joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004db0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rdx
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
lea rdx, [rsp + 0x60]
call fcn.1400011e0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140004e1b
mov qword [rsp + 0x50], 0
xor bl, bl
jmp 0x140004e6b
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [rbx + rax*2], 0
jne 0x140004e20
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov ebx, 1
mov r9d, ebx
xor r8d, r8d
lea rdx, str.RunNitroVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140004e63
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
jmp 0x140004e65
xor ebx, ebx
cmp ebx, 1
sete bl
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
add rsp, 0x40
pop rbx
ret
Function at 0x140005710
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, str.Nitro_updateService_OnStart_entered
call fcn.1400049d0
xor eax, eax
lea rcx, [0x140005cf0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.mfc120u.dll_Ordinal_2107]
lea rcx, str.Nitro_updateService_OnStart_exited
mov qword [rbx + 0x18], rax
add rsp, 0x30
pop rbx
jmp fcn.1400049d0
Function at 0x1400066d0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rdi, rdx
mov rbx, rcx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000680f
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
mov rdx, rbx
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc120u.dll_Ordinal_286]
nop
mov edx, 0x5c
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc120u.dll_Ordinal_12433]
test eax, eax
js 0x140006759
lea r8d, [rax + 1]
xor edx, edx
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc120u.dll_Ordinal_3683]
mov rdx, rdi
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc120u.dll_Ordinal_286]
nop
xor r8d, r8d
lea rdx, [0x140010670]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc120u.dll_Ordinal_4467]
mov edx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc120u.dll_Ordinal_13902]
lea rdx, str.__quiet
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc120u.dll_Ordinal_2373]
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
lea rdx, str._s__s
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc120u.dll_Ordinal_4612]
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax - 0x10]
lea ecx, [rcx*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.NitroInstaller
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x140006830
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006871
mov rcx, qword [rsp + 0x40]
lea rdx, str.NitroInstaller
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret
Function at 0x1400078b0
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1b8]
sub rsp, 0x2a0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov r14, rdx
mov rbx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
mov r9, r14
mov r8, rbx
lea rdx, str._s_s
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc120u.dll_Ordinal_4612]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x140007934
xor sil, sil
jmp 0x140007a42
lea rdx, [0x14000fabc]
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc120u.dll_Ordinal_2373]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc120u.dll_Ordinal_1496]
lea rdx, [0x140010730]
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc120u.dll_Ordinal_2373]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
xor sil, sil
cmp rax, 0xffffffffffffffff
je 0x140007a42
nop dword [rax + rax]
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc120u.dll_Ordinal_1498]
mov r8d, 4
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc120u.dll_Ordinal_12470]
nop
lea rdx, str..msi
mov rcx, rax
call qword [sym.imp.mfc120u.dll_Ordinal_2867]
test eax, eax
sete bl
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
test bl, bl
jne 0x1400079ef
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140007a38
jmp 0x140007990
mov r8, qword [rsp + 0x28]
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc120u.dll_Ordinal_7629]
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140005040
nop
mov rdx, r14
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc120u.dll_Ordinal_2867]
movzx esi, sil
mov ecx, 1
test eax, eax
cmove esi, ecx
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
movzx eax, sil
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14000cd50
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000a530
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rdi, r8
mov rbx, rcx
mov dword [rsp + 0x20], 0
call qword [sym.imp.mfc120u.dll_Ordinal_286]
mov dword [rsp + 0x20], 1
mov rax, qword [rbx]
mov edx, dword [rax - 0x10]
dec edx
mov rcx, rbx
call qword [sym.imp.mfc120u.dll_Ordinal_4822]
cmp ax, 0x5c
je 0x14000a58b
lea rdx, [0x14000fabc]
mov rcx, rbx
call qword [sym.imp.mfc120u.dll_Ordinal_2373]
lea rdx, str.NPUpdate
mov rcx, rbx
call qword [sym.imp.mfc120u.dll_Ordinal_2373]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000a5b4
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [0x14000fabc]
mov rcx, rbx
call qword [sym.imp.mfc120u.dll_Ordinal_2373]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.mfc120u.dll_Ordinal_2373]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000a5e7
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14000a600
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push rdi
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x280], rbx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rdx
mov rdi, rcx
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
cmp dword [rdi + 0x10], 0
je 0x14000a6e9
xor edx, edx
mov r8d, Ordinal_265
lea rcx, [rsp + 0x50]
call sub.MSVCR120.dll_memset
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14000a6e9
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.mfc120u.dll_Ordinal_13477]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x30]
cmp dword [rdi + 0x10], 1
lea rdx, str.NitroProUpdate
je 0x14000a6ad
lea rdx, str.NitroReaderUpdate
call qword [sym.imp.mfc120u.dll_Ordinal_13477]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.mfc120u.dll_Ordinal_2372]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000a6da
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
jmp 0x14000a6eb
xor bl, bl
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
movzx eax, bl
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14000cd50
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x14000c1e0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, qword [rcx]
cmp dword [rbx - 0x10], 0
jne 0x14000c208
xor al, al
jmp 0x14000c27f
xor eax, eax
lea rcx, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rax
mov r8d, 0x208
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
call sub.MSVCR120.dll_memset
movsxd r8, dword [rbx - 0x10]
lea rcx, [rsp + 0x60]
add r8, r8
mov rdx, rbx
call sub.MSVCR120.dll_memcpy
lea rax, [rsp + 0x60]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov eax, 0x614
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14000cd50
add rsp, 0x280
pop rbx
ret
Function at 0x140081dd0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140081ddd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140081ded
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140081dd5
lea eax, [rcx + 1]
jmp 0x140081dfb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140081e0e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140081df4
sub eax, 3
jb 0x140081e2e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140081e7d
sar eax, 1
movsxd rbp, eax
jb 0x140081e64
jmp 0x140081e3c
add ebx, ebx
jne 0x140081e3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140081e64
inc ecx
add ebx, ebx
jne 0x140081e4a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140081e64
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140081e5d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140081e4c
add ecx, 2
jmp 0x140081e69
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140081d92
jmp 0x140081ddd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x28800
mov dl, 0x12
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140081ec9
cmp rsi, rcx
jae 0x140081ed1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140081eb0
cmp al, 0x8f
ja 0x140081eb0
cmp byte [rsi - 2], 0xf
je 0x140081eb6
sub al, 0xe8
cmp al, 1
ja 0x140081e9a
cmp rsi, rcx
jae 0x140081ed1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140081ea0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140081ed1
lodsb al, byte [rsi]
jmp 0x140081eb0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x7f000]
mov eax, dword [rdi]
or eax, eax
je 0x140081f3a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xae81c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140081ede
jns 0x140081f13
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140081f1d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140081f34
mov qword [rbx], rax
add rbx, 8
jmp 0x140081efe
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140081f74
cmp al, 0xef
ja 0x140081f66
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140081f46
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140081f55
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140081fc8
sub rsp, 0xffffffffffffff80
jmp 0x14000afa0
Function at 0x14004a6b0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14004a6bd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14004a6cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14004a6b5
lea eax, [rcx + 1]
jmp 0x14004a6db
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14004a6ee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14004a6d4
sub eax, 3
jb 0x14004a70e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14004a75d
sar eax, 1
movsxd rbp, eax
jb 0x14004a744
jmp 0x14004a71c
add ebx, ebx
jne 0x14004a71a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14004a744
inc ecx
add ebx, ebx
jne 0x14004a72a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14004a744
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14004a73d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14004a72c
add ecx, 2
jmp 0x14004a749
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14004a672
jmp 0x14004a6bd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2b000
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14004a7a9
cmp rsi, rcx
jae 0x14004a7b1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14004a790
cmp al, 0x8f
ja 0x14004a790
cmp byte [rsi - 2], 0xf
je 0x14004a796
sub al, 0xe8
cmp al, 1
ja 0x14004a77a
cmp rsi, rcx
jae 0x14004a7b1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14004a780
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14004a7b1
lodsb al, byte [rsi]
jmp 0x14004a790
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x48000]
mov eax, dword [rdi]
or eax, eax
je 0x14004a80e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x4a56c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14004a7be
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14004a808
mov qword [rbx], rax
add rbx, 8
jmp 0x14004a7de
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14004a848
cmp al, 0xef
ja 0x14004a83a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14004a81a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14004a829
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14004a89c
sub rsp, 0xffffffffffffff80
jmp 0x14000b820
Function at 0x180005960
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0xa8
cmp byte [0x18017766b], 0
je 0x180005baf
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180005baf
mov qword [rsp + 0xb0], rbx
movabs rbx, 0xd80958fc74e988a6
mov qword [rsp + 0xa0], rdi
xor edi, edi
mov dword [0x180138b98], edi
mov dword [0x180138ba8], edi
mov qword [0x180178998], rbx
call fcn.180028e50
mov qword [rsp + 0xb8], rdi
mov ecx, dword [rax]
movabs rax, 0x997abd671d25ca0b
mov dword [rsp + 0xb8], ecx
mov qword [0x180178998], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xb8], rdi
mov qword [0x180138c70], rax
mov dword [rsp + 0xb8], 1
mov rax, qword [rsp + 0xb8]
mov qword [0x180138c78], rax
mov dword [0x180138ba8], edi
mov dword [0x180138b98], 2
call fcn.180028e50
cmp dword [rax], edi
je 0x180005b9f
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm7
mov dword [0x180138b98], edi
mov dword [0x180138ba8], edi
mov qword [0x180178998], rbx
call fcn.180028e50
mov qword [rsp + 0xb8], rdi
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0xb8], ecx
mov qword [0x180178998], rax
mov rax, qword [rsp + 0xb8]
mov qword [0x180138c70], rax
mov dword [0x180138ba8], edi
mov qword [0x180138c78], rdi
mov dword [0x180138b98], 2
call fcn.180028e50
mov qword [rsp + 0xb8], rdi
mov ebx, dword [rax]
movabs rax, 0x866a4a5fae349510
mov qword [0x180178998], rax
mov dword [rsp + 0xb8], ebx
mov rax, qword [rsp + 0xb8]
mov qword [0x180138c70], rax
mov dword [0x180138ba8], edi
mov dword [0x180138b98], 1
call fcn.180028e50
mov qword [rsp + 0xb8], rdi
xorps xmm6, xmm6
mov dword [rsp + 0xb8], ebx
movss xmm7, dword [rax]
movabs rax, 0x8bb4ef4214e0e6d5
mov qword [0x180178998], rax
addss xmm7, xmm6
mov rax, qword [rsp + 0xb8]
mov qword [0x180138c70], rax
mov dword [0x180138ba8], edi
mov dword [0x180138b98], 1
call fcn.180028e50
movss xmm0, dword [0x1801042f0]
mov edx, ebx
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x68], 1
movss xmm3, dword [rax]
mov dword [rsp + 0x58], 1
addss xmm3, xmm6
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x48], 1
movss dword [rsp + 0x40], xmm6
movss dword [rsp + 0x38], xmm6
movss dword [rsp + 0x30], xmm6
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x20], xmm7
call fcn.18001bcc0
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov rbx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xa0]
add rsp, 0xa8
ret
Function at 0x1800062a0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
cmp byte [0x180177662], 0
je 0x180006407
mov ecx, 0xa0
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
movabs rcx, 0xd80958fc74e988a6
mov qword [0x180178998], rcx
mov dword [0x180138b98], ebx
mov dword [0x180138ba8], ebx
test ax, ax
je 0x180006375
call fcn.180028e50
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0x38], ecx
mov qword [0x180178998], rax
mov rax, qword [rsp + 0x38]
mov qword [0x180138c70], rax
mov dword [0x180138ba8], ebx
mov qword [0x180138c78], rbx
mov dword [0x180138b98], 2
call fcn.180028e50
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x222ff6a823d122e2
mov dword [rsp + 0x38], ecx
mov qword [0x180178998], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x38], 1
mov qword [0x180138c70], rax
mov rax, qword [rsp + 0x38]
mov qword [0x180138c78], rax
jmp 0x1800063ed
call fcn.180028e50
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0x38], ecx
mov qword [0x180178998], rax
mov rax, qword [rsp + 0x38]
mov qword [0x180138c70], rax
mov dword [0x180138ba8], ebx
mov qword [0x180138c78], rbx
mov dword [0x180138b98], 2
call fcn.180028e50
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x222ff6a823d122e2
mov dword [rsp + 0x38], ecx
mov qword [0x180178998], rax
mov rax, qword [rsp + 0x38]
mov qword [0x180138c70], rax
mov qword [0x180138c78], rbx
mov dword [0x180138ba8], ebx
mov dword [0x180138b98], 2
call fcn.180028e50
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x18000d700
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
sub rsp, 0x28
cmp byte [0x18017761d], 0
je 0x18000d736
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000d736
mov ecx, 0x73
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000d736
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x28
ret
Function at 0x18000ee30
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
sub rsp, 0x78
cmp byte [0x18017760f], 0
je 0x18000f043
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
movabs rsi, 0xd80958fc74e988a6
mov qword [rax - 8], rdi
xor edi, edi
mov dword [0x180138b98], edi
mov dword [0x180138ba8], edi
movaps xmmword [rax - 0x18], xmm6
mov qword [0x180178998], rsi
call fcn.180028e50
mov qword [rsp + 0x88], rdi
mov ecx, dword [rax]
movabs rax, 0x3fef770d40960d5a
mov dword [rsp + 0x88], ecx
mov qword [0x180178998], rax
mov rax, qword [rsp + 0x88]
mov qword [0x180138c70], rax
mov dword [0x180138ba8], edi
mov qword [0x180138c78], rdi
mov dword [0x180138b98], 2
call fcn.180028e50
movsd xmm0, qword [rax + 0x10]
movups xmm6, xmmword [rax]
movabs rax, 0xd24d37cc275948cc
mov dword [0x180138ba8], edi
movsd qword [rsp + 0x50], xmm0
mov qword [0x180178998], rax
lea rax, str.prop_boogieboard_05
mov qword [0x180138c70], rax
mov dword [0x180138b98], 1
call fcn.180028e50
mov ebx, dword [rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x180178c88]
cmp eax, 0x64
jb 0x18000f029
movss xmm3, dword [rsp + 0x50]
movaps xmm2, xmm6
subss xmm3, dword [0x1801041f0]
shufps xmm2, xmm6, 0xaa
movaps xmm1, xmm6
subss xmm2, dword [0x1801041f0]
mov dword [rsp + 0x30], 1
mov ecx, ebx
mov dword [rsp + 0x28], 1
call fcn.18001c010
mov ebx, eax
mov dword [0x180138b98], edi
mov dword [0x180138ba8], edi
mov qword [0x180178998], rsi
call fcn.180028e50
mov qword [rsp + 0x88], rdi
mov ecx, dword [rax]
movabs rax, 0xe83d4f9ba2a38914
mov dword [rsp + 0x88], ecx
mov rcx, qword [rsp + 0x88]
mov qword [0x180138c70], rcx
mov dword [0x180138ba8], edi
mov qword [0x180178998], rax
mov dword [0x180138b98], 1
call fcn.180028e50
mov qword [rsp + 0x88], rdi
mov dword [rsp + 0x88], ebx
movss xmm0, dword [rax]
movabs rax, 0x8e2530aa8ada980e
mov qword [0x180178998], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x88], rdi
movss dword [rsp + 0x88], xmm0
mov qword [0x180138c70], rax
mov rax, qword [rsp + 0x88]
mov qword [0x180138c78], rax
mov dword [0x180138ba8], edi
mov dword [0x180138b98], 2
call fcn.180028e50
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x180178c88], eax
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
ret