joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b03b0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
call sub.user32.dll_GetMessagePos
mov ecx, eax
call fcn.00419810
mov dword [rbp + 0x3c], eax
movsx rax, word [rbp + 0x3c]
mov dword [rbp + 0x34], eax
movsx rax, word [rbp + 0x3e]
mov dword [rbp + 0x38], eax
mov rcx, rbx
mov rdx, qword [rbp + 0x34]
call fcn.005a6810
mov qword [rbp + 0x158], rax
test rdi, rdi
jne 0x5b041b
mov rcx, rbx
mov rdx, qword [rbp + 0x158]
xor r8, r8
xor r9, r9
mov byte [rsp + 0x20], 0
call fcn.005b01c0
mov rdi, rax
test rdi, rdi
je 0x5b050a
cmp rdi, rbx
je 0x5b0449
mov eax, dword [rbp + 0x158]
sub eax, dword [rdi + 0x90]
mov dword [rbp + 0x40], eax
mov eax, dword [rbp + 0x15c]
sub eax, dword [rdi + 0x94]
mov dword [rbp + 0x44], eax
jmp 0x5b0454
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x40], rax
movzx eax, word [rsi + 0x10]
mov dword [rbp + 0x48], eax
mov rax, qword [rsi + 8]
mov qword [rbp + 0x50], rax
movzx rax, word [rsi + 0x12]
cmp rax, 0x201
jge 0x5b0494
sub rax, 0xa1
cmp rax, 2
jb 0x5b04b7
sub rax, 3
cmp rax, 2
jb 0x5b04c3
sub rax, 3
cmp rax, 2
jae 0x5b04c9
jmp 0x5b04bd
sub rax, 0x201
cmp rax, 2
jb 0x5b04b7
sub rax, 3
cmp rax, 2
jb 0x5b04c3
sub rax, 3
cmp rax, 2
jae 0x5b04c9
jmp 0x5b04bd
mov byte [rbp + 0x4c], 0
jmp 0x5b04cd
mov byte [rbp + 0x4c], 2
jmp 0x5b04cd
mov byte [rbp + 0x4c], 1
jmp 0x5b04cd
mov byte [rbp + 0x4c], 0
lea rcx, [rbp + 0x58]
call sub.user32.dll_GetKeyboardState
lea rcx, [rbp + 0x58]
call fcn.006947d0
mov ebx, eax
call fcn.005a16c0
or bx, ax
mov word [rbp + 0x4d], bx
mov rcx, rdi
mov edx, 0xb04b
xor r8, r8
lea r9, [rbp + 0x40]
call fcn.005a9100
mov qword [rsi + 0x18], rax
mov al, 1
jmp 0x5b050d
xor rax, rax
lea rsp, [rbp + 0x168]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x5eee40
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
mov rcx, qword [rbp + 0x68]
call fcn.0040e780
nop
xor rcx, rcx
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x5eef29
nop
mov dword [rbp + 0x3c], 0
cmp qword [rbp + 0x68], 0
je 0x5eee87
mov rax, qword [rbp + 0x68]
mov eax, dword [rax - 4]
mov dword [rbp + 0x3c], eax
mov ecx, 0x2002
mov edx, dword [rbp + 0x3c]
add edx, edx
add edx, 2
movsxd rdx, edx
call sub.kernel32.dll_GlobalAlloc
mov qword [rbp + 0x48], rax
nop
mov rcx, qword [rbp + 0x48]
call sub.kernel32.dll_GlobalLock
mov qword [rbp + 0x40], rax
nop
mov dword [rbp + 0x38], 0
cmp qword [rbp + 0x68], 0
je 0x5eeec8
mov rax, qword [rbp + 0x68]
mov eax, dword [rax - 4]
mov dword [rbp + 0x38], eax
mov rcx, qword [rbp + 0x68]
call fcn.0040f960
mov rcx, rax
mov rdx, qword [rbp + 0x40]
mov r8d, dword [rbp + 0x38]
add r8d, r8d
add r8d, 2
movsxd r8, r8d
call fcn.004090a0
call sub.user32.dll_EmptyClipboard
mov ecx, 0xd
mov rdx, qword [rbp + 0x48]
call sub.user32.dll_SetClipboardData
nop
mov rcx, qword [rbp + 0x48]
call sub.kernel32.dll_GlobalUnlock
jmp 0x5eef21
nop
call sub.user32.dll_CloseClipboard
jmp 0x5eef46
mov rcx, qword [0x00427358]
mov dl, 1
mov r8, qword [0x00707628]
call fcn.0043b5b0
mov rcx, rax
call fcn.0040d860
nop
lea rcx, [rbp + 0x68]
call fcn.0040e5f0
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x5f64a0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, word [0x005f64f4]
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5f64c1
or bx, 1
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5f64d5
or bx, 4
mov ecx, 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5f64e9
or bx, 2
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x682910
Capabilities:
Get keyboard layout

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x90], rcx
nop
mov byte [0x007035f0], 0
mov word [rbp + 0x54], 0
lea rcx, [rbp + 0x54]
call sub.user32.dll_GetKeyboardLayoutNameW
mov rcx, qword [0x00561740]
mov dl, 1
call fcn.00562e70
mov qword [rbp + 0x70], rax
nop
mov rcx, qword [rbp + 0x70]
mov rdx, 0xffffffff80000002
call fcn.00563140
lea rcx, [rbp + 0x28]
lea rdx, [rbp + 0x54]
mov r8d, 0xa
call fcn.0040fa30
lea rcx, [rbp + 0x30]
lea rdx, [0x00682b30]
mov r8, qword [rbp + 0x28]
call fcn.0040fd90
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x30]
call fcn.00563550
test al, al
je 0x682a4c
mov rcx, qword [rbp + 0x70]
lea rdx, [rbp + 0x68]
lea r8, [0x00682ba4]
call fcn.00564250
mov rcx, qword [rbp + 0x68]
mov edx, 0x8000
call fcn.0043f720
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
je 0x682a4c
nop
mov rcx, qword [rbp + 0x78]
lea rdx, [0x00682bbc]
call fcn.0041c710
mov qword [rbp + 0x40], rax
cmp qword [rbp + 0x40], 0
je 0x682a42
call qword [rbp + 0x40]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x682a42
mov rcx, qword [rbp + 0x90]
call fcn.00682880
test eax, eax
je 0x682a26
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x50]
mov dword [rbp + 0x50], eax
jmp 0x682a30
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x50]
mov dword [rbp + 0x50], eax
mov eax, dword [rbp + 0x50]
and eax, 1
cmp eax, 1
sete al
mov byte [0x007035f0], al
nop
mov rcx, qword [rbp + 0x78]
call sub.kernel32.dll_FreeLibrary_2
nop
mov rcx, qword [rbp + 0x70]
call fcn.0040b220
nop
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.0040e6d0
lea rcx, [rbp + 0x68]
call fcn.0040e5f0
lea rsp, [rbp + 0x80]
pop rbp
ret

Function at 0x682c40
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rsi, rcx
lea rdi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movzx bx, byte [rbp + 0x28]
test bx, bx
je 0x682c9e
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x682c79
add bx, 0x2000
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x682c8e
add bx, 0x4000
mov eax, dword [rbp + 0x30]
test eax, 0x20000000
je 0x682c9e
add bx, 0x8000
mov eax, ebx
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x694700
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, word [0x00694768]
mov eax, ecx
test ax, 4
je 0x69471a
or bx, 1
mov eax, ecx
test ax, 8
je 0x694727
or bx, 4
mov eax, ecx
test ax, 1
je 0x694734
or bx, 8
mov eax, ecx
test ax, 2
je 0x694741
or bx, 0x10
test cx, 0x10
je 0x69474c
or bx, 0x20
mov ecx, 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x694760
or bx, 2
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x694770
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
movzx rsi, word [0x006947c0]
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x694794
or si, 1
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6947a8
or si, 4
test ebx, 0x20000000
je 0x6947b4
or si, 2
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x6a2d00
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x510
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x520], rcx
nop
mov rax, qword [rbp + 0x520]
cmp qword [rax + 0x80], 0
jne 0x6a2f32
mov rcx, qword [0x004d1a08]
mov dl, 1
call fcn.005039d0
mov rcx, qword [rbp + 0x520]
mov qword [rcx + 0x80], rax
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
call fcn.0040e5f0
mov ecx, 0x40
lea rdx, [rbp + 0x2f0]
call sub.user32.dll_GetKeyboardLayoutList
mov dword [rbp + 0x4fc], eax
xor rax, rax
mov ecx, dword [rbp + 0x4fc]
sub ecx, 1
mov dword [rbp + 0x3c], ecx
mov dword [rbp + 0x4f8], eax
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], eax
jg 0x6a2f0a
mov eax, dword [rbp + 0x3c]
add eax, 1
mov dword [rbp + 0x3c], eax
movsxd rax, dword [rbp + 0x4f8]
mov rcx, qword [rbp + rax*8 + 0x2f0]
call fcn.005bf9b0
test al, al
je 0x6a2ef4
movsxd rax, dword [rbp + 0x4f8]
lea rax, [rbp + rax*8 + 0x2f0]
mov qword [rbp + 0x48], rax
mov byte [rbp + 0x50], 0x10
lea rcx, [rbp + 0x70]
lea rdx, [0x006a2fc4]
lea r8, [rbp + 0x48]
xor r9, r9
call fcn.00433060
mov rcx, 0xffffffff80000002
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x508]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x6a2ef4
nop
mov dword [rbp + 0x4f4], 0x200
mov rcx, qword [rbp + 0x508]
lea rdx, [0x006a3032]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x4f4]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x6a2ee7
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.0040fa30
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov rcx, rax
mov rdx, qword [rbp + 0x40]
movsxd r8, dword [rbp + 0x4f8]
mov r8, qword [rbp + r8*8 + 0x2f0]
mov rax, qword [rax]
call qword [rax + 0x80]
movsxd rax, dword [rbp + 0x4f8]
mov rcx, qword [rbp + 0x520]
mov rax, qword [rbp + rax*8 + 0x2f0]
cmp rax, qword [rcx + 0x90]
jne 0x6a2ee7
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.0040fa30
nop
mov rcx, qword [rbp + 0x508]
call sub.advapi32.dll_RegCloseKey_1
add dword [rbp + 0x4f8], 1
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], eax
jne 0x6a2da8
nop
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov byte [rax + 0x61], 0
mov rax, qword [rbp + 0x520]
mov rcx, qword [rax + 0x80]
mov dl, 1
call fcn.00503880
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x500], rax
nop
lea rcx, [rbp + 0x40]
call fcn.0040e5f0
mov rax, qword [rbp + 0x500]
lea rsp, [rbp + 0x510]
pop rbp
ret
Function at 0x6a42c0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x007134c8]
cmp byte [rax + 0x159], 0
jne 0x6a4363
cmp qword [0x00713500], 0
jne 0x6a4306
call sub.kernel32.dll_GetCurrentThreadId_1
mov ecx, 3
mov rdx, qword [0x007057a0]
xor r8, r8
mov r9d, eax
call sub.user32.dll_SetWindowsHookExW
mov qword [0x00713500], rax
cmp qword [0x007134f8], 0
jne 0x6a4328
xor rcx, rcx
xor rdx, rdx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [0x007134f8], rax
cmp qword [0x00713508], 0
jne 0x6a4363
xor rcx, rcx
mov edx, 0x3e8
mov r8, qword [0x00705798]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread_1
mov qword [0x00713508], rax
add rsp, 0x48
ret

Function at 0x6a55b0
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
cmp qword [rbx + 0x2d0], 0
je 0x6a5696
cmp dword [rbx + 0x128], 0
jne 0x6a568c
mov rax, qword [rbx + 0x2d0]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x006a5490]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0x120]
cmp dword [rax + 0x10], 0
je 0x6a568c
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x40]
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
test rax, 8
je 0x6a563a
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x120]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x6a568b
mov rcx, qword [rbx + 0x120]
mov edx, esi
call fcn.004fbf90
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x6a564b
nop
lea rax, [rbx + 0x128]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6a59e0
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rsp
mov rbx, rcx
mov esi, edx
mov rax, qword [0x007134c8]
cmp qword [rax + 0x2d0], 0
je 0x6a5bba
test sil, sil
jne 0x6a5ad9
cmp dword [rbx + 0x138], 0
jne 0x6a5aca
mov rcx, rbx
call fcn.006aa120
lea rcx, [0x006a5880]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0xa8], 0
je 0x6a5a8c
mov rax, qword [0x007134c8]
cmp byte [rax + 0x193], 0
je 0x6a5a8c
mov rax, qword [rbx + 0x1a0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x6a5a65
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6a5a8b
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor rdx, rdx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6a5a6d
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6a5ac9
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.004fbf90
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6a5a9d
nop
lea rax, [rbx + 0x138]
add dword [rax], 1
jmp 0x6a5bba
cmp dword [rbx + 0x138], 0
jle 0x6a5bba
lea rax, [rbx + 0x138]
sub dword [rax], 1
cmp dword [rbx + 0x138], 0
jne 0x6a5bba
cmp qword [rbx + 0xa8], 0
je 0x6a5b59
mov rax, qword [0x007134c8]
cmp byte [rax + 0x193], 0
je 0x6a5b59
mov rax, qword [rbx + 0x1a0]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x6a5b2f
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6a5b58
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6a5b37
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6a5b96
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.004fbf90
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6a5b6a
nop
mov rax, qword [rbx + 0x130]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x1a0]
mov rdx, qword [0x0068f918]
call fcn.004117c0
lea rsp, [rbp + 0x38]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x6a6dc0
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x220
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [rbx + 0x158], 0
je 0x6a6e2f
cmp byte [rbx + 0x193], 0
jne 0x6a6e2f
mov rcx, qword [rbx + 0x2d0]
lea rdx, [rbp + 0x20]
mov r8d, pe_nt_image_headers64
call sub.user32.dll_GetWindowTextW
mov rcx, rsi
lea rdx, [rbp + 0x20]
mov r8d, eax
call fcn.0040e8b0
xor rax, rax
cmp qword [rsi], 0
je 0x6a6e1a
mov rax, qword [rsi]
mov eax, dword [rax - 4]
test eax, eax
jne 0x6a6e3e
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.0040ec20
jmp 0x6a6e3e
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.0040ec20
mov rax, rsi
lea rsp, [rbp + 0x220]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6aa520
Capabilities:
Hide graphical window from taskbar

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
cmp sil, byte [rbx + 0x193]
je 0x6aa6f1
mov byte [rbx + 0x193], sil
cmp qword [rbx + 0xa8], 0
je 0x6aa652
mov rcx, qword [rbx + 0xa8]
call fcn.005b5cf0
test al, al
je 0x6aa652
mov rax, qword [rbx + 0xa8]
movzx rax, word [rax + 0x34]
test ax, 0x10
jne 0x6aa652
mov rax, qword [rbx + 0xa8]
movzx rax, word [rax + 0x34]
test ax, 2
jne 0x6aa652
test sil, sil
je 0x6aa5cf
mov rcx, qword [rbx + 0x2d0]
xor rdx, rdx
xor r8, r8
call fcn.006940d0
mov rcx, qword [rbx + 0xa8]
call fcn.005b56f0
mov rcx, rax
mov dl, 1
mov rax, qword [rbx + 0xa8]
movzx r8, byte [rax + 0xa9]
call fcn.006940d0
jmp 0x6aa63a
call sub.user32.dll_GetForegroundWindow
mov rdi, rax
mov rcx, qword [rbx + 0xa8]
call fcn.005b56f0
cmp rdi, rax
sete dil
mov rcx, qword [rbx + 0xa8]
call fcn.005b56f0
mov rcx, rax
xor rdx, rdx
mov rax, qword [rbx + 0xa8]
movzx r8, byte [rax + 0xa9]
call fcn.006940d0
mov rcx, qword [rbx + 0x2d0]
mov dl, 1
mov r8b, 1
call fcn.006940d0
test dil, dil
je 0x6aa63a
mov rcx, qword [rbx + 0xa8]
call fcn.005b56f0
mov rcx, rax
call sub.user32.dll_SetForegroundWindow
mov rcx, qword [rbx + 0xa8]
mov edx, 0xb033
xor r8, r8
xor r9, r9
call fcn.005a9100
test sil, sil
je 0x6aa69c
mov rax, qword [rbx + 0x2d0]
mov rsi, qword [rbx + 0x2d0]
mov rcx, rax
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
or rax, 0x80
mov rcx, rsi
mov edx, 0xffffffec
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rcx, qword [rbx + 0x2d0]
xor rdx, rdx
call sub.user32.dll_SetWindowTextW
jmp 0x6aa6f1
mov rax, qword [rbx + 0x2d0]
mov rsi, qword [rbx + 0x2d0]
mov rcx, rax
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
and rax, 0xffffffffffffff7f
mov rcx, rsi
mov edx, 0xffffffec
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rsi, qword [rbx + 0x2d0]
mov rax, qword [rbx + 0x118]
mov rcx, rax
call fcn.0040f960
mov rcx, rsi
mov rdx, rax
call sub.user32.dll_SetWindowTextW
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x6b35d0
Capabilities:
Hide graphical window

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
cmp qword [rbx + 0xc0], 0
jne 0x6b3686
mov rcx, qword [rbx + 0x10]
call fcn.005b56f0
mov rcx, qword [0x005ca298]
mov dl, 1
mov r8, rax
call fcn.005ac3c0
mov qword [rbx + 0xc0], rax
mov rsi, qword [rbx + 0xc0]
mov rcx, rsi
xor rdx, rdx
call fcn.005d2a00
lea rax, [rsi + 0x4b0]
mov qword [rax + 8], rbx
lea rcx, [0x006b2c40]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xc0]
call fcn.005b56f0
mov rsi, rax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xc0]
call fcn.005b56f0
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xe0], 0
jne 0x6b3731
mov rcx, qword [rbx + 0x10]
call fcn.005b56f0
mov rcx, qword [0x005ca298]
mov dl, 1
mov r8, rax
call fcn.005ac3c0
mov qword [rbx + 0xe0], rax
mov rsi, qword [rbx + 0xe0]
mov rcx, rsi
mov dl, 1
call fcn.005d2a00
lea rax, [rsi + 0x4b0]
mov qword [rax + 8], rbx
lea rcx, [0x006b2ca0]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xe0]
call fcn.005b56f0
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xe0]
call fcn.005b56f0
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xd0], 0
jne 0x6b37cd
mov rcx, qword [rbx + 0x10]
call fcn.005b56f0
mov rcx, qword [0x005cb270]
mov dl, 1
mov r8, rax
call fcn.005ac3c0
mov qword [rbx + 0xd0], rax
mov rax, qword [rbx + 0xd0]
mov byte [rax + 0x480], 1
mov rcx, qword [rbx + 0xd0]
call fcn.005b56f0
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov edi, eax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xd0]
call fcn.005b56f0
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
Function at 0x1400017c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, r9
mov r14, r8
mov r12d, edx
mov r15, rcx
mov dword [rbp - 0x20], 0x78563412
cmp dword [rcx + 0x58], 1
jbe 0x1400019a1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
xor esi, esi
mov qword [rbp - 8], rsi
mov byte [rbp + 0x30], sil
mov al, byte [rcx + 0x5c]
neg al
sbb rdx, rdx
and edx, 4
cmp r8, 0x7e
sbb rax, rax
not rax
and eax, 2
add rdx, rax
cmp r8, 0x10000
sbb rax, rax
and rax, 0xfffffffffffffffa
add rax, 8
add rdx, rax
lea r8, [rbp + 0x30]
lea rcx, [rbp - 0x18]
call fcn.140002404
mov dl, 0x80
or r12b, dl
mov rdi, qword [rbp - 0x18]
mov byte [rdi], r12b
mov al, byte [r15 + 0x5c]
cmp r14, 0x7e
jae 0x14000187d
neg al
sbb al, al
and al, dl
or al, r14b
mov byte [rdi + 1], al
cmp byte [r15 + 0x5c], sil
je 0x140001909
mov dword [rdi + 2], 0x78563412
jmp 0x140001909
mov rcx, r14
shr rcx, 8
cmp r14, 0x10000
jae 0x1400018ae
neg al
sbb al, al
and al, dl
add al, 0x7e
mov byte [rdi + 1], al
mov byte [rdi + 2], cl
mov byte [rdi + 3], r14b
cmp byte [r15 + 0x5c], sil
je 0x140001909
mov dword [rdi + 4], 0x78563412
jmp 0x140001909
neg al
sbb al, al
and al, dl
add al, 0x7f
mov byte [rdi + 1], al
mov rax, r14
shr rax, 0x38
mov byte [rdi + 2], al
mov rax, r14
shr rax, 0x30
mov byte [rdi + 3], al
mov rax, r14
shr rax, 0x28
mov byte [rdi + 4], al
mov rax, r14
shr rax, 0x20
mov byte [rdi + 5], al
mov rax, r14
shr rax, 0x18
mov byte [rdi + 6], al
mov rax, r14
shr rax, 0x10
mov byte [rdi + 7], al
mov byte [rdi + 8], cl
mov byte [rdi + 9], r14b
cmp byte [r15 + 0x5c], sil
je 0x140001909
mov dword [rdi + 0xa], 0x78563412
lea r12, [r15 + 0x20]
mov r9, qword [rbp - 0x10]
sub r9, rdi
mov rdx, qword [r15 + 0x28]
mov r8, rdi
mov rcx, r12
call fcn.1400013ec
mov r9, qword [rbp + 0x50]
sub r9, rbx
mov rdx, qword [r15 + 0x28]
mov r8, rbx
mov rcx, r12
call fcn.1400013ec
cmp byte [r15 + 0x5c], sil
je 0x140001971
mov r8, qword [r12 + 8]
sub r8, qword [r12]
sub r8, r14
test r14, r14
je 0x140001971
mov rdx, qword [r12]
add rdx, rsi
mov cl, byte [rdx + r8]
mov rax, rsi
and eax, 3
xor cl, byte [rbp + rax - 0x20]
mov byte [rdx + r8], cl
inc rsi
cmp rsi, r14
jne 0x140001950
mov rdx, qword [rbp - 8]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x140001999
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400019ba
mov rcx, rdi
call fcn.14002a2e0
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.14003114c
int3
Function at 0x140002c34
Capabilities:
Connect socket
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x14008f0c0]
xor rax, rsp
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
lea r8, [0x140056620]
mov rbx, rcx
mov r9d, edx
movups xmmword [rsp + 0x48], xmm0
or rdi, 0xffffffffffffffff
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x58], xmm0
lea edx, [rdi + 0x11]
movups xmmword [rsp + 0x68], xmm0
call fcn.140001708
cmp qword [rbx + 0x18], 0xf
jbe 0x140002c95
mov rbx, qword [rbx]
lea r9, [rsp + 0x40]
mov rcx, rbx
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x78]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x140002d01
and qword [rsp + 0x30], 0
lea rbx, [0x140090aa0]
mov r9d, 0x400
mov r8d, eax
mov dword [rsp + 0x28], r9d
xor edx, edx
mov ecx, 0x12ff
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov ecx, 2
call fcn.1400312e4
mov r8, rbx
lea rdx, str.getaddrinfo:__s_n
mov rcx, rax
call fcn.1400032e8
mov eax, 1
jmp 0x140002d61
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140002d55
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140002d47
mov r8d, dword [rbx + 0x10]
mov rcx, rax
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140002d50
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
or rdi, 0xffffffffffffffff
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x140002d0b
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, rdi
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14002a7b0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
ret