joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ccc70
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x60], 4
mov dword [rsp + 0xa8], 0x400010
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x1800cccd7
mov edx, dword [rcx + 0x28]
mov dword [rsp + 0x88], edx
mov qword [rsp + 0x90], rax
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x1800ccd1e
mov rdx, qword [rcx + 0x40]
test rdx, rdx
je 0x1800ccd13
xor r9d, r9d
lea r10, [0x18015b5a0]
xor r8d, r8d
nop word cs:[rax + rax]
movzx r11d, byte [rax + r9]
or r8d, dword [r10 + r11*4]
inc r9
cmp rdx, r9
jne 0x1800ccd00
jmp 0x1800ccd16
xor r8d, r8d
mov dword [rsp + 0x98], r8d
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x1800ccda5
js 0x1800cceb4
mov rbx, qword [rcx]
lea r14, [rsi*8]
movzx eax, byte [0x180168bb8]
mov rcx, qword [0x180168b78]
test rcx, rcx
jne 0x1800ccd64
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1800cce9e
mov rcx, rax
mov qword [0x180168b78], rax
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1800cce9e
mov rdi, rax
lea r8, [rbx + rsi*8]
sub r8, rbx
add r8, 0xfffffffffffffff8
mov r14, r8
shr r14, 3
and r8, 0xfffffffffffffff8
add r8, 8
mov rcx, rax
mov rdx, rbx
call fcn.1800f64f0
inc r14d
jmp 0x1800ccdad
xor r14d, r14d
mov edi, 8
mov dword [rsp + 0x64], r14d
mov qword [rsp + 0x68], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
lea rdx, [0x180135095]
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x1800cce3a
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov r14d, 1
test rsi, rsi
je 0x1800cce1f
mov rcx, qword [0x180168b78]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, r14
mov rdx, rbx
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
ret
movaps xmm6, xmmword [rsp + 0x50]
movzx eax, byte [0x180168bb8]
mov rcx, qword [0x180168b78]
test rcx, rcx
jne 0x1800cce67
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1800cceb8
mov rcx, rax
mov qword [0x180168b78], rax
mov r8d, 0x20
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1800cceb8
mov rbx, rax
mov qword [rax], 1
mov qword [rax + 8], 1
movups xmmword [rax + 0x10], xmm6
xor r14d, r14d
test rsi, rsi
jne 0x1800cce0d
jmp 0x1800cce1f
shr rsi, 0x39
not esi
and esi, 8
mov rcx, rsi
mov rdx, r14
call fcn.180103b10
ud2
ud2
mov ecx, 8
mov edx, 0x20
call fcn.180103b10
ud2
Function at 0x1800d4920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x1800d4950
test ecx, ecx
jne 0x1800d49a0
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x1800d495c
test ecx, ecx
jne 0x1800d49a0
mov rcx, rdi
call fcn.1800d4810
movzx ecx, al
test bpl, bpl
jne 0x1800d49a7
lea rdx, [rdi + 0x10]
xor eax, eax
cmp byte [rdi + 0x10], 6
cmove rdx, rax
je case.0x1800d4993.2
movzx r8d, byte [rdx]
mov eax, 6
lea r9, [0x1800d4afc]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rax, qword [rdx + 0x10]
add rax, 4
jmp case.0x1800d4993.2
xor ecx, ecx
test bpl, bpl
je 0x1800d496c
xor eax, eax
add rcx, rax
movzx r10d, bl
lea r9, [rcx + r10]
mov rax, qword [rdi + 8]
cmp rax, r9
jb 0x1800d4af7
mov r11, qword [rdi]
lea rdx, [r11 + r9]
cmp rax, r9
jne 0x1800d49da
movzx r8d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x1800d4a59
movzx r8d, byte [rdi + 0x10]
add rcx, r10
sub rcx, rax
inc rcx
lea rdi, [rax + r11]
dec rdi
xor r10d, r10d
cmp r8b, 3
jae 0x1800d4a20
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x1800d4a3b
inc rcx
dec rdi
cmp rcx, 1
jne 0x1800d4a00
jmp 0x1800d4a59
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x1800d4a3b
cmp ebx, 0x5c
je 0x1800d4a3b
inc rcx
dec rdi
cmp rcx, 1
jne 0x1800d4a20
jmp 0x1800d4a59
neg rcx
add r9, rcx
inc r9
cmp rax, r9
jb 0x1800d4af7
add r11, r9
mov r10d, 1
mov rdx, r11
sub rax, r9
je 0x1800d4a82
mov cl, 9
cmp rax, 2
je 0x1800d4a86
cmp rax, 1
jne 0x1800d4a95
cmp byte [rdx], 0x2e
jne 0x1800d4a95
xor ecx, ecx
cmp r8b, 3
setae cl
lea ecx, [rcx + rcx*2]
add ecx, 7
jmp 0x1800d4a95
mov cl, 0xa
jmp 0x1800d4a95
cmp byte [rdx], 0x2e
jne 0x1800d4a95
cmp byte [rdx + 1], 0x2e
sete cl
xor cl, 9
add r10, rax
mov qword [rsi], r10
mov byte [rsi + 8], cl
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], rax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rax, r8
add rax, 8
jmp case.0x1800d4993.2
mov rax, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rax, r8
add rax, 2
jmp case.0x1800d4993.2
mov eax, 2
jmp case.0x1800d4993.2
ud2
Function at 0x1800d4e00
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x180135ef0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1800d4e6c
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x1800d4e7b
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x1800d4eb3
cmp eax, 0x103
je 0x1800d4ebd
test eax, eax
js 0x1800d4e98
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x1800d4eb3
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1800d1940
mov rcx, rax
call fcn.1800d1a20
mov ecx, 7
int 0x29
ud2
Function at 0x1800d6b30
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e8
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x180168b80]
cmp rax, 3
jne 0x1800d6cce
cmp rbx, 0x17f
ja 0x1800d6ce0
lea rcx, [rsp + 0x68]
mov rdx, r14
mov r8, rbx
call fcn.1800f64f0
mov byte [rsp + rbx + 0x68], 0
lea rax, [rbx + 1]
cmp rbx, 0xe
ja 0x1800d6ba8
xor edx, edx
nop dword [rax]
cmp byte [rsp + rdx + 0x68], 0
je 0x1800d6c34
inc rdx
cmp rax, rdx
jne 0x1800d6b90
jmp 0x1800d6c97
xor ecx, ecx
mov dl, 1
test dl, dl
jne 0x1800d6bd8
jne 0x1800d6bd8
xor edx, edx
nop word cs:[rax + rax]
cmp byte [rsp + rdx + 0x68], 0
je 0x1800d6c34
inc rdx
jne 0x1800d6bc0
xor edx, edx
test dl, dl
jne 0x1800d6c2a
lea rdx, [rbx - 0xf]
jmp 0x1800d6bde
lea rdx, [rbx - 0xf]
xor ecx, ecx
movdqa xmm0, xmmword [0x18010d770]
movabs r8, 0x8080808080808080
movdqu xmm1, xmmword [rsp + rcx + 0x68]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r9, xmm2
test r9, r8
jne 0x1800d6c2a
add rcx, 0x10
cmp rcx, rdx
jbe 0x1800d6bf0
jmp 0x1800d6c2a
cmp byte [rsp + rcx + 0x68], 0
je 0x1800d6c31
inc rcx
cmp rax, rcx
jne 0x1800d6c20
jmp 0x1800d6c97
mov rdx, rcx
cmp rdx, rbx
jne 0x1800d6c97
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x68]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1800d6cb6
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
jmp 0x1800d6ca9
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
jmp 0x1800d6ca9
call fcn.18010a140
cmp rbx, 0x17f
jbe 0x1800d6b68
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.18010a1a0
Function at 0x1800d7260
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [0x180168bb8]
mov rcx, qword [0x180168b78]
test rcx, rcx
jne 0x1800d729e
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1800d7352
mov rcx, rax
mov qword [0x180168b78], rax
mov r8d, 0x10
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1800d7352
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1800d7370]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1800d7345
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x1800d731f
cmp qword [rbx + 0x10], 0x11
jb 0x1800d730d
mov rdi, qword [rdi - 8]
mov rcx, qword [0x180168b78]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x180168b78]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
call sub.kernel32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 8
mov edx, 0x10
call fcn.180103b10
ud2

Function at 0x1800d73f0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x1800d741f
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.1800d4df0
ud2
Function at 0x1800d7b50
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rbx, r8
mov rsi, rcx
test rdx, rdx
je 0x1800d7b7b
mov qword [rsi + 8], rbx
mov qword [rsi], 1
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rax, qword [0x180168b80]
cmp rax, 3
jne 0x1800d7d00
cmp word [rbx], 0
mov eax, 2
mov ebp, 0x17
cmove ebp, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800d7bf1
cmp word [rbx], 0
je 0x1800d7c6b
movups xmm0, xmmword [rbx + 4]
mov eax, dword [rbx + 0x14]
mov edx, dword [rbx + 0x18]
movzx ecx, word [rbx + 0x1c]
mov r8d, 0x1c
mov r9w, 0x17
jmp 0x1800d7c80
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x1800d7c0c
mov r14d, eax
cmp eax, 0x2726
jne 0x1800d7cef
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x1800d7ce6
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
jne 0x1800d7bc9
call sub.kernel32.dll_GetLastError
mov r14d, eax
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
jmp 0x1800d7cef
mov eax, dword [rbx + 2]
movzx ecx, word [rbx + 6]
mov r8d, 0x10
mov r9w, 2
xorps xmm0, xmm0
rol cx, 8
mov word [rsp + 0x30], r9w
mov word [rsp + 0x32], cx
mov dword [rsp + 0x34], eax
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], edx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1800d7cbf
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x1800d7b70
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
jmp 0x1800d7b70
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov r14d, eax
shl r14, 0x20
or r14, 2
mov qword [rsi + 8], r14
jmp 0x1800d7b69
call fcn.18010a140
jmp 0x1800d7b8c
Function at 0x1800dc870
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
movaps xmmword [rsp + 0x90], xmm6
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x24]
mov rcx, rax
call qword [sym.imp.shell32.dll_CommandLineToArgvW]
test rax, rax
je 0x1800dc9cc
mov rdi, rax
mov qword [rsp + 0x40], rsi
movsxd rbp, dword [rsp + 0x24]
mov qword [rsp + 0x28], 8
xorps xmm6, xmm6
movups xmmword [rsp + 0x30], xmm6
test rbp, rbp
je 0x1800dc9a1
shl rbp, 3
mov esi, 8
xor r15d, r15d
lea rbx, [rsp + 0x48]
lea r14, [rsp + 0x78]
xor r12d, r12d
jmp 0x1800dc91c
lea rax, [r12 + r12*2]
mov rcx, qword [rsp + 0x70]
mov qword [rsi + rax*8 + 0x10], rcx
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + rax*8], xmm0
inc r12
mov qword [rsp + 0x38], r12
add r15, 8
cmp rbp, r15
je 0x1800dc9a1
mov r13, qword [rdi + r15]
mov rcx, r13
call fcn.1800f98c8
lea rax, [rax*2]
add rax, r13
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x80], rax
mov word [rsp + 0x88], 0
mov qword [rsp + 0x48], 1
lea rax, [rsp + 0x50]
movups xmmword [rax], xmm6
mov rcx, rbx
mov rdx, r14
call fcn.1800dad70
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x60], xmm0
cmp r12, qword [rsp + 0x30]
jne 0x1800dc8f0
lea rcx, [rsp + 0x28]
mov rdx, r12
call fcn.180054ce0
mov rsi, qword [rsp + 0x28]
mov r12, qword [rsp + 0x38]
jmp 0x1800dc8f0
mov rcx, rdi
call qword [sym.imp.kernel32.dll_LocalFree]
test rax, rax
jne 0x1800dc9b4
call sub.kernel32.dll_GetLastError
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
jmp 0x1800dc9da
mov qword [rsi], 8
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1800dd3e0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rcx + 0x18]
test rdi, rdi
je 0x1800dd479
mov rbx, qword [rsi]
lea r14, [rbx + 0x10]
movdqa xmm0, xmmword [rbx]
pmovmskb eax, xmm0
not eax
mov r15, qword [sym.imp.pdh.dll_PdhRemoveCounter]
jmp 0x1800dd441
lea ebp, [rax - 1]
and ebp, eax
tzcnt eax, eax
shl rax, 5
mov rcx, rbx
sub rcx, rax
mov rcx, qword [rcx - 8]
call r15
mov eax, ebp
dec rdi
je 0x1800dd479
test ax, ax
jne 0x1800dd420
nop word cs:[rax + rax]
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
add rbx, 0xfffffffffffffe00
add r14, 0x10
cmp ax, 0xffff
je 0x1800dd450
mov ecx, 0xfffffffe
sub ecx, eax
not eax
mov ebp, eax
and ebp, ecx
jmp 0x1800dd425
mov rcx, qword [rsi + 0x38]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x1800dd491
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x1800dd4ac
mov rcx, qword [rsi + 0x30]
lea rax, [rcx + 1]
cmp rax, 2
jae 0x1800dd4bf
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call sub.kernel32.dll_GetLastError
mov rcx, qword [rsi + 0x30]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x1800dd49f
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.pdh.dll_PdhCloseQuery]
Function at 0x1800e9070
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1800e927d
mov r14, qword [rsp + 0x20]
mov rcx, qword [0x180168b90]
test rcx, rcx
jne 0x1800e90e0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1800e927d
mov rcx, qword [rsp + 0x20]
mov qword [0x180168b90], rcx
test rcx, rcx
je 0x1800e9282
mov rax, r14
or rax, rcx
shr rax, 0x20
je 0x1800e90f6
mov rax, r14
xor edx, edx
div rcx
jmp 0x1800e90fd
mov eax, r14d
xor edx, edx
div ecx
imul r9, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x1800e9121
xor edx, edx
div rcx
mov r8, rax
jmp 0x1800e9128
xor edx, edx
div ecx
mov r8d, eax
add r8, r9
mov rcx, r8
shr rcx, 9
movabs r14, 0x44b82fa09b5a53
mov rax, rcx
mul r14
mov r9, rdx
shr r9, 0xb
add r9, rbx
jb 0x1800e917a
mov rax, rcx
mul r14
shr rdx, 0xb
imul eax, edx, 0x3b9aca00
sub r8d, eax
add r8d, edi
cmp r8d, 0x3b9aca00
jb 0x1800e9244
inc r9
jne 0x1800e9274
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1800e927d
mov rdi, qword [rsp + 0x20]
mov rcx, qword [0x180168b90]
test rcx, rcx
jne 0x1800e91d8
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1800e927d
mov rcx, qword [rsp + 0x20]
mov qword [0x180168b90], rcx
test rcx, rcx
je 0x1800e9282
mov rax, rdi
or rax, rcx
shr rax, 0x20
je 0x1800e91ee
mov rax, rdi
xor edx, edx
div rcx
jmp 0x1800e91f4
mov eax, edi
xor edx, edx
div ecx
imul r9, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x1800e9218
xor edx, edx
div rcx
mov r8, rax
jmp 0x1800e921f
xor edx, edx
div ecx
mov r8d, eax
add r8, r9
mov rax, r8
shr rax, 9
mul r14
mov r9, rdx
shr r9, 0xb
imul eax, r9d, 0x3b9aca00
sub r8d, eax
add r9, 0x38640900
mov eax, r8d
shr eax, 9
imul rax, rax, 0x44b83
shr rax, 0x27
imul eax, eax, 0x3b9aca00
sub r8d, eax
mov rcx, rsi
mov rdx, r9
call fcn.1800e8880
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
add r8d, 0xc4653600
jmp 0x1800e9244
call sub.kernel32.dll_GetLastError
ud2
Function at 0x1800fd2b8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800fd2e8
xor eax, eax
jmp 0x1800fd3ab
mov rbp, rbx
cmp word [rax], si
je 0x1800fd30d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800fd2f4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800fd2f0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800fd208
movsxd r14, eax
test eax, eax
jne 0x1800fd34b
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
jmp 0x1800fd2e1
mov rcx, r14
call fcn.1800fe540
mov rdi, rax
test rax, rax
jne 0x1800fd364
xor ecx, ecx
call fcn.1800fb870
jmp 0x1800fd340
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800fd208
test eax, eax
jne 0x1800fd395
mov rcx, rdi
call fcn.1800fb870
jmp 0x1800fd39f
xor ecx, ecx
call fcn.1800fb870
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400075c0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400075d0]
mov dword [rax], 1
mov rax, qword [0x1400075e0]
mov dword [rax], 1
mov rax, qword [0x140007550]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400075b0]
mov dword [0x14000a00c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140007690]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x140007670]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140007510]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x140007610]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov rax, qword gs:[0x30]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rbp
mov rax, rdi
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011b0
mov rsi, qword [0x140007620]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x14000a008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x140007580]
mov rax, qword [rax]
test rax, rax
je 0x140001223
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call dbg._pei386_runtime_relocator
mov rcx, qword [dbg._gnu_exception_handler]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x140007600]
lea rcx, [dbg.__mingw_invalidParameterHandler]
mov qword [rdx], rax
call sym._set_invalid_parameter_handler
call dbg._fpreset
mov ebx, dword [0x14000a028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sym.malloc
mov r12, qword [0x14000a020]
mov rbp, rax
test ebx, ebx
jle 0x1400013c0
sub rdi, 8
xor ebx, ebx
mov rcx, qword [r12 + rbx]
call sym.strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sym.malloc
mov r8, rsi
mov qword [rbp + rbx], rax
mov rdx, qword [r12 + rbx]
mov rcx, rax
add rbx, 8
call sym.memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, rbp
mov qword [rdi], 0
mov qword [0x14000a020], rbp
call dbg.__main
mov rax, qword [0x140007590]
mov r8, qword [0x14000a018]
mov ecx, dword [0x14000a028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x14000a020]
call sym.main
mov ecx, dword [0x14000a00c]
mov dword [0x14000a010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x14000a008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x140007620]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011e1
mov ecx, 0x1f
call dbg._amsg_exit
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001200
mov rdx, qword [0x140007640]
mov rcx, qword [0x140007630]
call sym._initterm
mov dword [rsi], 2
test edi, edi
jne 0x140001208
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001208
call sym._cexit
mov eax, dword [0x14000a010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x140007660]
mov rcx, qword [0x140007650]
mov dword [rsi], 1
call sym._initterm
jmp 0x1400011f5
mov rdi, rax
jmp 0x1400012b5
mov ecx, eax
call sym.exit
nop
Function at 0x14000151a
Capabilities:
Log keystrokes via application hook

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov r9d, 0
mov r8d, 0
lea rax, [sym.HookCallback_int__unsigned_long_long__long_long_]
mov rdx, rax
mov ecx, 0xd
mov rax, qword [sym.imp.USER32.dll_SetWindowsHookExW]
call rax
mov qword [0x14000a040], rax
mov rax, qword [0x14000a040]
test rax, rax
sete al
test al, al
je 0x140001596
lea rax, str.Failed_to_install_hook_
mov qword [rbp - 8], rax
lea rax, str.Error
mov qword [rbp - 0x10], rax
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov r9d, 0x10
mov r8, rdx
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
nop
add rsp, 0x30
pop rbp
ret