joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141abfc64
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror edx, 1
bswap edx
cmp di, r13w
xor edx, 0x65505ae6
dec edx
test r9b, 0x2f
cmp r14b, r14b
push rsi
shr sil, cl
bsf rsi, r12
xor dword [rsp], edx
shl sil, cl
bswap rsi
pop rsi
test bp, 0x34d6
movsxd rdx, edx
add r10, rdx
jmp 0x141a1a99f
jmp r10
push r12
push rbx
movzx bx, bpl
push rdi
push r13
jmp 0x141a8ddb9
neg ebp
bts r10w, r12w
add ebp, 0x16f7103c
bswap rdx
or r10, 0x5a976f32
movsx ax, r15b
xor ebp, 0x27207eeb
sal r9d, 0x85
lea rbp, [rbp + r8]
bsr r10w, bx
bswap si
movabs r9, 0x100000000
movsxd r10, edx
add rbp, r9
and dl, sil
mov rbx, rsp
xor ah, 0xef
sub rsp, 0x180
cdq
cmove r10w, r10w
adc sil, 0xa9
and rsp, 0xfffffffffffffff0
rcl sil, 0x23
movzx rdx, r14w
mov rsi, rbp
stc
sbb ah, 0x77
movabs rax, 0
btr r10w, 0xf6
sub rsi, rax
lea r10, [0x141a5bf4b]
rcl dh, cl
mov edx, dword [rbp + riz]
add rbp, 4
xor edx, esi
jmp 0x1419dfc19
push r8
cwde
movsx r8, r13w
push rsi
cwde
movzx rsi, r10w
push r10
movsx rbx, r12w
cbw
push r14
mov sil, 0x86
mov r8b, r8b
lahf
push r11
lahf
push r9
dec r8d
movsxd r10, r10d
push r15
mov r9w, 0x12ed
push rdx
movsxd r8, r13d
push rcx
movzx r9d, ax
movzx dx, r13b
push rbp
movsx ebx, r9w
cdq
movabs r8, 0
push r8
cwde
cwd
rdtsc
mov rbp, qword [rsp + 0x90]
rdtsc
inc ebp
jmp 0x141a5bec5
pushfq
push rax
jmp 0x141a5a029

Function at 0x140004000
Capabilities:
Encode data using xor

Disassembly:
add byte [rax + 0x31], cl
fist dword [rcx + rcx*2 - 0x41]
clc
cmp dl, dh
fst dword [rbp - 0x32]
dec dh
xor rbx, rbx
push rsp
movabs r15, 0xcefece55d9d63af8
fcmove st(0), st(7)
pop r9
and r9w, 0xfb10
fxsave64 [r9]
mov bx, 0x6fe
add dword [rsi - 0x45], esp
inc byte [rsi]
mov rdx, qword [r9 + 8]
dec rbx
xor qword [rdx + rbx*8 + 0x23], r15
test rbx, rbx
jne 0x140004024
lodsb al, byte [rsi]
jb 0x14000401b
sbb dword [rax + rdx*4], edx
mov bh, 0x77
push rbx
jns 0x140003fff
and bh, bl
sbb ebp, edx
mov ecx, 0xdf21829e
xor ecx, dword [rdi - 0x30d7d781]
or eax, 0x50c11c15
enter 0xffffffffffffb9b1, 0x10
rcr dword [rax], 1
clc
xchg byte [rdi], al
wait
call 0xc6e44e7a
sbb dword [rsi], ecx
in al, 0x86
jge 0x14000405d
movabs dword [0x9b66cc7f0c04b72a], eax
test eax, 0x640fe03f
out dx, eax
xor eax, 0x56cfe609
lea esi, [rsi - 0xd]
or byte [rdx + 0x4582b756], dl
xor byte [rsp + rdx*2], dl
xor ch, byte [rax + 0x3f8406b7]
cmp dl, byte [rax]
or esi, esp
iretd
Function at 0x14041fdd0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14041fddd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14041fded
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14041fdd5
lea eax, [rcx + 1]
jmp 0x14041fdfb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14041fe0e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14041fdf4
sub eax, 3
jb 0x14041fe2e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14041fe7d
sar eax, 1
movsxd rbp, eax
jb 0x14041fe64
jmp 0x14041fe3c
add ebx, ebx
jne 0x14041fe3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14041fe64
inc ecx
add ebx, ebx
jne 0x14041fe4a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14041fe64
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14041fe5d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14041fe4c
add ecx, 2
jmp 0x14041fe69
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14041fd92
jmp 0x14041fddd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xb8a00
mov dl, 0x25
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14041fec9
cmp rsi, rcx
jae 0x14041fed1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14041feb0
cmp al, 0x8f
ja 0x14041feb0
cmp byte [rsi - 2], 0xf
je 0x14041feb6
sub al, 0xe8
cmp al, 1
ja 0x14041fe9a
cmp rsi, rcx
jae 0x14041fed1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14041fea0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14041fed1
lodsb al, byte [rsi]
jmp 0x14041feb0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x41b000]
mov eax, dword [rdi]
or eax, eax
je 0x14041ff3a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x4623f0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14041fede
jns 0x14041ff13
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14041ff1d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14041ff34
mov qword [rbx], rax
add rbx, 8
jmp 0x14041fefe
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14041ff7e
cmp al, 0xef
ja 0x14041ff66
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14041ff46
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x14041ff55
mov eax, dword [rdi]
add rdi, 4
jmp 0x14041ff55
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x24f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14041ffd2
sub rsp, 0xffffffffffffff80
jmp 0x1400b6788
Function at 0x18028a453
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
bt r11, 0xfb
mov qword [rsp + 0x10], rdi
shl bh, 0xf8
stc
sub edi, edi
movsx r9w, r14b
inc r10b
movzx ebx, r8b
mov r11, rcx
dec r9w
movsx r8d, r11w
mov r8, rdi
movsxd r10, ebx
cmovl r10, rbx
bswap r10d
nop
movsx r10, r11w
mov r9b, 0xb0
movzx r9w, r11b
movzx r9d, byte [r11]
not r10
movzx r10d, byte [rdx]
jmp 0x18028a4a9
inc r11
jmp 0x18028a4b1
inc rdx
cmp r14b, r13b
clc
test bl, bl
jmp 0x18028a4bf
je 0x18028a4e4
mov ecx, r8d
mov eax, 0x4aa30ad4
clc
rol eax, cl
add al, r8b
jmp 0x18028a4d8
xor r9b, al
jmp 0x18028a4e0
inc r8
cmc
test r9b, r9b
jmp 0x18028a4ec
je 0x18028a500
cmp r9b, r10b
jmp 0x18028a4fa
je 0x18028a499
cmp r9b, r10b
jae 0x18028a524
or eax, 0xffffffff
not di
mov rbx, qword [rsp + 8]
mov dil, 0x31
movsxd rdi, r12d
movsx edi, r14w
mov rdi, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 8]
mov dil, r9b
movsx rax, r15w
seta dil
cwde
mov eax, edi
mov rdi, qword [rsp + 0x10]
jmp 0x18028a541
ret
Function at 0x1400139c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1400a407c]
call fcn.140075a54
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x140013a20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1400a407c]
call fcn.140075a54
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x140013ff0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x1400a407c]
call fcn.140075a54
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x1400796f0]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x14001406f
mov dword [rbp + 0x120], 1
jmp 0x140014079
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x1400140c2
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x14001403a
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1400140e0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x1400a407c]
call fcn.140075a54
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x1400796f0]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x140014225
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x140014179
mov dword [rbp + 0x160], 1
jmp 0x140014183
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x140014220
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x1400141fa
cmp qword [rbp + 0x198], 2
jb 0x1400141fa
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400141fa
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400141fa
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x140014144
jmp 0x1400142bf
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x1400142bf
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x140014296
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140014296
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140014296
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x140014225
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x14006fa00
Capabilities:
Enumerate process modules

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1c8]
mov rax, qword [0x140097808]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x1400a435a]
call fcn.140075a54
mov qword [rbp + 8], 0
mov r8d, dword [rbp + 0x1a0]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x14006fb1c
lea r9, [rbp + 0x84]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x28]
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x14006fb12
cmp dword [rbp + 0x84], 0
je 0x14006fb12
mov eax, dword [rbp + 0x84]
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
je 0x14006fb12
mov eax, dword [rbp + 0x84]
xor edx, edx
mov ecx, 8
div rcx
mov dword [rbp + 0xa4], eax
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x48], rax
lea r9, [rbp + 0x84]
mov r8d, dword [rbp + 0x84]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x28]
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x14006fb08
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x48]
mov rax, qword [rcx + rax]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 8]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14008c3d0]
call fcn.1400758f8
mov rax, rdi
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.140075c00
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret

Function at 0x14006fb50
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x278
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x66
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x298]
mov rax, qword [0x140097808]
xor rax, rbp
mov qword [rbp + 0x248], rax
lea rcx, [0x1400a435a]
call fcn.140075a54
mov dword [rbp + 4], 0
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
je 0x14006fc1f
lea rax, [rbp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x130
rep stosb byte [rdi], al
mov dword [rbp + 0x50], 0x130
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14006fc15
mov rcx, qword [rbp + 0x270]
call fcn.1400712c0
mov rdx, rax
lea rcx, [rbp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14006fc04
mov eax, dword [rbp + 0x58]
mov dword [rbp + 4], eax
jmp 0x14006fc15
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14006fbdf
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14008c370]
call fcn.1400758f8
mov eax, edi
mov rcx, qword [rbp + 0x248]
xor rcx, rbp
call fcn.140075c00
lea rsp, [rbp + 0x258]
pop rdi
pop rbp
ret
Function at 0x14006fce0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x4b8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xc6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4d8]
mov rax, qword [0x140097808]
xor rax, rbp
mov qword [rbp + 0x488], rax
lea rcx, [0x1400a435a]
call fcn.140075a54
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14006fd47
xor al, al
jmp 0x14006fdf7
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x14006fd70
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14006fdf7
mov byte [rbp + 0x284], 0
lea rdx, [rbp + 0x5c]
lea rcx, [rbp + 0x448]
call fcn.14006ebb0
mov qword [rbp + 0x478], rax
mov rax, qword [rbp + 0x478]
mov qword [rbp + 0x480], rax
mov rdx, qword [rbp + 0x4b0]
mov rcx, qword [rbp + 0x480]
call fcn.14006de50
mov byte [rbp + 0x424], al
lea rcx, [rbp + 0x448]
call fcn.14006f3f0
movzx eax, byte [rbp + 0x424]
test eax, eax
je 0x14006fdd5
mov byte [rbp + 0x284], 1
jmp 0x14006fde6
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14006fd77
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rbp + 0x284]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14008c490]
call fcn.1400758f8
mov rax, rdi
mov rcx, qword [rbp + 0x488]
xor rcx, rbp
call fcn.140075c00
lea rsp, [rbp + 0x498]
pop rdi
pop rbp
ret
Function at 0x140070220
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x40]
lea rcx, [0x1400a435a]
call fcn.140075a54
call fcn.140071830
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140070281
movzx eax, byte [0x1400977e0]
test eax, eax
jne 0x14007026a
mov dword [rbp + 0x114], 1
jmp 0x140070274
mov dword [rbp + 0x114], 0
movzx eax, byte [rbp + 0x114]
mov byte [0x1400977e0], al
call fcn.14004b4a0
call fcn.14004d0e0
call fcn.14001daf0
movzx eax, byte [0x1400977e0]
mov byte [rbp + 0x114], al
call fcn.140011db0
movzx ecx, byte [rbp + 0x114]
mov byte [rax + 0x68], cl
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0xe4]
call fcn.140004750
mov qword [rbp + 0x118], rax
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x104]
call fcn.140004750
mov qword [rbp + 0x120], rax
mov r8, qword [rbp + 0x118]
xor edx, edx
mov rcx, qword [rbp + 0x120]
call fcn.1400241f0
mov r8d, 0x187
xor edx, edx
lea rcx, str.fontesie_watermark
call fcn.140006f00
lea rcx, str.By_VegaShop_published_on_Dc:yAPFKBQpXU
call fcn.140069c40
call fcn.14000e420
movzx eax, byte [0x1400977e0]
test eax, eax
je 0x140070332
call fcn.14006fc50
call fcn.140073000
call fcn.140071d70
call fcn.14000e990
mov rax, qword [0x14009e4b0]
mov rax, qword [rax]
mov rax, qword [rax + 0x1c8]
mov qword [rbp + 0x118], rax
xor r8d, r8d
mov edx, 7
mov rcx, qword [0x14009e4b0]
call qword [rbp + 0x118]
mov rax, qword [0x14009e4b0]
mov rax, qword [rax]
mov rax, qword [rax + 0x1c8]
mov qword [rbp + 0x118], rax
xor r8d, r8d
mov edx, 0x1b
mov rcx, qword [0x14009e4b0]
call qword [rbp + 0x118]
mov rax, qword [0x14009e4b0]
mov rax, qword [rax]
mov rax, qword [rax + 0x1c8]
mov qword [rbp + 0x118], rax
xor r8d, r8d
mov edx, 0xae
mov rcx, qword [0x14009e4b0]
call qword [rbp + 0x118]
mov rax, qword [0x14009e4b0]
mov rax, qword [rax]
mov rax, qword [rax + 0x158]
mov qword [rbp + 0x118], rax
mov dword [rsp + 0x30], 0
movss xmm0, dword [0x14007e61c]
movss dword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 0
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x14009e4b0]
call qword [rbp + 0x118]
mov rax, qword [0x14009e4b0]
mov rax, qword [rax]
mov rcx, qword [0x14009e4b0]
call qword [rax + 0x148]
test eax, eax
jl 0x140070450
call fcn.14001f3c0
call fcn.1400119b0
mov rcx, rax
call fcn.14004b4e0
mov rax, qword [0x14009e4b0]
mov rax, qword [rax]
mov rcx, qword [0x14009e4b0]
call qword [rax + 0x150]
mov rax, qword [0x14009e4b0]
mov rax, qword [rax]
mov rax, qword [rax + 0x88]
mov qword [rbp + 0x118], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x14009e4b0]
call qword [rbp + 0x118]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0x88760868
jne 0x1400704e3
mov rax, qword [0x14009e4b0]
mov rax, qword [rax]
mov rcx, qword [0x14009e4b0]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x1400704e3
call fcn.14004b3b0
mov rax, qword [0x14009e4b0]
mov rax, qword [rax]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x118], rax
lea rdx, [0x14009e4c0]
mov rcx, qword [0x14009e4b0]
call qword [rbp + 0x118]
call fcn.14004ae50
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1400704f0
Capabilities:
Hide graphical window

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x190
lea rbp, [rsp + 0x60]
lea rcx, [0x1400a435a]
call fcn.140075a54
mov dword [rbp + 0xc8], 0x50
mov dword [rbp + 0xcc], 0
lea rax, [0x140070700]
mov qword [rbp + 0xd0], rax
mov dword [rbp + 0xd8], 0
mov dword [rbp + 0xdc], 0
mov qword [rbp + 0xe0], 0
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rbp + 0xe8], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 0
mov qword [rbp + 0x100], 0
lea rax, [0x14008c8c0]
mov qword [rbp + 0x108], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rbp + 0x110], rax
lea rax, [0x14009e450]
lea rcx, [rbp + 0xc8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x50
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x14009e450]
call qword [sym.imp.USER32.dll_RegisterClassExA]
cmp qword [0x14009e428], 0
je 0x140070637
lea rdx, [0x14009e548]
mov rcx, qword [0x14009e428]
call qword [sym.imp.USER32.dll_GetClientRect]
lea rdx, [0x14009e558]
mov rcx, qword [0x14009e428]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [0x14009e558]
mov dword [0x14009e548], eax
mov eax, dword [0x14009e55c]
mov dword [0x14009e54c], eax
mov eax, dword [0x14009e550]
mov dword [0x14009e434], eax
mov eax, dword [0x14009e554]
mov dword [0x14009e430], eax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [0x14009e430]
mov dword [rsp + 0x38], eax
mov eax, dword [0x14009e434]
mov dword [rsp + 0x30], eax
mov eax, dword [0x14009e440]
mov dword [rsp + 0x28], eax
mov eax, dword [0x14009e438]
mov dword [rsp + 0x20], eax
mov r9d, 0x90000000
lea r8, [0x14008c8c0]
lea rdx, [0x14008c8c0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x14009e448], rax
lea rdx, [0x1400977f0]
mov rcx, qword [0x14009e448]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [0x14009e448]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov edx, 5
mov rcx, qword [0x14009e448]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14009e448]
call qword [sym.imp.USER32.dll_UpdateWindow]
lea rsp, [rbp + 0x130]
pop rdi
pop rsi
pop rbp
ret
Function at 0x140076d54
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140076d9e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140076d9e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140076d9e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140076d9e
cmp dword [rcx + 0x84], 0xe
jbe 0x140076d9e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140076da0
xor al, al
add rsp, 0x28
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00404480]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00404490]
mov dword [rax], 1
mov rax, qword [0x004044a0]
mov dword [rax], 1
mov rax, qword [0x00404470]
mov dword [rax], 1
mov rax, qword [0x00404330]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x00404460]
mov dword [0x00407008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call dbg._encode_pointer
mov rdx, qword [0x004043c0]
mov qword [rdx], rax
mov rdx, qword [0x004043b0]
mov qword [rdx], rax
mov rax, qword [0x00404420]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x004042e0]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058