joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001240
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x110
mov rax, qword [0x14005d8c0]
xor rax, rsp
mov qword [rsp + 0x108], rax
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.140037a20
mov dword [rsp + 0x80], 0x68
mov dword [rsp + 0xbc], 1
xor eax, eax
mov word [rsp + 0xc0], ax
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.140037a20
mov rcx, qword [rsp + 0x120]
call fcn.14000fdd0
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400013a7
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x51]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.1400014c0
mov rcx, rax
call fcn.1400100f0
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x54], eax
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x51]
call fcn.1400013f0
mov rcx, rax
call fcn.140010370
mov rdx, rax
lea rcx, [0x14005edc0]
call fcn.140008610
mov ecx, dword [rsp + 0x54]
mov edx, ecx
mov rcx, rax
call fcn.14000c9b0
mov rcx, qword [rsp + 0x60]
mov rdx, rcx
mov rcx, rax
call fcn.140008610
lea rdx, [0x14000a6e0]
mov rcx, rax
call fcn.14000cb70
xor al, al
jmp 0x1400013cf
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.140015110
add rsp, 0x110
pop rdi
ret

Function at 0x1400013f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x28
mov rax, qword [0x14005d8c0]
xor rax, rsp
mov qword [rsp + 0x18], rax
mov byte [rsp], 0x5b
mov byte [rsp + 1], 0x18
mov byte [rsp + 2], 0x29
mov byte [rsp + 3], 0x3e
mov byte [rsp + 4], 0x3a
mov byte [rsp + 5], 0x2f
mov byte [rsp + 6], 0x3e
mov byte [rsp + 7], 0xb
mov byte [rsp + 8], 0x29
mov byte [rsp + 9], 0x34
mov byte [rsp + 0xa], 0x38
mov byte [rsp + 0xb], 0x3e
mov byte [rsp + 0xc], 0x28
mov byte [rsp + 0xd], 0x28
mov byte [rsp + 0xe], 0x7b
mov byte [rsp + 0xf], 0x3d
mov byte [rsp + 0x10], 0x3a
mov byte [rsp + 0x11], 0x32
mov byte [rsp + 0x12], 0x37
mov byte [rsp + 0x13], 0x3e
mov byte [rsp + 0x14], 0x3f
mov byte [rsp + 0x15], 0x7b
mov byte [rsp + 0x16], 0x73
mov byte [rsp + 0x17], 0
lea rax, [rsp]
mov rdi, qword [rsp + 0x48]
mov rsi, rax
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.140015110
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140008050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14005d8c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov byte [rsp], 0xc
mov byte [rsp + 1], 0x7c
mov byte [rsp + 2], 0x63
mov byte [rsp + 3], 0x7b
mov byte [rsp + 4], 0x69
mov byte [rsp + 5], 0x7e
mov byte [rsp + 6], 0x7f
mov byte [rsp + 7], 0x64
mov byte [rsp + 8], 0x69
mov byte [rsp + 9], 0x60
mov byte [rsp + 0xa], 0x60
mov byte [rsp + 0xb], 0x22
mov byte [rsp + 0xc], 0x69
mov byte [rsp + 0xd], 0x74
mov byte [rsp + 0xe], 0x69
mov byte [rsp + 0xf], 0x2c
mov byte [rsp + 0x10], 0x21
mov byte [rsp + 0x11], 0x49
mov byte [rsp + 0x12], 0x62
mov byte [rsp + 0x13], 0x6f
mov byte [rsp + 0x14], 0x63
mov byte [rsp + 0x15], 0x68
mov byte [rsp + 0x16], 0x69
mov byte [rsp + 0x17], 0x68
mov byte [rsp + 0x18], 0x4f
mov byte [rsp + 0x19], 0x63
mov byte [rsp + 0x1a], 0x61
mov byte [rsp + 0x1b], 0x61
mov byte [rsp + 0x1c], 0x6d
mov byte [rsp + 0x1d], 0x62
mov byte [rsp + 0x1e], 0x68
mov byte [rsp + 0x1f], 0x2c
mov byte [rsp + 0x20], 0
lea rax, [rsp]
mov rdi, qword [rsp + 0x58]
mov rsi, rax
mov ecx, 0x21
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140015110
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x140008370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14005d8c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov byte [rsp], 0x68
mov byte [rsp + 1], 0x2e
mov byte [rsp + 2], 9
mov byte [rsp + 3], 1
mov byte [rsp + 4], 4
mov byte [rsp + 5], 0xd
mov byte [rsp + 6], 0xc
mov byte [rsp + 7], 0x48
mov byte [rsp + 8], 0x1c
mov byte [rsp + 9], 7
mov byte [rsp + 0xa], 0x48
mov byte [rsp + 0xb], 0x1a
mov byte [rsp + 0xc], 0x1d
mov byte [rsp + 0xd], 6
mov byte [rsp + 0xe], 0x48
mov byte [rsp + 0xf], 0x38
mov byte [rsp + 0x10], 7
mov byte [rsp + 0x11], 0x1f
mov byte [rsp + 0x12], 0xd
mov byte [rsp + 0x13], 0x1a
mov byte [rsp + 0x14], 0x3b
mov byte [rsp + 0x15], 0
mov byte [rsp + 0x16], 0xd
mov byte [rsp + 0x17], 4
mov byte [rsp + 0x18], 4
mov byte [rsp + 0x19], 0x48
mov byte [rsp + 0x1a], 0x1b
mov byte [rsp + 0x1b], 0xb
mov byte [rsp + 0x1c], 0x1a
mov byte [rsp + 0x1d], 1
mov byte [rsp + 0x1e], 0x18
mov byte [rsp + 0x1f], 0x1c
mov byte [rsp + 0x20], 0x46
mov byte [rsp + 0x21], 0
lea rax, [rsp]
mov rdi, qword [rsp + 0x58]
mov rsi, rax
mov ecx, 0x22
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140015110
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x140042290
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
sub rsp, 0x28
call fcn.14012b830
mov rcx, qword [rsp + 0x60]
call fcn.1400bd588
mov dword [section..data], 0x17000d2
mov dword [section..data], 0x17000d4
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
mov rdx, rax
movabs rcx, 0x50
sub rsp, 0x20
call fcn.140128710
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.14012b4f0
mov dword [section..data], 0x17000d5
push 0x50
mov rax, qword [rsp + 0x30]
push rax
mov r15, qword [rsp + 0x50]
add r15, 0x29
mov rax, r15
mov rdx, rax
movabs rcx, 0x400
pop r8
pop r9
call sub.KERNEL32.dll_GetLocaleInfoW
mov dword [section..data], 0x17000d6
mov rcx, qword [rsp + 0x28]
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
pop rax
push rax
call fcn.14012b6a0
pop rdx
add rax, rdx
jmp 0x14004238e
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.14012b910
add rsp, 0x28
pop rax
add rsp, 0x30
pop r15
ret
Function at 0x14004fc9f
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push r15
xor rax, rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.14012b830
mov dword [section..data], 0x140002a
mov dword [section..data], 0x140002b
call fcn.1400a3969
mov r15, rax
and r15, r15
jne 0x14004fd85
mov dword [section..data], 0x140002c
mov qword [rsp + 0x28], DispGetIDsOfNames
mov dword [section..data], 0x140002d
sub rsp, 8
movabs rax, 0xf0000000
push rax
push qword [rsp + 0x38]
push 0
push 0
lea rax, [rsp + 0x60]
mov rcx, rax
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.dll_CryptAcquireContextW
add rsp, 0x30
mov qword [rsp + 0x30], rax
mov dword [section..data], 0x140002f
mov r15, qword [rsp + 0x30]
and r15, r15
jne 0x14004fd5d
mov dword [section..data], 0x1400030
xor rax, rax
jmp 0x14004fdbe
mov dword [section..data], 0x1400031
mov dword [section..data], 0x1400032
mov rcx, qword [rsp + 0x38]
call fcn.1400871bb
mov dword [section..data], 0x1400034
mov dword [section..data], 0x1400035
mov dword [section..data], 0x1400036
call fcn.14004d5cf
mov dword [section..data], 0x1400037
mov rax, 1
jmp 0x14004fdbe
add rsp, 0x40
pop r15
ret

Function at 0x140052bda
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push r15
xor rax, rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.14012b830
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.14012b8a0
add rsp, 0x10
mov dword [section..data], 0x700004
mov dword [section..data], 0x700007
mov rcx, qword [rsp + 0x28]
call fcn.140127510
inc rax
mov rcx, rax
call fcn.140129ad0
mov qword [rsp + 0x30], rax
mov dword [section..data], 0x700008
movabs r9, DispGetIDsOfNames
movabs r8, 0xffffffffffffffff
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call fcn.140129da0
mov dword [section..data], 0x700009
mov rcx, qword [rsp + 0x30]
call sub.WS2_32.dll_gethostbyname
mov qword [rsp + 0x38], rax
mov dword [section..data], 0x70000a
mov rcx, qword [rsp + 0x30]
call fcn.140129bb0
mov dword [section..data], 0x70000b
mov r15, qword [rsp + 0x38]
and r15, r15
je 0x140052cd3
mov dword [section..data], 0x70000c
mov rbp, qword [rsp + 0x38]
mov rcx, qword [rbp + 0x18]
call fcn.140129f30
mov rcx, rax
call fcn.140129f30
jmp 0x140052d03
mov dword [section..data], 0x70000d
mov dword [section..data], 0x70000e
xor rax, rax
jmp 0x140052d03
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.14012b910
add rsp, 0x28
pop rax
add rsp, 0x48
pop r15
pop rbp
ret
Function at 0x140064912
Capabilities:
Get networking parameters

Disassembly:
push r15
xor rax, rax
push rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.14012b830
mov rcx, qword [rsp + 0x80]
call fcn.1400bd588
mov dword [section..data], 0xc9f
mov dword [section..data], 0xca2
movabs rdx, 0x140207502
lea rcx, [rsp + 0x40]
call fcn.14012b3b0
mov dword [section..data], 0xca4
lea rax, [rsp + 0x28]
mov rdx, rax
movabs rcx, 0
call sub.IPHLPAPI.DLL_GetNetworkParams
mov r15, rax
cmp r15, 0x6f
jne 0x140064a7b
mov dword [section..data], 0xca5
mov rcx, qword [rsp + 0x28]
call fcn.140129ad0
mov qword [rsp + 0x30], rax
mov dword [section..data], 0xca7
cmp qword [rsp + 0x30], 0
je 0x140064a71
mov dword [section..data], 0xca8
lea rax, [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call sub.IPHLPAPI.DLL_GetNetworkParams
mov qword [rsp + 0x38], rax
mov dword [section..data], 0xcaa
mov r15, qword [rsp + 0x38]
and r15, r15
jne 0x140064a53
mov dword [section..data], 0xcab
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
push 2
push 0xffffffffffffffff
mov r15, qword [rsp + 0x58]
add r15, 0x84
mov rax, r15
mov rcx, rax
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140129bd0
add rsp, 0x28
lea rcx, [rsp + 0x48]
pop rdx
call fcn.14012b4f0
mov dword [section..data], 0xcaf
mov dword [section..data], 0xcb1
mov rcx, qword [rsp + 0x30]
call fcn.140129bb0
mov dword [section..data], 0xcb2
mov dword [section..data], 0xcb3
mov dword [section..data], 0xcb4
mov rcx, qword [rsp + 0x40]
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
pop rax
push rax
call fcn.14012b6a0
pop rdx
add rax, rdx
jmp 0x140064ad2
push rax
mov rcx, qword [rsp + 0x48]
sub rsp, 0x28
call fcn.14012b910
add rsp, 0x28
pop rax
add rsp, 0x50
pop r15
ret

Function at 0x14006899c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.14012b830
mov dword [section..data], 0x100080
mov dword [section..data], 0x100081
mov qword [rsp + 0x28], 0
mov dword [section..data], 0x100082
mov r8, qword [rsp + 0x50]
movabs rdx, 0
movabs rcx, 1
call sub.KERNEL32.dll_OpenProcess
mov qword [rsp + 0x30], rax
mov dword [section..data], 0x100083
mov r15, qword [rsp + 0x30]
and r15, r15
je 0x140068a64
mov dword [section..data], 0x100084
movabs rdx, 1
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_TerminateProcess
and rax, rax
je 0x140068a46
mov dword [section..data], 0x100085
mov qword [rsp + 0x28], 1
mov dword [section..data], 0x100086
mov dword [section..data], 0x100087
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_CloseHandle
mov dword [section..data], 0x100088
mov dword [section..data], 0x100089
mov rax, qword [rsp + 0x28]
jmp 0x140068a8c
add rsp, 0x40
pop r15
ret
Function at 0x14006bb8f
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push r15
mov rax, 0x4c
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14006bb9e
sub rsp, 0x28
call fcn.14012b830
mov rdx, qword [rsp + 0x2a0]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.14012b8a0
add rsp, 0x10
mov dword [section..data], 0x10008d
mov dword [section..data], 0x100093
lea rbp, [rsp + 0x50]
mov dword [rbp], 0x238
mov dword [section..data], 0x100094
movabs rdx, 0
movabs rcx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x30], rax
mov dword [section..data], 0x100095
cmp qword [rsp + 0x30], 0
je 0x14006bd36
mov dword [section..data], 0x100096
lea rax, [rsp + 0x50]
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_Process32FirstW
mov qword [rsp + 0x38], rax
mov dword [section..data], 0x100098
cmp qword [rsp + 0x38], 0
je 0x14006bd22
mov dword [section..data], 0x100099
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
lea rbp, [rsp + 0x68]
lea rax, [rbp + 0x2c]
mov rcx, rax
pop rdx
sub rsp, 0x20
call fcn.14012a0b0
add rsp, 0x28
call fcn.14012b700
mov rcx, qword [rsp + 0x30]
pop rdx
push rcx
mov rcx, rdx
sub rsp, 0x20
call fcn.14012b790
add rsp, 0x20
pop rcx
mov rdx, rax
call fcn.14012b640
or rax, rax
je 0x14006bce8
mov dword [section..data], 0x10009a
inc qword [rsp + 0x48]
mov dword [section..data], 0x10009b
mov dword [section..data], 0x10009c
lea rax, [rsp + 0x50]
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_Process32NextW
mov qword [rsp + 0x38], rax
mov dword [section..data], 0x10009d
jmp 0x14006bc51
mov dword [section..data], 0x10009f
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_CloseHandle
mov dword [section..data], 0x1000a0
mov dword [section..data], 0x1000a2
mov rax, qword [rsp + 0x48]
jmp 0x14006bd5e
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.14012b910
add rsp, 0x28
pop rax
add rsp, 0x288
pop r15
pop rbp
ret
Function at 0x14006f575
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push rbp
xor rax, rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.14012b830
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.14012b8a0
add rsp, 0x10
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.14012b8a0
add rsp, 0x10
mov dword [section..data], 0x1e002c7
mov dword [section..data], 0x1e002c9
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x14021c2b4]
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
movabs rcx, str.Licences.json
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
push rax
call fcn.14012b6d0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call sub.SHLWAPI.dll_PathFileExistsW
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400bd588
add rsp, 0x28
pop rax
and rax, rax
je 0x14006f783
mov dword [section..data], 0x1e002cb
mov rcx, qword [0x14021cea4]
call fcn.14011da1c
mov rcx, qword [0x14021cea4]
call fcn.14011da30
or rax, rax
je 0x14006f774
mov dword [section..data], 0x1e002cb
mov dword [section..data], 0x1e002cc
mov rbp, qword [0x14021ceac]
add rbp, 0x10
mov rcx, qword [rbp + 0x20]
call fcn.14011da1c
mov rbp, qword [0x14021ceac]
add rbp, 0x10
mov rcx, qword [rbp + 0x20]
call fcn.14011da30
or rax, rax
je 0x14006f765
mov dword [section..data], 0x1e002cc
mov dword [section..data], 0x1e002cd
mov rbp, qword [0x14021ceac]
add rbp, 0x10
mov rbp, qword [rbp + 0x28]
push qword [rbp + 0x10]
mov rcx, qword [rsp + 0x30]
pop rdx
call fcn.14012b640
or rax, rax
je 0x14006f74c
mov dword [section..data], 0x1e002ce
mov rcx, qword [rsp + 0x30]
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
mov rbp, qword [0x14021ceac]
add rbp, 0x10
mov rbp, qword [rbp + 0x28]
lea rcx, [rbp + 0x10]
pop rdx
call fcn.14012b4f0
mov dword [section..data], 0x1e002cf
jmp 0x14006f765
mov dword [section..data], 0x1e002d0
mov dword [section..data], 0x1e002d1
jmp 0x14006f6a8
mov dword [section..data], 0x1e002d2
jmp 0x14006f66b
mov dword [section..data], 0x1e002d3
call fcn.140068a93
mov dword [section..data], 0x1e002d4
mov dword [section..data], 0x1e002d5
xor rax, rax
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.14012b910
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.14012b910
add rsp, 0x28
pop rax
add rsp, 0x40
pop rbp
ret
Function at 0x14007ee69
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rcx
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.14012b830
mov rcx, qword [rsp + 0x60]
call fcn.1400bd588
mov dword [section..data], 0x600018
mov dword [section..data], 0x600019
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
mov rdx, rax
movabs rcx, 0x104
sub rsp, 0x20
call fcn.140128710
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.14012b4f0
mov dword [section..data], 0x60001b
mov rax, qword [rsp + 0x28]
mov r9, rax
movabs r8, 0x104
movabs rdx, reloc.WS2_32.dll_listen
mov rcx, qword [rsp + 0x40]
call sub.USER32.dll_SendMessageW
mov dword [section..data], 0x60001d
mov rcx, qword [rsp + 0x28]
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
pop rax
push rax
call fcn.14012b6a0
pop rdx
add rax, rdx
jmp 0x14007ef5f
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.14012b910
add rsp, 0x28
pop rax
add rsp, 0x38
ret
Function at 0x140086c12
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
sub rsp, 0x28
call fcn.14012b830
mov dword [section..data], 0x5000e7
mov dword [section..data], 0x5000e9
mov rcx, qword [rsp + 0x40]
call sub.USER32.dll_GetAsyncKeyState
mov r15, rax
and r15, 0x8000
and r15, r15
je 0x140086c72
mov dword [section..data], 0x5000ea
mov rax, 1
jmp 0x140086ca2
mov dword [section..data], 0x5000eb
mov dword [section..data], 0x5000ec
xor rax, rax
jmp 0x140086ca2
add rsp, 0x30
pop r15
ret

Function at 0x14008861f
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
sub rsp, 0x28
call fcn.14012b830
mov dword [section..data], 0x26000a8
mov dword [section..data], 0x26000a9
mov dword [rsp + 0x28], 0
mov dword [section..data], 0x26000aa
lea rax, [rsp + 0x28]
push rax
push 0x4004667f
movsxd rax, dword [rsp + 0x50]
mov rcx, rax
pop rdx
pop r8
call sub.WS2_32.dll_ioctlsocket
mov dword [section..data], 0x26000ab
movsxd r15, dword [rsp + 0x28]
and r15, r15
jle 0x1400886a5
mov dword [section..data], 0x26000ad
movsxd rax, dword [rsp + 0x28]
jmp 0x1400886d5
mov dword [section..data], 0x26000ae
mov dword [section..data], 0x26000af
xor rax, rax
jmp 0x1400886d5
add rsp, 0x30
pop r15
ret
Function at 0x1400bd588
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x140215954]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x1400bf21c
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x1400bf2e2
lea rcx, [0x1402216e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14021cf98]
jmp 0x1400bf2a6
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400bf2a3
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x14021cf98]
mov rdx, rsi
call fcn.14012b264
jmp 0x1400bf2a6
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400bf273
mov rdx, qword [reloc.WS2_32.dll_accept]
lea rcx, [0x14021cf98]
mov rdi, rdx
inc rdx
mov qword [reloc.WS2_32.dll_accept], rdx
lea edx, [rbx + 0x20]
call fcn.14012b2ac
lea rcx, [0x1402216e0]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x1400bf408
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.1400bf0fc
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x1402216e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14021cf98]
jmp 0x1400bf444
cmp qword [rbx + 0x18], rdi
je 0x1400bf44b
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400bf43b
jmp 0x1400bf465
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x14021cf98]
call fcn.14012b264
lea rcx, [0x1402216e0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400c5a10
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x1400c5a87
movsxd rdx, ecx
lea rcx, [0x1400c596c]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [0x14021d248]
test rbx, rbx
je 0x1400c5afa
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x1400c5a7d
cmp byte [rbx + 0x20], 0
je 0x1400c5a7d
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x1400c5a43
jmp 0x1400c5afa
mov rbx, qword [0x14021d248]
test rbx, rbx
je 0x1400c5afa
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x1400c5af2
cmp byte [rbx + 0x21], 0
je 0x1400c5ab6
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x1400c5ae2
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x14021d248]
call fcn.14012b264
mov rbx, rdi
test rdi, rdi
jne 0x1400c5a93
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret