b, 1
mov rdx, rax
mov rcx, rdi
call fcn.140099ad0
mov byte [rdi + 0x1ae], 0
mov al, 1
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400b51f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, qword [rcx + 0xe0]
test rax, rax
je 0x1400b520d
mov rdx, rcx
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
jmp fcn.140099ad0
ret
Function at 0x1400bd660
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, rdx
mov r15, r9
shr rax, 0x10
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
test ax, ax
je 0x1400bd6c8
cmp word [rdx], 0x3c
jne 0x1400bd6be
call fcn.1400bb920
test al, al
jne 0x1400bd754
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
xor r8d, r8d
call fcn.1400bba50
jmp 0x1400bd69b
call fcn.140094f80
mov rcx, rax
mov r8, rbp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1400bd6a3
call fcn.140094f80
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
jne 0x1400bd708
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x1400bd6a3
mov qword [rdi + 0x148], r15
call fcn.140094f80
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
call fcn.1400bbdc0
test al, al
je 0x1400bd6a3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov qword [rdi + 0x150], rbp
mov r9, qword [rsp + 0x68]
mov rdx, r15
mov r8, qword [rsp + 0x60]
mov rcx, rdi
call fcn.1400bcd30
jmp 0x1400bd6a5
Function at 0x1400c53f0
Capabilities:
Get graphical window text

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rdi
mov rax, qword [0x140129718]
xor rax, rbp
mov qword [rbp], rax
cmp byte [rcx + 0x38], 0
mov rbx, rcx
je 0x1400c54e1
cmp qword [rcx + 0x28], 0
je 0x1400c54e1
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea r8d, [rax + 1]
movsxd rax, r8d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400c5450
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400dd0b0
sub rsp, rcx
lea rdi, [rsp + 0x40]
test rdi, rdi
je 0x1400c54e1
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
add rcx, 0x280
call fcn.14008f490
mov rcx, qword [rbx + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x100]
mov rdx, qword [rbx + 0x28]
lea r8, str.textchanged
mov byte [rsp + 0x30], 1
mov rcx, rax
mov byte [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], 0
call fcn.140099730
mov rcx, qword [rbx + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x100]
mov rcx, rax
call fcn.140095520
test al, al
je 0x1400c54e1
mov rcx, qword [rbx + 0x28]
call fcn.1400b21f0
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.1400dc960
mov rbx, qword [rbp + 0x20]
mov rdi, qword [rbp + 0x28]
lea rsp, [rbp + 0x10]
pop rbp
ret

Function at 0x1400c5ec0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400b52f0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x290]
test al, al
jne 0x1400c5f01
cmp qword [rbx + 0x888], 0
je 0x1400c5f01
mov rcx, qword [rbx + 0xe0]
xor r9d, r9d
mov r8b, 1
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.140099ad0
add rsp, 0x20
pop rbx
ret

Function at 0x1400c6080
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400b5cd0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x290]
test al, al
jne 0x1400c60c1
cmp qword [rbx + 0x888], 0
je 0x1400c60c1
mov rcx, qword [rbx + 0xe0]
xor r9d, r9d
mov r8b, 1
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.140099ad0
add rsp, 0x20
pop rbx
ret
Function at 0x1400caf30
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0x830], 0
mov rbp, r9
mov rdi, r8
mov esi, edx
mov rbx, rcx
je 0x1400cb004
cmp edx, 0x100
jne 0x1400caf8d
cmp di, 0xd
jne 0x1400caf8d
cmp byte [rcx + 0x839], 0
jne 0x1400cafb6
cmp byte [rcx + 0x83b], 0
je 0x1400cafcf
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400cafcf
mov rax, qword [rbx + 0x830]
mov r9, rbp
mov r8, rdi
mov edx, esi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx]
mov r10, qword [rax + 0x18]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call r10
jmp 0x1400cb009
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400caf8d
cmp byte [rbx + 0x83b], 0
jne 0x1400caf8d
mov rcx, qword [rbx + 0xe0]
test rcx, rcx
je 0x1400cb000
mov byte [rsp + 0x30], 1
lea r8, str.return
mov byte [rsp + 0x28], 0
xor r9d, r9d
mov rdx, rbx
mov qword [rsp + 0x20], 0
call fcn.140099730
xor eax, eax
jmp 0x1400cb009
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400cc2d0
Capabilities:
Create directory

Disassembly:
test rdx, rdx
je 0x1400cc3f9
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x140129718]
xor rax, rsp
mov qword [rsp + 0x440], rax
movzx eax, word [rdx]
mov rdi, rdx
mov rbx, rcx
test ax, ax
je 0x1400cc3d9
mov qword [rsp + 0x470], rsi
mov rcx, rdx
mov rsi, rdx
cmp ax, 0x2f
je 0x1400cc324
cmp ax, 0x5c
jne 0x1400cc327
mov rsi, rcx
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x1400cc318
cmp rsi, rdi
je 0x1400cc371
sub rsi, rdi
lea rcx, [rsp + 0x20]
sar rsi, 1
mov r8, rsi
call qword [0x1400e7e30]
add rsi, rsi
cmp rsi, 0x208
jae 0x1400cc3fa
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov word [rsp + rsi + 0x20], ax
call fcn.1400cc2d0
lea rcx, [rsp + 0x230]
sub rcx, rbx
nop dword [rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1400cc380
lea rcx, [rsp + 0x230]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400cc3a0
xor edx, edx
nop dword [rax]
movzx eax, word [rdi + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1400cc3b0
xor edx, edx
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rsi, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400dc960
mov rbx, qword [rsp + 0x478]
add rsp, 0x450
pop rdi
ret
call fcn.1400dd208
int3
Function at 0x1400ccab0
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x40
mov r15, rcx
mov ebp, r8d
mov ecx, 0x348
mov r12d, edx
call fcn.1400dc988
xor esi, esi
mov qword [rsp + 0x88], rax
mov rdi, rax
test rax, rax
je 0x1400ccaf7
mov qword [rax], rsi
mov dword [rax + 8], 0xffffffff
mov dword [rax + 0x138], 0xffffffff
jmp 0x1400ccafa
mov rdi, rsi
cmp qword [rdi], 0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], r14
jne 0x1400cccc2
cmp dword [rdi + 8], 0xffffffff
jne 0x1400cccc2
lea rbx, [rdi + 0x13c]
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
sub rbx, 2
cmp word [rbx + 2], 0
lea rbx, [rbx + 2]
jne 0x1400ccb31
mov eax, dword [0x1400e8994]
mov dword [rbx], eax
cmp ebp, 1
jne 0x1400ccb65
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, ebp
je 0x1400ccb77
mov dword [0x14012e418], 0x2000000
jmp 0x1400ccccc
lea eax, [rbp - 2]
cmp eax, 1
jbe 0x1400ccb77
mov eax, 0x10000
jmp 0x1400ccca4
xor r14b, r14b
mov qword [rsp + 0x88], rsi
cmp ebp, 1
je 0x1400ccbd2
cmp ebp, 2
jne 0x1400ccc2e
mov qword [rsp + 0x30], rsi
lea r8d, [rbp - 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x88], rax
cmp rax, 0xffffffffffffffff
jne 0x1400ccc1e
mov eax, 0x200
jmp 0x1400ccca4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x88]
mov rcx, rax
mov dword [rsp + 0x28], esi
mov r8, rbx
mov dword [rsp + 0x20], esi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x1400ccc16
mov eax, 0x100
jmp 0x1400ccca4
mov rax, qword [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
sete r14b
mov ecx, 0x28
call fcn.1400dc988
lea ecx, [rbp - 1]
mov rbx, rax
cmp ecx, 1
jbe 0x1400ccc58
mov word [rax], 0x100
mov qword [rax + 0x18], r15
mov dword [rax + 0x20], r12d
mov dword [rax + 0x24], esi
mov dword [rax + 0x14], esi
jmp 0x1400ccc93
mov byte [rax], 1
mov byte [rax + 1], r14b
mov rax, qword [rsp + 0x88]
mov qword [rbx + 8], rax
mov byte [rbx + 0x10], 0
mov dword [rbx + 0x14], esi
test r14b, r14b
je 0x1400ccc93
mov rcx, qword [rsp + 0x88]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbx + 0x14], eax
mov rcx, rbx
call fcn.1400cff90
mov qword [rdi], rax
mov eax, dword [0x14012e41c]
mov dword [0x14012e418], eax
test eax, eax
jne 0x1400ccccc
lea ecx, [rax + 0x10]
call fcn.1400dc988
mov dword [rax], 1
mov qword [rax + 8], rdi
jmp 0x1400cccd6
mov dword [0x14012e418], 0x1000000
mov rcx, rdi
call fcn.1400dc980
xor eax, eax
mov r14, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400cf7e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov r10, r8
mov rdi, r9
imul r10d, edx
mov rsi, rdx
cmp byte [r9], 0
mov r11, rcx
je 0x1400cf83a
mov rdx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x48]
mov r8d, r10d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400cf826
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov edx, dword [r9 + 0x24]
mov ecx, dword [r9 + 0x20]
sub ecx, edx
mov qword [rsp + 0x40], rbx
lea eax, [rdx + r10]
cmp eax, dword [r9 + 0x20]
cmovbe ecx, r10d
add rdx, qword [r9 + 0x18]
mov ebx, ecx
mov r8d, ecx
mov rcx, r11
call fcn.1400ddd9e
add dword [rdi + 0x24], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400cf910
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x1400cf91b
xor eax, eax
ret
lea r11, [0x1400fd540]
not ecx
cmp r8d, 8
jb 0x1400cf9f1
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1400cf940
test r8d, r8d
je 0x1400cfa1d
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x1400cfa00
not ecx
mov eax, ecx
ret
Function at 0x1400d0ef0
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
sub rsp, 0x38
cmp byte [rcx], 0
mov r14, rdx
mov qword [rsp + 0x58], rbp
mov rbx, rcx
mov qword [rsp + 0x30], rdi
mov edi, 1
je 0x1400d0f40
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x60]
mov r8d, edi
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400d0f3a
mov byte [rbx + 0x10], dil
mov ebp, dword [rsp + 0x60]
jmp 0x1400d0f77
mov qword [rsp + 0x68], rsi
mov esi, dword [rcx + 0x24]
mov ecx, dword [rcx + 0x20]
lea eax, [rsi + 1]
cmp eax, ecx
jbe 0x1400d0f56
mov edi, ecx
sub edi, esi
mov rdx, rsi
mov r8d, edi
add rdx, qword [rbx + 0x18]
lea rcx, [rsp + 0x50]
mov ebp, edi
call fcn.1400ddd9e
lea eax, [rsi + rdi]
mov rsi, qword [rsp + 0x68]
mov dword [rbx + 0x24], eax
mov rdi, qword [rsp + 0x30]
cmp ebp, 1
mov rbp, qword [rsp + 0x58]
jne 0x1400d0f98
movzx eax, byte [rsp + 0x50]
mov dword [r14], eax
xor eax, eax
add rsp, 0x38
pop r14
pop rbx
ret
cmp byte [rbx], 0
je 0x1400d0f8e
cmp byte [rbx + 0x10], 0
je 0x1400d0f8e
mov eax, 0xffffffff
add rsp, 0x38
pop r14
pop rbx
ret

Function at 0x1400d48e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rcx
mov rcx, qword [rcx + 0x7f8]
test rcx, rcx
je 0x1400d48f9
mov rax, qword [rcx]
jmp qword [rax + 0x2e0]
mov rcx, rax
jmp method.CUIComboEx.virtual_736
Function at 0x140011098
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x1400110d6
cmp word [rcx], 0x5a4d
jne 0x1400110d6
movsxd rdx, dword [rcx + 0x3c]
cmp edx, 0x400
jg 0x1400110d6
call fcn.1400075c9
mov rcx, qword [0x140135d70]
mov rbx, rax
call fcn.140015130
cmp byte [rax], 0
jne 0x1400110d6
cmp dword [rbx], 0x4550
je 0x1400110d8
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400142a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call fcn.14001a1d0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop dword [rax]

Function at 0x140014310
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14013ab04]
test esi, esi
mov rbx, rcx
jle 0x140014440
mov rax, qword [0x14013ab08]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14001435b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400143e5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140014340
mov rcx, rbx
call fcn.140014d80
test rax, rax
mov rdi, rax
je 0x140014462
mov rax, qword [0x14013ab08]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140014ec0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14013ab08]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140014447
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400143de
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400143f0
add dword [0x14013ab04], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov r8d, 0x40
mov eax, 4
mov rcx, qword [rsp + 0x20]
cmove r8d, eax
mov rdx, qword [rsp + 0x38]
add rbx, qword [0x14013ab08]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400143de
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400142a0
nop dword [rax]
xor esi, esi
jmp 0x140014368
mov rax, qword [0x14013ab08]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [rdi + 8]
mov r8, qword [rax + rbx + 0x18]
call fcn.1400142a0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.1400142a0
nop
nop word cs:[rax + rax]
nop dword [rax]