joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002f140
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14002f37b
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x140171140]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x140144c40]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x14002f343
mov rcx, rbp
call fcn.14002e810
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x14002f211
movsxd rdx, dword [rbp + 0x3108]
mov r8, qword [rbp + 0x3110]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x14002f201
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x14002f1f9
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x14002f1fc
mov rdx, rcx
test rdx, rdx
jne 0x14002f1d0
cmp r8, r10
je 0x14002f211
cmp dword [r8], r9d
jne 0x14002f211
mov rcx, qword [r8 + 8]
jmp 0x14002f213
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb0]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb0], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x14002f2a7
cmp qword [rcx + 0x18], 0
jne 0x14002f29c
mov qword [rcx + 0x18], rbx
jmp 0x14002f2a7
cmp qword [rcx + 0x20], 0
jne 0x14002f2a7
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xa8], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14002f2dc
nop
mov r9, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14002f2d0
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rsp + 0x20]
call fcn.140012370
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x14002f338
cmp r9b, 0x23
jne 0x14002f31b
cmp byte [r8], r9b
jne 0x14002f31b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x14002f308
not ecx
call fcn.14001c680
mov qword [rbx + 0x78], rax
add rdi, 0x24
sub rsi, 1
jne 0x14002f190
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140127fa0
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x1400501a0
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
mov r10, rdx
mov eax, 0x5e6ea9af
mul r8d
mov ebx, r8d
xor r9d, r9d
shr edx, 0xb
mov esi, r8d
imul eax, edx, 0x15b0
mov ecx, 1
sub ebx, eax
test r8d, r8d
je 0x1400502dc
mov qword [rsp + 0x20], rdi
xor edx, edx
cmp ebx, 7
jbe 0x140050242
lea r8d, [rdx + 7]
movzx eax, byte [r10]
add edx, 8
add ecx, eax
add r8d, 8
movzx eax, byte [r10 + 1]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 2]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 3]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 4]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 5]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 6]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 7]
add r9d, ecx
add ecx, eax
add r10, 8
add r9d, ecx
cmp r8d, ebx
jb 0x1400501e3
xor r8d, r8d
xor r11d, r11d
cmp edx, ebx
jae 0x1400502a4
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x140050291
mov eax, ebx
sub eax, edx
sub eax, 2
shr eax, 1
inc eax
mov edi, eax
lea edx, [rdx + rax*2]
nop word [rax + rax]
movzx eax, byte [r10]
add ecx, eax
movzx eax, byte [r10 + 1]
add r8d, ecx
add r10, 2
add ecx, eax
add r11d, ecx
sub rdi, 1
jne 0x140050270
cmp edx, ebx
jae 0x14005029d
movzx eax, byte [r10]
add ecx, eax
add r9d, ecx
inc r10
lea eax, [r11 + r8]
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul edx, edx, 0xffff000f
add r9d, edx
sub esi, ebx
mov ebx, 0x15b0
jne 0x1400501d8
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
shl r9d, 0x10
lea eax, [rcx + r9]
pop rsi
ret
Function at 0x140053f10
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140171140]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [0x140215508]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x50], rbx
mov rbx, qword [0x140214df0]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x28]
sub eax, dword [rsp + 0x20]
movd xmm1, eax
mov eax, dword [rsp + 0x2c]
sub eax, dword [rsp + 0x24]
cmp byte [reloc.WS2_32.dll_accept], 0
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x10], xmm1
movss dword [rbx + 0x14], xmm0
je 0x140053fce
mov qword [rsp + 0x40], rdi
mov rdi, qword [0x140214df0]
mov ecx, dword [rdi + 0x1634]
test ecx, ecx
jns 0x140053fa4
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rdi + 0x1630]
test eax, eax
cmovg edx, eax
call fcn.140055950
xor r9d, r9d
mov dword [rdi + 0x1630], 0
lea r8, [0x140053d80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayMonitors]
mov rdi, qword [rsp + 0x40]
mov byte [reloc.WS2_32.dll_accept], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x30]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [0x140215510]
cvtsi2ss xmm0, qword [0x140215518]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rbx + 0x18], xmm1
mov qword [0x140215510], rcx
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, reloc.WS2_32.dll_recv
and al, 1
mov byte [rbx + 0x154], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, reloc.WS2_32.dll_select
and al, 1
mov byte [rbx + 0x155], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x157], 0
mov byte [rbx + 0x156], al
call fcn.1400538c0
cmp byte [rbx + 0xd0], 0
mov rbx, qword [rsp + 0x50]
je 0x14005406f
mov eax, 0xffffffff
jmp 0x14005407c
mov rax, qword [0x140214df0]
mov eax, dword [rax + 0x2078]
cmp dword [reloc.WS2_32.dll_htons], eax
je 0x14005408f
mov dword [reloc.WS2_32.dll_htons], eax
call fcn.140053740
call fcn.140053ad0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140127fa0
add rsp, 0x48
ret
Function at 0x1400761b0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x30
mov r8, qword [0x140214df0]
mov rbx, rcx
mov ecx, dword [r8 + 0x74]
call fcn.14001bbe0
test al, al
je 0x1400761d9
mov byte [rbx + 0x20], 0x42
mov al, 1
add rsp, 0x30
pop rbx
ret
movss xmm0, dword [r8 + 0x148]
movaps xmmword [rsp + 0x20], xmm6
xorps xmm6, xmm6
comiss xmm6, xmm0
jbe 0x140076200
movaps xmm6, xmmword [rsp + 0x20]
mov al, 1
mov byte [rbx + 0x20], 0x3f
add rsp, 0x30
pop rbx
ret
comiss xmm0, xmm6
jbe 0x140076216
movaps xmm6, xmmword [rsp + 0x20]
mov al, 1
mov byte [rbx + 0x20], 0x40
add rsp, 0x30
pop rbx
ret
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140076237
movaps xmm6, xmmword [rsp + 0x20]
mov al, 1
mov byte [rbx + 0x20], gethostname
add rsp, 0x30
pop rbx
ret
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140076258
movaps xmm6, xmmword [rsp + 0x20]
mov al, 1
mov byte [rbx + 0x20], 0x34
add rsp, 0x30
pop rbx
ret
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140076279
movaps xmm6, xmmword [rsp + 0x20]
mov al, 1
mov byte [rbx + 0x20], 0x35
add rsp, 0x30
pop rbx
ret
mov ecx, 5
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14007629a
movaps xmm6, xmmword [rsp + 0x20]
mov al, 1
mov byte [rbx + 0x20], reloc.WLDAP32.dll_Ordinal_60
add rsp, 0x30
pop rbx
ret
mov ecx, 6
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400762bb
movaps xmm6, xmmword [rsp + 0x20]
mov al, 1
mov byte [rbx + 0x20], 0x3d
add rsp, 0x30
pop rbx
ret
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400762dc
movaps xmm6, xmmword [rsp + 0x20]
mov al, 1
mov byte [rbx + 0x20], reloc.WS2_32.dll_setsockopt
add rsp, 0x30
pop rbx
ret
mov rdx, qword [0x140214df0]
xor r8d, r8d
mov ecx, r8d
nop dword [rax]
movsxd rax, ecx
movss xmm0, dword [rdx + rax*4 + 0x44c]
ucomiss xmm0, xmm6
jp 0x140076303
je 0x140076354
inc ecx
cmp ecx, 5
jl 0x1400762f0
lea r10, str._._
lea r9, str.RustClient.exe
mov ecx, r8d
call fcn.14001bbe0
test al, al
je 0x14007633b
mov rcx, r10
cmp dword [rcx + 0x10], r8d
je 0x140076336
add rcx, 0x18
cmp rcx, r9
jne 0x140076327
cmp rcx, r9
jne 0x140076367
inc r8d
cmp r8d, 0x200
jl 0x140076318
movaps xmm6, xmmword [rsp + 0x20]
xor al, al
add rsp, 0x30
pop rbx
ret
movaps xmm6, xmmword [rsp + 0x20]
add cl, 0x39
mov byte [rbx + 0x20], cl
mov al, 1
add rsp, 0x30
pop rbx
ret
sub rcx, r10
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov byte [rbx + 0x20], dl
cmp dl, 0x35
jne 0x14007639f
mov ecx, 0xa5
call fcn.14001bbe0
test al, al
je 0x14007639f
mov byte [rbx + 0x20], 0x53
movaps xmm6, xmmword [rsp + 0x20]
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140077600
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x140171140]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14007766b
lea rdx, str.RustClient.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14007768f
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140077643
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140127fa0
add rsp, 0x160
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x140077676
Function at 0x140083500
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140171140]
xor rax, rsp
mov qword [rsp + 0x30], rax
movsxd rdi, ecx
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movabs rax, 0x20c49ba5e353f7cf
lea rcx, [rsp + 0x20]
imul qword [rsp + 0x28]
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x28], rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
cqo
mov qword [rsp + 0x20], 0
idiv qword [rsp + 0x28]
add rdi, rax
test rdi, rdi
jle 0x140083592
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
cqo
idiv qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
cmp rax, rdi
jl 0x140083571
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140127fa0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400835b0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov rax, rsp
push rbp
push r12
push r14
push r15
sub rsp, 0x58
xor ecx, ecx
movaps xmmword [rax - 0x48], xmm6
cvttsd2si ebp, xmm1
mov r14d, r9d
mov dword [rsp + 0x80], ecx
xor r9d, r9d
mov r12d, 1
mov r15d, r8d
movaps xmm6, xmm0
cmp ebp, r12d
jl 0x14008368f
mov qword [rax + 0x18], rbx
mov qword [rax - 0x28], rsi
mov qword [rax - 0x30], rdi
mov qword [rax - 0x38], r13
mov r13d, r14d
mov dword [rsp + 0x88], r8d
nop word [rax + rax]
mov eax, r15d
mov qword [rsp + 0x20], 0
cdq
idiv ebp
mov esi, eax
mov eax, r14d
cdq
idiv ebp
mov edi, eax
mov eax, ebp
imul eax, r12d
mov r8d, edi
sub r8d, r9d
xor r9d, r9d
cdq
idiv ebp
mov edx, esi
sub edx, ecx
mov ebx, eax
lea ecx, [r9 + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, ebx
sub ecx, dword [rsp + 0x80]
call fcn.140083500
add r15d, dword [rsp + 0x88]
inc r12d
add r14d, r13d
mov dword [rsp + 0x80], ebx
mov ecx, esi
mov r9d, edi
cmp r12d, ebp
jle 0x140083610
mov r13, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x90]
cvttsd2si ecx, xmm6
sub ecx, ebp
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x58
pop r15
pop r14
pop r12
pop rbp
jmp fcn.140083500
Function at 0x140084a00
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140171140]
xor rax, rsp
mov qword [rsp + 0x30], rax
movsxd rdi, ecx
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movabs rax, 0x20c49ba5e353f7cf
lea rcx, [rsp + 0x20]
imul qword [rsp + 0x28]
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x28], rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
cqo
mov qword [rsp + 0x20], 0
idiv qword [rsp + 0x28]
add rdi, rax
test rdi, rdi
jle 0x140084a92
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
cqo
idiv qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
cmp rax, rdi
jl 0x140084a71
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140127fa0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140084ab0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbp
push r12
push r14
push r15
sub rsp, 0x60
xor r12d, r12d
movaps xmmword [rax - 0x38], xmm7
cvttsd2si ebp, xmm0
mov r14d, 1
mov ecx, r12d
mov r9d, r12d
mov r15d, r12d
movaps xmmword [rax - 0x48], xmm8
movaps xmm7, xmm2
movaps xmm8, xmm1
cmp ebp, r14d
jl 0x140084b92
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
movaps xmmword [rax - 0x28], xmm6
movd xmm6, ebp
cvtdq2ps xmm6, xmm6
nop word [rax + rax]
movd xmm1, r14d
mov eax, ebp
cvtdq2ps xmm1, xmm1
mov qword [rsp + 0x20], r12
imul eax, r14d
movaps xmm0, xmm1
mulss xmm1, xmm7
mulss xmm0, xmm8
cdq
idiv ebp
divss xmm1, xmm6
mov ebx, eax
divss xmm0, xmm6
cvttss2si edi, xmm1
cvttss2si esi, xmm0
mov r8d, edi
sub r8d, r9d
xor r9d, r9d
mov edx, esi
sub edx, ecx
lea ecx, [r9 + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, ebx
sub ecx, r15d
call fcn.140084a00
inc r14d
mov ecx, esi
mov r9d, edi
mov r15d, ebx
cmp r14d, ebp
jle 0x140084b10
movaps xmm6, xmmword [rsp + 0x50]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov ecx, ebp
mov rbp, qword [rsp + 0x98]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x30]
add rsp, 0x60
pop r15
pop r14
pop r12
jmp fcn.140084a00
Function at 0x140085910
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x140085933
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x1b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jb 0x140085920
mov byte [rcx + 0x15], 0
mov rax, rcx
ret

Function at 0x1400859a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x25], 0
je 0x1400859c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x1b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x24
jb 0x1400859b0
mov byte [rcx + 0x25], 0
mov rax, rcx
ret

Function at 0x140086c40
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140214df0]
mov ecx, 1
mov dword [rax + 0x140], 0
mov byte [rax + 0x144], 0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140086c7a
mov rax, qword [0x140214df0]
mov byte [rax + 0x140], 1
add rsp, 0x28
ret
Function at 0x14008b940
Capabilities:
Clear windows event logs
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0xf8
mov rax, qword [0x140171140]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
lea rdx, str.cmd.exe__c_echo_Starting_Removal_Of_Script...__for__L__i_in__10__1_1__do__echo__i__timeout__T_1___nul____if_exist_C:EmporiumAssets__rd__S__Q_C:EmporiumAssets__echo_Assets_removed___else__echo_Assets_folder_not_found_______if_exist_C:Emporiumconfigs__rd__S__Q_C:Emporiumconfigs__echo_Configs_removed___else__echo_Configs_folder_not_found_______if_exist_C:EmporiumPackages__rd__S__Q_C:EmporiumPackages__echo_Packages_removed___else__echo_Packages_folder_not_found_______if_exist_C:Emporium__rd__S__Q_C:Emporium__echo_Emporium_removed___else__echo_Emporium_folder_not_found______wevtutil_cl_Application__echo_Event_Viewer_cleared__echo_Script_Cleaned__Delete_The_Loader_And_Clear_Your_Downloads_On_Your_Browser.__pause
movups xmmword [rsp + 0x74], xmm0
xor eax, eax
xor r9d, r9d
mov dword [r11 - 0x24], eax
xor r8d, r8d
mov qword [rsp + 0x60], rax
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
movups xmmword [r11 - 0x74], xmm0
mov dword [rsp + 0x28], 0x8000000
movups xmmword [r11 - 0x64], xmm0
mov dword [rsp + 0x20], eax
movups xmmword [r11 - 0x54], xmm0
movups xmmword [r11 - 0x44], xmm0
movups xmmword [r11 - 0x34], xmm0
mov dword [rsp + 0x70], WSAGetLastError
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14008ba3e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.CreateProcess_failed:
mov qword [rsp + 0xf0], rbx
call fcn.14000a080
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x14000a040]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, qword [rsp + 0xf0]
mov eax, 1
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140127fa0
add rsp, 0xf8
ret
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140127fa0
add rsp, 0xf8
ret
Function at 0x14008f5c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14008f5e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x1b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14008f5d0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14008f5f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x14008f613
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x1b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x14008f600
mov byte [rcx + 0xb], 0
mov rax, rcx
ret

Function at 0x14008f6a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x14008f6c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x1b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x14008f6b0
mov byte [rcx + 0xd], 0
mov rax, rcx
ret

Function at 0x14008f6d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x14008f6f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x1b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x14008f6e0
mov byte [rcx + 9], 0
mov rax, rcx
ret

Function at 0x14008f880
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2a], 0
je 0x14008f8a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x1b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x29
jb 0x14008f890
mov byte [rcx + 0x2a], 0
mov rax, rcx
ret

Function at 0x14008f940
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x14008f963
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x1b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x14008f950
mov byte [rcx + 0xf], 0
mov rax, rcx
ret

Function at 0x14008fb50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x35], 0
je 0x14008fb73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x1b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x34
jb 0x14008fb60
mov byte [rcx + 0x35], 0
mov rax, rcx
ret

Function at 0x14008fc40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x14008fc63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x1b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x13
jb 0x14008fc50
mov byte [rcx + 0x14], 0
mov rax, rcx
ret

Function at 0x14008fcd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x14008fcf3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x1b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x14008fce0
mov byte [rcx + 0xa], 0
mov rax, rcx
ret

Function at 0x14008fd50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x23], 0
je 0x14008fd73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x1b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x22
jb 0x14008fd60
mov byte [rcx + 0x23], 0
mov rax, rcx
ret

Function at 0x14008fdd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x14008fdf3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x1b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x14008fde0
mov byte [rcx + 8], 0
mov rax, rcx
ret