joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007720
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x1401cb558]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
lea rdx, [rsp + 0x20]
mov rcx, qword [rcx + 0x6e0]
mov r8d, 2
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 1
jl 0x14000790c
movzx eax, word [rsp + 0x20]
mov ecx, 0xff
cmp ax, cx
ja 0x14000790c
mov qword [rsp + 0x188], rbx
movzx ebx, al
mov ecx, ebx
mov qword [rsp + 0x158], r14
mov qword [rsp + 0x150], r15
call fcn.140071b4c
mov ecx, ebx
mov r14d, eax
call fcn.140071b20
mov rcx, qword [rdi + 0x1e0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x147
mov r15d, eax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x1400078f4
mov rcx, qword [rdi + 0x1e0]
xor r9d, r9d
mov qword [rsp + 0x190], rbp
mov edx, 0x150
mov qword [rsp + 0x198], rsi
mov qword [rsp + 0x168], r12
movsxd r8, eax
mov qword [rsp + 0x160], r13
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x1d0]
lea r13, [0x1401be8a0]
movsxd rbp, eax
xor r9d, r9d
add rbp, rbp
xor r8d, r8d
mov edx, 0x188
mov r12d, dword [r13 + rbp*8 + 4]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, rax
cmp eax, 0xffffffff
je 0x1400078d4
movzx edx, r14b
lea rcx, [rsp + 0x40]
cmp r12d, 0x14
cmovge edx, ebx
movsxd rbx, esi
movzx r8d, dl
lea rdx, str.___c_t_s
mov byte [rdi + rbx*8 + 0x8f4], r8b
mov dword [rdi + rbx*8 + 0x8f8], r12d
mov r9, qword [r13 + rbp*8 + 8]
call fcn.1400080e0
mov rcx, qword [rdi + 0x1d0]
lea r9, [rsp + 0x40]
mov r8, rbx
mov edx, 0x181
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x1d0]
lea eax, [rsi + 1]
movsxd r8, eax
xor r9d, r9d
mov edx, 0x182
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x1d0]
xor r9d, r9d
mov r8, rbx
mov edx, 0x186
call qword [sym.imp.USER32.dll_SendMessageW]
movzx edx, r15b
mov rcx, rdi
call fcn.140006260
cmp eax, 0xffffffff
je 0x1400078d4
cmp eax, esi
je 0x1400078d4
mov edx, eax
mov rcx, rdi
call fcn.140006060
mov rsi, qword [rsp + 0x198]
mov r13, qword [rsp + 0x160]
mov r12, qword [rsp + 0x168]
mov rbp, qword [rsp + 0x190]
mov r14, qword [rsp + 0x158]
mov rbx, qword [rsp + 0x188]
mov r15, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14002a970
add rsp, 0x170
pop rdi
ret
Function at 0x140008430
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, r9
mov edi, r8d
mov rbp, rdx
mov rbx, rcx
cmp r8d, 0x201
jne 0x140008483
lea r8, [rcx + 0xa0]
mov dword [rsp + 0x28], 1
xor ecx, ecx
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov r9, rsi
mov r8d, edi
mov rdx, rbp
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp method.CSmLabel.virtual_0
sub rsp, 0x38
cmp r8d, 0x20
je 0x1400084e5
cmp r8d, 0x138
je case.default.0x1400084cb
mov rcx, qword [rcx + 0x18]
add rsp, 0x38
jmp qword [sym.imp.USER32.dll_CallWindowProcW]
mov rax, qword [rcx]
mov rdx, r9
mov r8, qword [rsp + 0x60]
add rsp, 0x38
jmp qword [rax + 8]
mov rcx, qword [rcx + 0x90]
test rcx, rcx
je 0x1400084f7
call qword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
add rsp, 0x38
ret
mov ecx, dword [rcx - 0x4100c6d2]
mov cl, 0x2f
invalid
invalid
xor esi, dword [rbx - 0x3f]
invalid
lahf
out dx, al
wait
loop case.0x1400084cb.4
invalid
jmp 0x1402a737a
and eax, 0x9d3d27d7
movsb byte [rdi], byte [rsi]
xor al, 0x78
cmp byte [rsi - 0x40], cl
sal byte [rdx - 0x4773eb9d], 0xb
insb byte [rdi], dx
movsd dword [rdi], dword [rsi]
or eax, 0x77f037c6
pop rbx
test eax, 0x3e1727e7
add al, 0xea
invalid
push rsp
jae 0x1402a8148
lodsb al, byte [rsi]
ret
mov ebx, 0x204240ac
invalid
mov esp, 0x6707e77e
pop rbx
mov ebx, 0x7fb5ff7e
call qword [rbp - 0x46]
push rdi
jno 0x1402a81b9
shl dword [rsi + 0x6e3283a4], 0x12
test eax, 0xeceeb882
lodsb al, byte [rsi]
xchg dword [rdx - 0x1b9bacf5], eax
push rbx
in al, 0xe4
cmp eax, 0xbef009ec
neg dword [rcx]
test eax, 0x22812af9
add byte [rax], al
invalid
invalid
push rbx
in al, 0xe4
cmp eax, 0xbef009ec
neg dword [rcx]
test eax, 0x22812af9
add byte [rax], al
jmp 0x1402a82bc
jns 0x1402a8327
std
push rsi
invalid

Function at 0x140008e90
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x860
mov rax, qword [0x1401cb558]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rbx, rcx
lea rdx, [rsp + 0x50]
mov rcx, qword [rcx + 0x1d0]
mov r8d, 0x400
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx + 0x4a8]
lea rdx, [rsp + 0x28]
mov r8d, 0x10
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx + 0x1c8]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.1400086a0
cmp eax, 0xffffffff
je 0x140008f6a
mov rcx, qword [rbx + 0x1c8]
xor r9d, r9d
movsxd r8, eax
mov edx, 0x182
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x260]
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
xor edx, edx
mov rcx, rbx
call fcn.140009a80
mov rcx, qword [rbx + 0x1f0]
xor edx, edx
cmp word [rsp + 0x50], dx
setne dl
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rbx + 0x4a8]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rbx + 0x4a8]
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.14002a970
add rsp, 0x860
pop rbx
ret
Function at 0x140009940
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x850
mov rax, qword [0x1401cb558]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov rcx, qword [rcx + 0x1d0]
mov r8d, 0x400
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx + 0x4a8]
lea rdx, [rsp + 0x20]
mov r8d, 0x10
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rsp + 0x40], 0
je 0x1400099a5
cmp word [rsp + 0x20], 0
je 0x1400099a5
mov edx, 1
jmp 0x1400099a7
xor edx, edx
mov rcx, qword [rbx + 0x1f0]
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14002a970
add rsp, 0x850
pop rbx
ret

Function at 0x14000b0e0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
lea r8, [rcx + 0x5c]
mov dword [rsp + 0x28], 1
xor ecx, ecx
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
add rsp, 0x38
ret
Function at 0x14000c3a0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1401cb558]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
mov rdi, r8
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x34], 6
jb 0x14000c40b
mov ecx, 0x28
call fcn.14002a9c8
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14000c42f
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.14000b8d0
jmp 0x14000c431
mov ecx, 0x98
call fcn.14002a9c8
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14000c42f
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.14000b860
jmp 0x14000c431
xor eax, eax
mov qword [rbx + 8], rax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14002a970
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14000d0b0
Capabilities:
Get file attributes
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x1401cb558]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov r8d, 0x104
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ecx, ecx
mov r8d, 0x80070057
test eax, eax
cmovne r8d, ecx
je 0x14000d152
lea r8, str.MicrosoftWindowsStart_MenuProgramsUnikeyNT.lnk
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.140095c40
mov ecx, eax
neg ecx
sbb edx, edx
and edx, 0x80070057
test eax, eax
jne 0x14000d14e
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xfffffff
jb 0x14000d147
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000cb10
jmp 0x14000d155
mov eax, 1
jmp 0x14000d155
mov eax, edx
jmp 0x14000d155
mov eax, r8d
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14002a970
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x14000da60
Capabilities:
Write clipboard data

Disassembly:
cmp ecx, 1
jne 0x14000da6c
xor ecx, ecx
jmp fcn.14000f000
cmp ecx, 0xd
jne 0x14000da7b
mov ecx, 1
jmp fcn.14000f000
mov eax, 1
ret
Function at 0x14000f000
Capabilities:
Write clipboard data

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rdi, qword [0x1401da538]
xor ebx, ebx
mov r14d, ecx
mov esi, ebx
mov ebp, ebx
test rdi, rdi
jne 0x14000f02d
xor eax, eax
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x60], r12
mov rcx, rdi
mov qword [rsp + 0x78], r15
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov rcx, rdi
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r15, rax
test rax, rax
je 0x14000f11d
lea r9, [rsp + 0x68]
mov dword [rsp + 0x70], r12d
lea r8, [rsp + 0x70]
mov dword [rsp + 0x68], ebx
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rcx, rax
call fcn.14002a030
cmp eax, 6
jne 0x14000f0c5
movsxd rdx, dword [rsp + 0x68]
lea ecx, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x14000f0f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x14000f0f8
lea r9, [rsp + 0x68]
mov dword [rsp + 0x70], r12d
lea r8, [rsp + 0x70]
mov dword [rsp + 0x20], r14d
mov rdx, rax
mov rcx, r15
call fcn.14002a030
test eax, eax
jne 0x14000f0f8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test r14d, r14d
mov eax, 0xd
mov ebp, 1
mov rdx, rbx
mov ecx, ebp
cmovne ecx, eax
call qword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x14000f11d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test rsi, rsi
je 0x14000f10f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test rbx, rbx
je 0x14000f11d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r15, qword [rsp + 0x78]
mov eax, ebp
mov r12, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000f140
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor r9d, r9d
mov rcx, qword [rcx + 0x1c8]
xor r8d, r8d
mov edx, 0x147
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, qword [rbx + 0x5b8]
xor r9d, r9d
mov edx, 0x147
mov dword [r8 + 0x20], eax
xor r8d, r8d
mov rcx, qword [rbx + 0x1d0]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x5b8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov dword [rcx + 0x24], eax
mov rcx, qword [rbx + 0x1e8]
call qword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov edx, 0xf0
cmp rax, 1
mov rax, qword [rbx + 0x5b8]
sete cl
xor r9d, r9d
xor r8d, r8d
mov dword [rax + 0x28], ecx
mov rcx, qword [rbx + 0x1f0]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x5b8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov dword [rcx + 0x270], eax
mov rcx, qword [rbx + 0x1f8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x5b8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov dword [rcx + 0x274], eax
mov rcx, qword [rbx + 0x200]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x5b8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov dword [rcx + 0x278], eax
mov rcx, qword [rbx + 0x208]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x5b8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov dword [rcx + 0x26c], eax
mov rcx, qword [rbx + 0x210]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x5b8]
mov dword [rcx + 0x27c], eax
mov rcx, qword [rbx + 0x5b8]
add rsp, 0x20
pop rbx
jmp fcn.140012220

Function at 0x1400102c0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x1401daae5], 0
mov rbx, rcx
je 0x1400102dc
add rsp, 0x20
pop rbx
jmp fcn.14000fe70
lea rcx, [0x1401daad0]
call fcn.140010930
test al, al
je 0x140010300
mov rcx, rbx
mov byte [rbx + 0x1d8], 1
add rsp, 0x20
pop rbx
jmp fcn.140010350
mov rax, qword [rbx + 8]
lea r8, [0x1400eb388]
mov r9d, 0x10
lea rdx, str.Failed_to_start_downloading_update
movsxd rcx, dword [rax + 4]
mov rcx, qword [rcx + rbx + 0x10]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140010350

Function at 0x140010d60
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x1401cb558]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140010dd8
lea rdx, [rsp + 0x20]
mov ecx, 0x103
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x140010dd8
mov edx, 0x2f
mov rcx, rbx
call fcn.1400626b8
test rax, rax
je 0x140010dd8
cmp word [rax + 2], 0
je 0x140010dd8
lea r9, [rax + 2]
mov rcx, rdi
lea r8, [rsp + 0x20]
lea rdx, [0x140183120]
call fcn.1400080e0
mov al, 1
jmp 0x140010dda
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14002a970
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rdi
ret
Function at 0x140011890
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x3a0
mov rax, qword [0x1401cb558]
xor rax, rsp
mov qword [rsp + 0x390], rax
mov edi, ecx
mov dword [rsp + 0x60], 0x114
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
lea rax, [rsp + 0x58]
cmp dword [rsp + 0x70], 2
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov qword [rsp + 0x40], rax
mov ecx, ebx
setne cl
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
add rcx, 0xffffffff80000001
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 3
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14001191a
xor eax, eax
jmp 0x1400119ce
test edi, edi
je 0x140011988
mov r8d, 0x104
lea rdx, [rsp + 0x180]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x180]
mov rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x140011943
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.UniKey
lea rax, [rsp + 0x180]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
jmp 0x1400119c1
mov rcx, qword [rsp + 0x50]
lea rdx, str.UniKey
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
lea rdx, str.UniKey
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.14002a970
mov rbx, qword [rsp + 0x3b0]
add rsp, 0x3a0
pop rdi
ret
Function at 0x140012070
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x1401cb558]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor edi, edi
lea rax, [rsp + 0x30]
cmp dword [rsp + 0x50], 2
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov ecx, edi
mov qword [rsp + 0x20], rax
setne cl
xor r8d, r8d
add rcx, 0xffffffff80000001
lea r9d, [rdi + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400120d7
xor eax, eax
jmp 0x14001211e
mov rcx, qword [rsp + 0x30]
lea rdx, str.UniKey
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x180], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x180]
sete dil
mov eax, edi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14002a970
add rsp, 0x170
pop rdi
ret
Function at 0x14001a090
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14001a0c1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x14001a13b
mov rdi, r14
mov rcx, rbx
call fcn.140021f40
test rax, rax
jle 0x14001a113
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140062a60
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14001a12b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14001a133
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14001a0d5
sub r14, rdi
jmp 0x14001a21f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14001a152
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001a154
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001a186
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140062a60
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14001a21c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001a1c1
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14001a1fd
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14009748c
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14001a21c
cmp rbp, rax
ja 0x14001a1d0
test rbp, rbp
je 0x14001a21c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14009748c
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14001acb0
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
movabs r9, 0x100000001b3
movzx eax, byte [rdx + 1]
xor r8, rcx
movzx ecx, byte [rdx + 2]
imul r8, r9
xor rax, r8
imul rax, r9
xor rax, rcx
movzx ecx, byte [rdx + 3]
imul rax, r9
xor rax, rcx
imul rax, r9
ret
mov rdx, rcx
movabs rcx, 0xcbf29ce484222325
jmp 0x14001abe0
Function at 0x14001e930
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
lea rcx, [0x1401dc940]
call qword [sym.imp.USER32.dll_GetKeyboardState]
movzx eax, byte [0x1401dc951]
shr al, 7
mov byte [0x1401dc0e6], al
movzx eax, byte [0x1401dc952]
shr al, 7
mov byte [0x1401dc0e7], al
movzx eax, byte [0x1401dc950]
shr al, 7
mov byte [0x1401dc128], al
movzx eax, byte [0x1401dc9e0]
shr al, 7
mov byte [0x1401dc129], al
movzx eax, byte [0x1401dc9e1]
shr al, 7
test byte [0x1401dc99b], 0x80
mov byte [0x1401dc12a], al
jne 0x14001e9b5
test byte [0x1401dc99c], 0x80
mov byte [0x1401dc12b], 0
je 0x14001e9bc
mov byte [0x1401dc12b], 1
add rsp, 0x28
ret
Function at 0x14002b9e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002ba32
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002ba32
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002ba32
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002ba32
cmp dword [rcx + 0x84], 0xe
jbe 0x14002ba32
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002ba34
xor al, al
add rsp, 0x28
ret

Function at 0x140095288
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x1400952bf
call fcn.140095ab4
mov dword [rax], 0x16
call fcn.1400958d8
xor eax, eax
jmp 0x14009534d
mov rdx, r9
mov rcx, r8
call fcn.1400950d8
mov rbx, rax
test rax, rax
je 0x14009534a
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x140094ed8]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140095337
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140095a28
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14009531e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14009532d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1400c08bc
jmp 0x14009534a
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140095347
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400ac4cc
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov r14, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rbp - 0x60]
call fcn.1400710fc
mov rax, qword [rbp - 0x58]
mov edi, 0xfde9
cmp dword [rax + 0xc], edi
jne 0x1400ac517
xor ebx, ebx
cmp byte [rbp - 0x48], bl
je 0x1400ac54b
mov rax, qword [rbp - 0x60]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400ac54b
call fcn.1400c35c4
xor ebx, ebx
test eax, eax
jne 0x1400ac539
cmp byte [rbp - 0x48], bl
je 0x1400ac532
mov rax, qword [rbp - 0x60]
and dword [rax + 0x3a8], 0xfffffffd
mov edi, 1
jmp 0x1400ac54b
cmp byte [rbp - 0x48], bl
je 0x1400ac549
mov rax, qword [rbp - 0x60]
and dword [rax + 0x3a8], 0xfffffffd
mov edi, ebx
mov r9d, edi
mov qword [rbp - 0x30], rbx
lea r8, [rbp + 0x30]
mov qword [rbp - 0x28], rbx
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x20], rbx
mov rcx, rsi
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rbx
mov byte [rbp - 8], bl
call fcn.1400ac094
mov esi, eax
test eax, eax
je 0x1400ac587
call fcn.140095ab4
or edi, 0xffffffff
mov dword [rax], esi
jmp 0x1400ac5e0
mov r9d, edi
mov qword [rbp - 0x60], rbx
lea r8, [rbp + 0x30]
mov qword [rbp - 0x58], rbx
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x50], rbx
mov rcx, r14
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rbx
mov byte [rbp - 0x38], bl
call fcn.1400ac094
mov edi, eax
test eax, eax
je 0x1400ac5c3
call fcn.140095ab4
mov dword [rax], edi
or edi, 0xffffffff
jmp 0x1400ac5d2
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x20]
call fcn.1400c9d98
mov edi, eax
cmp byte [rbp - 0x38], bl
je 0x1400ac5e0
mov rcx, qword [rbp - 0x50]
call fcn.1400c08bc
cmp byte [rbp - 8], bl
je 0x1400ac5ee
mov rcx, qword [rbp - 0x20]
call fcn.1400c08bc
lea r11, [rsp + 0x80]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400c9a38
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400c9a4e
mov al, 1
jmp 0x1400c9aae
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400c9a5f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400c9aac
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400ca2d8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400c9aac
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400c9aac
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400c9aac
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400c9aae
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400c9d68
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400c9d88
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140095a28
or eax, 0xffffffff
jmp 0x1400c9d8a
xor eax, eax
add rsp, 0x28
ret