joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400122bc
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
lea r9, [0x14001e8e8]
mov r8, rdx
lea rdx, str.open
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r9
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp rax, 0x20
seta cl
mov eax, ecx
add rsp, 0x38
ret

Function at 0x14001246c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [0x140026d28], 0
jne 0x140012544
mov esi, InitCommonControls
lea rbp, [0x140026d30]
mov edi, 0x400
lea edx, [rsi + 2]
mov r9d, esi
mov r8, rbp
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rcx, rbp
call sub.msvcrt.dll__wtoi
mov r9d, esi
mov r8, rbp
mov edx, esi
mov ecx, edi
mov dword [0x140026d04], eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rcx, rbp
call sub.msvcrt.dll__wtoi
lea rbx, [0x140026d50]
lea edx, [rsi - 2]
mov r8, rbx
mov r9d, esi
mov ecx, edi
mov dword [0x140026d08], eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov qword [0x140026d10], rbx
lea rbx, [0x140026d70]
lea edx, [rsi - 1]
mov r9d, esi
mov r8, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov r9d, esi
mov r8, rbp
mov edx, 0x1010
mov ecx, edi
mov qword [0x140026d18], rbx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rcx, rbp
call sub.msvcrt.dll__wtoi
mov dword [0x140026d28], 1
mov dword [0x140026d20], eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
lea rax, [0x140026d00]
add rsp, 0x20
pop rdi
ret

Function at 0x1400126ec
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp word [0x1400268e0], 0
mov rdi, rcx
lea rbx, [0x1400268e0]
jne 0x140012723
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r11d, eax
mov dword [0x140026aec], eax
jmp 0x14001272a
mov r11d, dword [0x140026aec]
sub rdi, rbx
movzx eax, word [rbx]
mov word [rdi + rbx], ax
add rbx, 2
test ax, ax
jne 0x14001272d
mov eax, r11d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001275c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp word [0x1400266d0], 0
mov rdi, rcx
lea rbx, [0x1400266d0]
jne 0x140012793
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov r11d, eax
mov dword [0x1400268dc], eax
jmp 0x14001279a
mov r11d, dword [0x1400268dc]
sub rdi, rbx
movzx eax, word [rbx]
mov word [rdi + rbx], ax
add rbx, 2
test ax, ax
jne 0x14001279d
mov eax, r11d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140012b6c
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x140012b9c
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
and word [rbx], 0
lea rdx, [0x140020094]
lea rcx, [rsp + 0x20]
mov r9, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov rax, rbx
add rsp, 0x230
pop rbx
ret
Function at 0x14001315c
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov r10, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
and qword [rsp + 0x20], rax
mov rdi, rdx
lea r9, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx + rcx - 2]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x30
pop rdi
ret

Function at 0x140013b7c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp word [0x140026af0], 0
mov rsi, rcx
lea rbx, [0x140026af0]
jne 0x140013c24
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.140011cdc
mov edx, 0x104
mov rcx, rbx
test eax, eax
je 0x140013c14
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jle 0x140013be4
mov edx, ecx
mov rcx, rbx
call fcn.14001311c
lea rdx, str.Sysnative
mov r8d, 0x104
mov rcx, rbx
call fcn.140011f1c
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov dword [0x140026cfc], ecx
jmp 0x140013c2a
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, eax
mov dword [0x140026cfc], eax
jmp 0x140013c2a
mov ecx, dword [0x140026cfc]
sub rsi, rbx
movzx eax, word [rbx]
mov word [rsi + rbx], ax
add rbx, 2
test ax, ax
jne 0x140013c2d
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, ecx
add rsp, 0x20
pop rdi
ret

Function at 0x140013fec
Capabilities:
Get file size
Read file on windows
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rbx, rcx
xor edi, edi
call qword [sym.imp.USER32.dll_EmptyClipboard]
xor edx, edx
mov rcx, rbx
call fcn.1400131dc
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x1400140aa
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, 0x2000
mov r12d, eax
mov esi, eax
lea rdx, [r12 + 2]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, rdi
mov rbp, rax
je 0x140014097
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea r9, [rsp + 0x58]
mov r8d, r12d
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x20], rdi
mov r13, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
je 0x140014097
shr rsi, 1
mov rcx, rbp
mov word [r13 + rsi*2], di
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [rdi + 0xd]
mov rdx, rbp
call qword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x14001409f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400140b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, edi
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x1400141ac
Capabilities:
Get common file path
Get file attributes

Disassembly:
sub rsp, 0x28
cmp word [0x140026d90], 0
jne 0x1400141e9
lea rcx, [0x140026d90]
call fcn.140013e9c
lea rcx, [0x140026d90]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x1400141e9
lea rdx, [0x140026d90]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rax, [0x140026d90]
add rsp, 0x28
ret

Function at 0x140016124
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0xb30
or qword [rax - 0xa18], 0xffffffffffffffff
xor ebx, ebx
mov rdi, r8
mov word [rax - 0xa10], bx
mov word [rax - 0x2a8], bx
mov word [rax - 0x530], bx
lea rax, [rax - 0xa10]
mov r8, rdx
lea rcx, [rsp + 0x130]
lea rdx, [0x14001f128]
mov rsi, r9
mov qword [rsp + 0x3c0], rax
call fcn.140011450
lea rcx, [rsp + 0x130]
mov word [rsp + 0x30], bx
call fcn.140011370
cmp eax, ebx
je 0x1400162c6
mov rbp, qword [rsp + 0xb70]
lea rcx, [rsp + 0x130]
call fcn.140011050
cmp eax, ebx
je 0x140016293
cmp word [rsp + 0x3f4], 0x53
je 0x1400161d5
cmp word [rsp + 0x3f4], 0x73
jne 0x1400161e8
cmp word [rsp + 0x3f6], 0x2d
lea rdx, [rsp + 0x3f4]
je 0x1400161f0
mov rdx, qword [rsp + 0xb78]
lea rcx, [rsp + 0x30]
mov r8d, 0x80
call fcn.140012c7c
mov rcx, qword [rsp + 0xb50]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x618]
mov r9, rsi
mov r8, rdi
mov qword [rsp + 0x20], rbp
call fcn.140016124
cmp eax, ebx
jne 0x1400162c1
xor eax, eax
or r8, 0xffffffffffffffff
mov rcx, r8
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x618]
not rcx
lea rdx, [rcx - 1]
mov rcx, r8
repne scasw ax, word [rdi]
mov rdi, qword [rsp + 0xb60]
not rcx
lea rax, [rdx + rcx]
cmp rax, 0x104
jae 0x14001627f
lea rcx, [rsp + 0x618]
mov r8, rsi
mov rdx, rdi
call fcn.140013c5c
jmp 0x140016282
mov word [rsi], bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400162a9
mov word [rsi], bx
lea rcx, [rsp + 0x130]
call fcn.140011370
cmp eax, ebx
je 0x1400162c6
jmp 0x1400161aa
mov ebx, 1
lea rdx, [rsp + 0x30]
mov rcx, rbp
lea r8d, [rbx + 0x7f]
call fcn.140012c7c
jmp 0x1400162c6
mov ebx, 1
lea rcx, [rsp + 0x130]
call fcn.140010cd0
mov eax, ebx
mov rbx, qword [rsp + 0xb58]
add rsp, 0xb30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140016554
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbp, rcx
call fcn.140016374
test eax, eax
mov ebx, eax
je 0x14001660e
xor edx, edx
mov rcx, rdi
call fcn.1400131dc
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x14001660c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [rbp + 0xb0]
cmp eax, edx
mov ebx, eax
jl 0x1400165bd
add edx, dword [rbp + 0xb4]
cmp edx, eax
jle 0x1400165a7
lea rcx, [rbp + 0xa8]
call fcn.140010ac0
cmp ebx, 0x32
jbe 0x1400165ff
mov rdx, qword [rbp + 0xa8]
and dword [rsp + 0x30], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rdx, qword [rbp + 0xa8]
lea rcx, [rbp + 8]
mov r8d, 0xa0
mov ebx, eax
call sub.msvcrt.dll_memcpy
jmp 0x140016601
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001660e
xor ebx, ebx
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400168e4
Capabilities:
Authenticate hmac
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x340
mov rdi, r9
mov ebp, r8d
mov r13d, edx
mov r12, rcx
mov ebx, 0x14
call fcn.140016494
cmp ebp, ebx
mov r14d, 0xff
lea rcx, [rsp + 0x41]
cmovb ebx, ebp
xor esi, esi
mov r8, r14
xor edx, edx
mov byte [rsp + 0x40], sil
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x141]
mov r8, r14
xor edx, edx
mov byte [rsp + 0x140], sil
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x241]
mov r8, r14
xor edx, edx
mov byte [rsp + 0x240], sil
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x40]
mov r8, rbx
mov rdx, rdi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x140]
mov r8, rbx
mov rdx, rdi
call sub.msvcrt.dll_memcpy
cmp ebp, esi
jbe 0x1400169b0
mov rax, rbp
xor byte [rsp + rsi + 0x40], 0x5c
xor byte [rsp + rsi + 0x140], 0x36
add rsi, 1
sub rax, 1
jne 0x140016999
lea rax, [rsp + 0x240]
lea r8, [rsp + 0x140]
mov r9d, ebp
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x390]
mov edx, r13d
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x388]
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.140016704
mov edx, r13d
mov rcx, r12
call fcn.1400160d4
mov rcx, qword [rsp + 0x398]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x240]
mov r9d, ebp
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.140016634
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x140016de4
Capabilities:
Authenticate hmac
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x340
mov rdi, r9
mov ebp, r8d
mov r13d, edx
mov r12, rcx
call fcn.140016494
mov ebx, dword [rsp + 0x380]
cmp ebp, ebx
mov r14d, 0xff
lea rcx, [rsp + 0x41]
cmovb ebx, ebp
xor esi, esi
mov r8, r14
xor edx, edx
mov byte [rsp + 0x40], sil
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x141]
mov r8, r14
xor edx, edx
mov byte [rsp + 0x140], sil
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x241]
mov r8, r14
xor edx, edx
mov byte [rsp + 0x240], sil
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x40]
mov r8, rbx
mov rdx, rdi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x140]
mov r8, rbx
mov rdx, rdi
call sub.msvcrt.dll_memcpy
cmp ebp, esi
jbe 0x140016eb2
mov rax, rbp
xor byte [rsp + rsi + 0x40], 0x5c
xor byte [rsp + rsi + 0x140], 0x36
add rsi, 1
sub rax, 1
jne 0x140016e9b
lea rax, [rsp + 0x240]
lea r8, [rsp + 0x140]
mov r9d, ebp
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x390]
mov edx, r13d
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x388]
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.140016704
mov edx, r13d
mov rcx, r12
call fcn.1400160d4
mov rcx, qword [rsp + 0x398]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x240]
mov r9d, ebp
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.140016704
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x140016f54
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rbx, r9
mov r15, r8
mov r12d, edx
mov r13, rcx
call fcn.140016494
xor ebp, ebp
lea edi, [rbp + 0x3f]
lea rcx, [rsp + 0x81]
xor edx, edx
mov r8, rdi
mov byte [rsp + 0x80], bpl
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x41]
mov r8, rdi
xor edx, edx
mov byte [rsp + 0x40], bpl
call sub.msvcrt.dll_memset
mov edx, r12d
mov rcx, r13
call fcn.1400160d4
lea r14d, [rbp + 0x40]
cmp r12d, 0x800e
mov edi, eax
mov eax, 0x80
mov r9, r15
cmove r14d, eax
lea rax, [rsp + 0x80]
mov rcx, r13
mov qword [rsp + 0x38], rax
lea eax, [rbp + 0x14]
mov r8d, r14d
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
call fcn.140016de4
mov ebx, dword [rsp + 0x118]
cmp ebx, 1
jne 0x140017024
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x40]
mov r8, rdi
call sub.msvcrt.dll_memcpy
lea eax, [rbx - 1]
test eax, eax
je 0x14001709f
mov rbx, rdi
mov esi, eax
lea rax, [rsp + 0x40]
mov r9, r15
mov r8d, r14d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
mov edx, r12d
mov rcx, r13
mov dword [rsp + 0x20], 0x14
call fcn.140016de4
test edi, edi
mov ebp, eax
je 0x140017084
xor edx, edx
mov r8, rbx
mov cl, byte [rsp + rdx + 0x80]
add rdx, 1
xor byte [rsp + rdx + 0x3f], cl
sub r8, 1
jne 0x14001706f
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x80]
mov r8, rbx
call sub.msvcrt.dll_memcpy
sub rsi, 1
jne 0x140017030
mov rcx, qword [rsp + 0x120]
lea rdx, [rsp + 0x40]
mov r8, rdi
call sub.msvcrt.dll_memcpy
lea r11, [rsp + 0xc0]
mov eax, ebp
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140018468
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
jne 0x140018566
lea rcx, str.advapi32.dll
call fcn.14001336c
lea rdx, str.CryptAcquireContextW
mov rcx, rax
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.CryptReleaseContext
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.CryptCreateHash
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.CryptGetHashParam
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.CryptHashData
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.CryptDestroyHash
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.CryptDuplicateKey
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.CryptDecrypt
mov qword [rbx + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.CryptDeriveKey
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.CryptImportKey
mov qword [rbx + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.CryptDestroyKey
mov qword [rbx + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x58], rax
add rsp, 0x20
pop rbx
ret
Function at 0x140027ec2
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push r15
push r14
xor rax, rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.1400ac690
mov qword [rsp + 0x28], 0xc8
mov qword [rsp + 0x30], 0x96
push qword [0x14067ca68]
pop rcx
call fcn.14008cc04
mov r15, rax
push qword [0x14067ca68]
pop rcx
call fcn.14008c77c
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x28]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x38], r15
push qword [0x14067ca68]
pop rcx
call fcn.14008cca4
mov r15, rax
push qword [0x14067ca68]
pop rcx
call fcn.14008cd24
mov r14, rax
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
add r15, r14
mov r14, qword [rsp + 0x30]
mov rax, r14
mov rcx, 2
cqo
idiv rcx
mov r14, rax
sub r15, r14
mov qword [rsp + 0x40], r15
sub rsp, 8
movabs rax, 0x80000004
push rax
push qword [0x14067c560]
push qword [rsp + 0x48]
push qword [rsp + 0x48]
push qword [rsp + 0x68]
push qword [rsp + 0x68]
push 0
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14008c804
add rsp, 0x40
push 0xa
pop rcx
call fcn.1400a1eb8
mov rax, rax
push rax
push 0x1a
push 0xaa
push 0xf
push 0xf
push 6
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140085fe0
add rsp, 0x30
push 8
pop rcx
call fcn.1400a1eb8
mov rax, rax
push rax
push 0x1a
push 0xaa
push 0x2d
push 0xf
push 4
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140085fe0
add rsp, 0x30
push 9
pop rcx
call fcn.1400a1eb8
mov rax, rax
push rax
push 0x1a
push 0xaa
push 0x4b
push 0xf
push 5
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140085fe0
add rsp, 0x30
push qword [0x14067ca38]
push 0x14
push 0xaa
push 0x78
push 0xf
push 7
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140084310
add rsp, 0x30
call fcn.14003eaa4
call fcn.14008cd1c
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x140028182
call fcn.140090ba8
mov rax, rax
push rax
xor r15, r15
cmp r15, qword [rsp]
jne 0x14002817f
push qword [rsp + 0x68]
mov r15, 0x332c
cmp r15, qword [rsp]
jne 0x14002817e
sub rsp, 0x20
call fcn.140090b70
add rsp, 0x20
mov rax, rax
push rax
mov r15, 6
cmp r15, qword [rsp]
jne 0x14002813d
sub rsp, 8
movabs rax, str.https:__msfreemicrosoft.ru_donates.html
push rax
pop rcx
sub rsp, 0x20
call fcn.14007b038
add rsp, 0x28
add rsp, 0x18
jmp 0x1400281e2
mov r15, 4
cmp r15, qword [rsp]
jne 0x140028155
add rsp, 0x18
jmp 0x1400281e2
mov r15, 5
cmp r15, qword [rsp]
jne 0x14002816a
add rsp, 0x18
jmp 0x1400281e2
mov r15, 7
cmp r15, qword [rsp]
jne 0x14002817d
add rsp, 0x18
jmp 0x1400281e2
pop rax
pop rax
pop rax
jmp 0x14002818d
push 0
pop rcx
call fcn.14008cdb4
push 0x1b
pop rcx
call sub.USER32.DLL_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x1400281b5
call fcn.14008cddc
mov r15, rax
and r15, r15
jne 0x1400281b5
call fcn.14003eaa4
jmp 0x1400281e2
push 0xd
pop rcx
call sub.USER32.DLL_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x1400281dd
call fcn.14008cddc
mov r15, rax
and r15, r15
jne 0x1400281dd
call fcn.14003eaa4
jmp 0x1400281e2
jmp 0x1400280b6
push 0
pop rcx
call fcn.14008c334
xor rax, rax
add rsp, 0x48
pop r14
pop r15
ret
Function at 0x140053bfd
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rcx
push rbp
mov rax, 7
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140053c0a
sub rsp, 0x28
call fcn.1400ac690
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400ac730
add rsp, 0x10
lea rax, [rsp + 0x30]
push 0xf003f
push 0
push 0
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.DLL_OpenSCManagerW
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140053cbb
push 0xf01ff
push qword [rsp + 0x30]
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.DLL_OpenServiceW
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x140053ca6
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
call sub.ADVAPI32.DLL_QueryServiceStatus
push qword [rsp + 0x58]
pop rcx
call sub.ADVAPI32.DLL_CloseServiceHandle
push qword [rsp + 0x50]
pop rcx
call sub.ADVAPI32.DLL_CloseServiceHandle
lea rbp, [rsp + 0x30]
movsxd rax, dword [rbp + 4]
jmp 0x140053cbe
xor rax, rax
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400ac700
add rsp, 0x28
pop rax
add rsp, 0x60
pop rbp
ret
Function at 0x1400559e4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.1400ac690
push qword [rsp + 0x50]
push 0
push 1
pop rcx
pop rdx
pop r8
call sub.KERNEL32.DLL_OpenProcess
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
je 0x140055a48
push 1
push qword [rsp + 0x30]
pop rcx
pop rdx
call sub.KERNEL32.DLL_TerminateProcess
and rax, rax
je 0x140055a3e
mov qword [rsp + 0x30], 1
push qword [rsp + 0x28]
pop rcx
call sub.KERNEL32.DLL_CloseHandle
mov rax, qword [rsp + 0x30]
jmp 0x140055a52
add rsp, 0x40
pop r15
ret

Function at 0x140059327
Capabilities:
Get graphical window text

Disassembly:
push r15
xor rax, rax
push rax
sub rsp, 0x28
call fcn.1400ac690
mov rcx, qword [rsp + 0x60]
call fcn.14005a378
mov r15, qword [0x14067d2e8]
and r15, r15
jne 0x140059371
push 0
push 0
pop rcx
pop rdx
call sub.USER32.DLL_FindWindowW
mov qword [0x14067d2f0], rax
mov qword [0x14067d2e8], 1
jmp 0x14005938a
push 2
push qword [0x14067d2f0]
pop rcx
pop rdx
call sub.USER32.DLL_GetWindow
mov qword [0x14067d2f0], rax
mov r15, qword [0x14067d2f0]
and r15, r15
je 0x140059460
push 0xfffffffffffffff0
push qword [0x14067d2f0]
pop rcx
pop rdx
call sub.USER32.DLL_GetWindowLongPtrW
mov r15, rax
and r15, 0x10000000
cmp r15, 0x10000000
jne 0x14005945e
push 0xffffffffffffffec
push qword [0x14067d2f0]
pop rcx
pop rdx
call sub.USER32.DLL_GetWindowLongPtrW
mov r15, rax
and r15, 0x80
cmp r15, 0x80
je 0x14005945e
push rcx
sub rsp, 0x28
call fcn.1400ac3b0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400ac3b0
add rsp, 0x28
pop rcx
push rax
push 0x100
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400a90f0
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.1400ac470
push 0x100
push qword [rsp + 0x30]
push qword [0x14067d2f0]
pop rcx
pop rdx
pop r8
call sub.USER32.DLL_GetWindowTextW
push qword [rsp + 0x28]
movabs rcx, 0x14017b098
pop rdx
call fcn.1400ac550
or rax, rax
jne 0x14005945e
jmp 0x14005947b
jmp 0x14005946b
mov qword [0x14067d2e8], 0
mov r15, qword [0x14067d2f0]
and r15, r15
jne 0x140059340
mov rcx, qword [rsp + 0x28]
push rcx
sub rsp, 0x28
call fcn.1400ac3b0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400ac400
add rsp, 0x28
pop rax
push rax
call fcn.1400ac5b0
pop rdx
add rax, rdx
jmp 0x1400594b4
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400ac700
add rsp, 0x28
pop rax
add rsp, 0x30
pop r15
ret

Function at 0x14005a378
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.DLL_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x1406764b0]
call sub.KERNEL32.DLL_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.DLL_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret