joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180583058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1805831df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180583089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18058306f
add dl, dl
jne 0x180583096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805830f6
xor eax, eax
add dl, dl
jne 0x1805830a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805831ad
add dl, dl
jne 0x1805830b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805830c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805830d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805830dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1805830ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18058307e
mov eax, 1
add dl, dl
jne 0x180583106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180583113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805830fb
sub eax, ebx
mov ebx, 1
jne 0x18058314c
mov ecx, 1
add dl, dl
jne 0x18058312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18058313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180583123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18058307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180583168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180583175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18058315d
cmp eax, 0x7d00
jae 0x18058319b
cmp eax, 0x500
jb 0x180583196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18058307e
cmp eax, 0x7f
ja 0x18058319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18058307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1805831d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18058307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140003da1
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [section..data]
syscall
ret

Function at 0x140004510
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000455a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000455a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000455a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000455a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000455a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000455c
xor al, al
add rsp, 0x28
ret

Function at 0x140008b54
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140008950
Function at 0x14000b5b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000b637
mov rsi, rbx
cmp word [rax], bp
je 0x14000b5f6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000b5e0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14000b5dc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000bfd0
mov rdi, rax
test rax, rax
je 0x14000b624
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140016240
mov rbp, rdi
xor ecx, ecx
call fcn.14000a278
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140010780
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400107a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400107a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140015690
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
xor ebx, ebx
mov rdi, rcx
mov eax, ebx
nop dword [rax]
nop dword [rax + rax]
mov byte [rsp + rax + 0x20], bl
inc rax
cmp rax, 0x11c
jb 0x1400156b0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.ntdll.dll_RtlGetVersion]
test eax, eax
js 0x14001593d
mov eax, dword [rsp + 0x24]
cmp eax, 0xa
jne 0x14001580c
cmp dword [rsp + 0x28], ebx
jne 0x1400158f3
mov eax, dword [rsp + 0x2c]
cmp eax, 0x47ba
ja 0x140015791
je 0x140015787
cmp eax, 0x3ad7
ja 0x140015750
je 0x140015746
cmp eax, 0x2800
je 0x14001573c
cmp eax, 0x295a
je 0x140015732
cmp eax, 0x3839
jne 0x1400158f3
mov ebx, 0xf
jmp 0x1400158f8
mov ebx, 0xe
jmp 0x1400158f8
mov ebx, 0xd
jmp 0x1400158f8
mov ebx, 0x10
jmp 0x1400158f8
cmp eax, 0x3fab
je 0x14001577d
cmp eax, 0x42ee
je 0x140015773
cmp eax, 0x4563
jne 0x1400158f3
mov ebx, 0x13
jmp 0x1400158f8
mov ebx, 0x12
jmp 0x1400158f8
mov ebx, 0x11
jmp 0x1400158f8
mov ebx, 0x14
jmp 0x1400158f8
cmp eax, 0x4a63
ja 0x1400157d7
je 0x1400157cd
sub eax, 0x47bb
je 0x1400157c3
sub eax, 0x2a6
je 0x1400157b9
cmp eax, 1
jne 0x1400158f3
lea ebx, [rax + 0x16]
jmp 0x1400158f8
mov ebx, 0x16
jmp 0x1400158f8
mov ebx, 0x15
jmp 0x1400158f8
mov ebx, 0x18
jmp 0x1400158f8
sub eax, 0x4a64
je 0x140015802
sub eax, 1
je 0x1400157f8
cmp eax, 0x517
jne 0x1400158f3
mov ebx, 0x1b
jmp 0x1400158f8
mov ebx, 0x1a
jmp 0x1400158f8
mov ebx, 0x19
jmp 0x1400158f8
cmp eax, 0xb
jne 0x140015861
cmp dword [rsp + 0x28], ebx
jne 0x1400158f3
mov eax, dword [rsp + 0x2c]
sub eax, 0x55f0
je 0x140015857
sub eax, 0x26d
je 0x14001584d
sub eax, 0xa
je 0x140015843
cmp eax, 2
jne 0x1400158f3
lea ebx, [rax + 0x1d]
jmp 0x1400158f8
mov ebx, 0x1e
jmp 0x1400158f8
mov ebx, 0x1d
jmp 0x1400158f8
mov ebx, 0x1c
jmp 0x1400158f8
cmp eax, 6
jne 0x1400158bf
mov eax, dword [rsp + 0x28]
cmp eax, 3
jne 0x140015877
lea ebx, [rax + 9]
jmp 0x1400158f8
cmp eax, 2
jne 0x140015881
lea ebx, [rax + 9]
jmp 0x1400158f8
cmp eax, 1
jne 0x140015896
cmp dword [rsp + 0x2c], 0x1db1
sete bl
add ebx, 9
jmp 0x1400158f8
test eax, eax
jne 0x1400158f3
mov eax, dword [rsp + 0x2c]
sub eax, 0x1771
je 0x1400158b8
cmp eax, 1
je 0x1400158b1
mov ebx, 6
jmp 0x1400158f8
mov ebx, 8
jmp 0x1400158f8
mov ebx, 7
jmp 0x1400158f8
cmp eax, 5
jne 0x1400158f3
mov eax, dword [rsp + 0x28]
cmp eax, 2
jne 0x1400158dd
cmp dword [rsp + 0x2c], 0xece
setne bl
add ebx, 3
jmp 0x1400158f8
cmp eax, 1
jne 0x1400158ef
cmp dword [rsp + 0x2c], 0xa28
setne bl
jmp 0x1400158f8
test eax, eax
je 0x1400158f8
mov ebx, 0xffffffff
lea rdx, [0x140000000]
movsxd rax, ebx
lea rcx, [rax*4]
mov eax, dword [rcx + rdx + 0x1e950]
mov dword [rdi], eax
mov eax, dword [rcx + rdx + 0x1e850]
mov dword [rdi + 8], eax
mov eax, dword [rcx + rdx + 0x1e8d0]
mov dword [rdi + 4], eax
mov eax, 1
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret
mov rbx, qword [rsp + 0x150]
xor eax, eax
add rsp, 0x140
pop rdi
ret
Function at 0x1400046b4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x28
movsxd rdx, dword [rcx + 0x108]
mov r9d, 4
mov rax, qword [rcx + 0x110]
mov r8d, dword [rax + rdx*4 - 4]
lea rdx, [rsp + 0x38]
not r8d
movzx eax, byte [rdx]
inc rdx
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x14003ad70]
xor r8d, dword [rax + rcx*4]
sub r9, 1
jne 0x1400046dd
not r8d
mov ecx, r8d
call fcn.140004814
mov eax, r8d
add rsp, 0x28
ret

Function at 0x14000e744
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140084040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [0x140084940]
mov r10d, 4
mov dword [rsp + 0x20], ecx
mov r9, qword [rax + 0x1b90]
movsxd rcx, dword [r9 + 0x108]
mov rax, qword [r9 + 0x110]
mov r8d, dword [rax + rcx*4 - 4]
lea rcx, [rsp + 0x20]
not r8d
movzx eax, byte [rcx]
inc rcx
movzx edx, r8b
xor rdx, rax
shr r8d, 8
lea rax, [0x14003ad70]
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x14000e78a
not r8d
lea rdx, [rsp + 0x20]
lea rcx, [r9 + 0x108]
mov dword [rsp + 0x20], r8d
call fcn.14001c878
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140037f40
add rsp, 0x38
ret

Function at 0x1400134b4
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, qword [0x140084940]
cmp byte [rbx + 0x3000], 0
je 0x140013575
cmp qword [rbx + 0x3008], 0
lea rbp, [rax + 0x10]
lea rdi, [rbx + 0x3010]
je 0x140013567
mov r9d, dword [rdi + 4]
test r9d, r9d
jns 0x14001351f
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001cbb8
mov rcx, qword [rsp + 0x40]
and dword [rdi], 0
mov rdx, rcx
mov rcx, rdi
mov r8, rbp
call fcn.140002ec4
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x3008]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x140084938]
movsxd r8, eax
mov rax, qword [rbx + 0x3018]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x140013575
mov rdx, rcx
mov r8, rbp
mov rcx, rdi
call fcn.140002ec4
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret

Function at 0x140013bd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140084940]
mov rbx, rcx
and dword [rax + 0x2fbc], 0
test rcx, rcx
je 0x140013c39
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.140013c44
lea rdx, [0x14003a7ec]
mov rcx, rbx
mov rdi, rax
call fcn.140002664
mov rbx, rax
test rax, rax
je 0x140013c39
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140038bb8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140038c02
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140038c02
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140038c02
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140038c02
cmp dword [rcx + 0x84], 0xe
jbe 0x140038c02
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140038c04
xor al, al
add rsp, 0x28
ret
Function at 0x140001096
Capabilities:
Write file on windows

Disassembly:
jmp 0x140011f80
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14002e0eb]
call fcn.140001884
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140011fd7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400120e3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001207c
cmp qword [rbp + 0x28], 0
jle 0x14001207c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001201c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140001816
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x1400120d2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x1400120d2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14000148d
Capabilities:
Terminate process

Disassembly:
jmp 0x1400174c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400015aa
Capabilities:
Parse pe header

Disassembly:
jmp 0x140016880
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400168a0
xor al, al
jmp 0x140016921
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400168b3
xor al, al
jmp 0x140016921
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400168dd
xor al, al
jmp 0x140016921
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400168f1
xor al, al
jmp 0x140016921
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140016903
xor al, al
jmp 0x140016921
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001691f
xor al, al
jmp 0x140016921
mov al, 1
add rsp, 0x38
ret
Function at 0x140001861
Capabilities:
Write file on windows

Disassembly:
jmp 0x14000bf70
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x140027040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x14002e0eb]
call fcn.140001884
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x14000bfd6
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000bfdd
mov al, 1
jmp 0x14000c12d
call fcn.14000123a
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.14000123a
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.14000168b
movzx eax, al
test eax, eax
je 0x14000c02e
xor al, al
jmp 0x14000c12d
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x14000c093
cmp dword [rbp + 0x154], 1
je 0x14000c09e
cmp dword [rbp + 0x154], 3
je 0x14000c11c
jmp 0x14000c12b
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14000c0ee
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14000c0ee
xor al, al
jmp 0x14000c12d
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000c109
mov dword [rbp + 0x154], 1
jmp 0x14000c113
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14000c12d
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14000c12d
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001fa90]
call fcn.1400016ea
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.1400013de
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret

Function at 0x140008070
Capabilities:
Log keystrokes via application hook

Disassembly:
jmp 0x140008070
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14002e100]
call fcn.140001884
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14000126c]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x140027880], rax
cmp qword [0x140027880], 0
jne 0x1400080e0
lea rax, str.Failed_to_install_hook_
mov qword [rbp + 8], rax
lea rax, str.Error
mov qword [rbp + 0x28], rax
mov r9d, 0x10
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14000bf70
Capabilities:
Write file on windows

Disassembly:
jmp 0x14000bf70
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x140027040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x14002e0eb]
call fcn.140001884
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x14000bfd6
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000bfdd
mov al, 1
jmp 0x14000c12d
call fcn.14000123a
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.14000123a
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.14000168b
movzx eax, al
test eax, eax
je 0x14000c02e
xor al, al
jmp 0x14000c12d
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x14000c093
cmp dword [rbp + 0x154], 1
je 0x14000c09e
cmp dword [rbp + 0x154], 3
je 0x14000c11c
jmp 0x14000c12b
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14000c0ee
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14000c0ee
xor al, al
jmp 0x14000c12d
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000c109
mov dword [rbp + 0x154], 1
jmp 0x14000c113
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14000c12d
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14000c12d
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001fa90]
call fcn.1400016ea
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.1400013de
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x140011f80
Capabilities:
Write file on windows

Disassembly:
jmp 0x140011f80
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14002e0eb]
call fcn.140001884
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140011fd7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400120e3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001207c
cmp qword [rbp + 0x28], 0
jle 0x14001207c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001201c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140001816
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x1400120d2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x1400120d2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret