joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402055a0
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x20], 0
call fcn.140205870
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x50]
mov rdx, rbx
mov qword [rsp + 0x28], rax
call fcn.1402053f0
cmp dword [rsp + 0x20], 0
je 0x1402055fa
mov rax, qword [rsp + 0x20]
mov qword [rdi], rax
mov rax, qword [rsp + 0x28]
mov qword [rdi + 8], rax
mov rax, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x50]
cmp eax, 1
je 0x140205656
cmp eax, 3
jne 0x140205641
cmp qword [rbx + 0x18], 8
jb 0x140205612
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140205656
call fcn.140205870
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rdi + 8], rbx
mov dword [rdi], eax
mov rax, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
cmp qword [rbx + 0x18], 8
jb 0x14020564b
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14020561b
mov rax, qword [0x1402fe688]
mov rbx, qword [rsp + 0x40]
mov qword [rdi], rax
mov rax, qword [0x1402fe690]
mov qword [rdi + 8], rax
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x1402056a0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x30], 0
call fcn.140205870
mov dword [rsp + 0x20], 0
mov rsi, rax
call fcn.140205870
cmp qword [rdi + 0x18], 8
mov qword [rsp + 0x28], rax
jb 0x1402056e3
mov rcx, qword [rdi]
jmp 0x1402056e6
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1402056f8
mov byte [rbx + 0x10], 1
jmp 0x14020575a
call fcn.140205870
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
cmp eax, 0xb7
jne 0x140205756
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x58]
mov rdx, rdi
call fcn.1402053f0
cmp dword [rsp + 0x58], 3
jne 0x140205756
mov rax, qword [0x1402fe688]
mov byte [rbx + 0x10], 0
mov qword [rbx], rax
mov rax, qword [0x1402fe690]
mov qword [rbx + 8], rax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov byte [rbx + 0x10], 0
mov rax, qword [rsp + 0x30]
mov qword [rbx], rax
mov qword [rbx + 8], rsi
mov rsi, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140001300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x78
mov dword [rsp + 0x20], 1
mov byte [rsp + 0x60], 0x53
mov byte [rsp + 0x61], 0x68
mov byte [rsp + 0x62], 0x65
mov byte [rsp + 0x63], 0x6c
mov byte [rsp + 0x64], 0x6c
mov byte [rsp + 0x65], 0x45
mov byte [rsp + 0x66], 0x78
mov byte [rsp + 0x67], 0x65
mov byte [rsp + 0x68], 0x63
mov byte [rsp + 0x69], 0x75
mov byte [rsp + 0x6a], 0x74
mov byte [rsp + 0x6b], 0x65
mov byte [rsp + 0x6c], 0x41
mov byte [rsp + 0x6d], 0
mov byte [rsp + 0x40], 0x43
mov byte [rsp + 0x41], 0x72
mov byte [rsp + 0x42], 0x65
mov byte [rsp + 0x43], 0x61
mov byte [rsp + 0x44], 0x74
mov byte [rsp + 0x45], 0x65
mov byte [rsp + 0x46], 0x46
mov byte [rsp + 0x47], 0x69
mov byte [rsp + 0x48], 0x6c
mov byte [rsp + 0x49], 0x65
mov byte [rsp + 0x4a], 0x41
mov byte [rsp + 0x4b], 0
mov byte [rsp + 0x30], 0x57
mov byte [rsp + 0x31], 0x72
mov byte [rsp + 0x32], 0x69
mov byte [rsp + 0x33], 0x74
mov byte [rsp + 0x34], 0x65
mov byte [rsp + 0x35], 0x46
mov byte [rsp + 0x36], 0x69
mov byte [rsp + 0x37], 0x6c
mov byte [rsp + 0x38], 0x65
mov byte [rsp + 0x39], 0
mov byte [rsp + 0x50], 0x43
mov byte [rsp + 0x51], 0x6c
mov byte [rsp + 0x52], 0x6f
mov byte [rsp + 0x53], 0x73
mov byte [rsp + 0x54], 0x65
mov byte [rsp + 0x55], 0x48
mov byte [rsp + 0x56], 0x61
mov byte [rsp + 0x57], 0x6e
mov byte [rsp + 0x58], 0x64
mov byte [rsp + 0x59], 0x6c
mov byte [rsp + 0x5a], 0x65
mov byte [rsp + 0x5b], 0
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001aa70], rax
lea rcx, [0x140010330]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001aa78], rax
lea rcx, [0x140010340]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001aa80], rax
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001aa88], rax
mov qword [rsp + 0x28], 0
jmp 0x14000149c
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 5
jae 0x1400014c3
lea rax, [0x14001aa70]
mov rcx, qword [rsp + 0x28]
cmp qword [rax + rcx*8], 0
jne 0x1400014c1
mov dword [rsp + 0x20], 0
jmp 0x1400014c3
jmp 0x14000148f
mov eax, dword [rsp + 0x20]
add rsp, 0x78
ret

Function at 0x140005bfc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400059ec
Function at 0x140008d74
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140008da4
xor eax, eax
jmp 0x140008e67
mov rbp, rbx
cmp word [rax], si
je 0x140008dc9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140008db0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140008dac
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140008cc4
movsxd r14, eax
test eax, eax
jne 0x140008e07
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140008d9d
mov rcx, r14
call fcn.140009c28
mov rdi, rax
test rax, rax
jne 0x140008e20
xor ecx, ecx
call fcn.1400073f0
jmp 0x140008dfc
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140008cc4
test eax, eax
jne 0x140008e51
mov rcx, rdi
call fcn.1400073f0
jmp 0x140008e5b
xor ecx, ecx
call fcn.1400073f0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000c32c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140006384
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14000c3b6
cmp byte [rbp - 0x21], r15b
je 0x14000c3b1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14000c3ec
call fcn.14000a448
test eax, eax
jne 0x14000c3d8
cmp byte [rbp - 0x21], r15b
je 0x14000c3d0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14000c3ec
cmp byte [rbp - 0x21], r15b
je 0x14000c3e9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140007440
test eax, eax
jne 0x14000c48c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140006384
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14000c42b
cmp byte [rbp - 0x21], r15b
je 0x14000c460
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14000c460
call fcn.14000a448
test eax, eax
jne 0x14000c44c
cmp byte [rbp - 0x21], r15b
je 0x14000c445
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14000c460
cmp byte [rbp - 0x21], r15b
je 0x14000c45d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140007440
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14000c48c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14000c48f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14000c49d
mov rcx, rdi
call fcn.1400073f0
cmp byte [rbp + 0x3f], r15b
je 0x14000c4ac
mov rcx, qword [rbp + 0x27]
call fcn.1400073f0
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1402547b4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140254908

Function at 0x140254c40
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140259f50
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140259f50
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140254d90
cmp rax, 0xffffffffffffffff
je 0x140254d90
xor edi, edi
test rbp, rbp
jle 0x140254d3b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1401f06e0
mov rbx, rax
test rax, rax
jne 0x140254cc8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140254d31
mov edx, 0x8000
mov ecx, r14d
call fcn.14025b068
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14025f4c4
cmp eax, 0xffffffff
je 0x140254d11
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140254cd8
mov edx, r15d
mov ecx, r14d
call fcn.14025b068
jmp 0x140254d31
cmp byte [rsi + 0x38], dil
je 0x140254d28
cmp dword [rsi + 0x34], 5
jne 0x140254d28
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], ntohl
cmp byte [rsi + 0x30], dil
je 0x140254d31
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1401f0640
jmp 0x140254da4
jns 0x140254da4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140259f50
cmp rax, 0xffffffffffffffff
jne 0x140254d5c
cmp byte [rsi + 0x30], dil
je 0x140254da4
mov edi, dword [rsi + 0x2c]
jmp 0x140254da4
mov ecx, r14d
call fcn.1402589dc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140254da4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, ntohl
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], ntohl
jmp 0x140254da4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140254d9d
mov eax, dword [rsi + 0x2c]
jmp 0x140254da2
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140259f50
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140001500
Capabilities:
Connect pipe

Disassembly:
mov rdx, qword [rcx + 0x20]
mov rcx, qword [rcx + 0x18]
jmp qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]

Function at 0x140001560
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rbp, r8
mov edi, edx
mov rsi, rcx
mov ebx, 0x200
xor edx, edx
add rcx, 0x2c
mov r8d, ebx
call fcn.1400e5f00
cmp dword [rsi + 8], 1
jne 0x1400015c0
test rbp, rbp
je 0x1400015c0
cmp edi, ebx
ja 0x1400015a6
mov ebx, edi
mov r9, qword [rsi + 0x20]
mov rcx, qword [rsi + 0x18]
lea rdx, [rsi + 0x2c]
mov r8d, ebx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop r14
ret

Function at 0x1400015f0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
test rdx, rdx
jne 0x140001600
xor eax, eax
add rsp, 0x38
ret
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x30], rbx
xor ebx, ebx
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x48]
test eax, eax
cmove ecx, ebx
mov rbx, qword [rsp + 0x30]
mov eax, ecx
add rsp, 0x38
ret
Function at 0x140001670
Capabilities:
Create pipe

Disassembly:
push rbp
push rsi
sub rsp, 0x68
mov ebp, edx
mov rsi, rcx
test rcx, rcx
jne 0x14000168a
xor eax, eax
add rsp, 0x68
pop rsi
pop rbp
ret
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x60], r15
lea r15d, [rdi + 3]
mov ebx, edi
cmp edx, 1
jne 0x14000172d
xor r9d, r9d
xor ecx, ecx
mov r8d, edx
mov r15d, 0x40000003
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x1400016ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Failed_to_create_event:__d_n
mov edx, eax
call fcn.1400e5e38
xor eax, eax
jmp 0x1400017e2
mov ecx, 0x28
call fcn.1400e5d3c
mov rbx, rax
test rax, rax
je 0x140001715
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
jmp 0x140001718
mov rbx, rdi
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x18], r14
xor r9d, r9d
lea r8, [rsp + 0x48]
lea rcx, str.D:_A_OICI_GA___BG__D_OICI_GA___AN__A_OICI_GRGWGX___AU__A_OICI_GA___BA_S:_ML__NW___ME_
lea edx, [r9 + 1]
mov dword [rsp + 0x40], 0x18
mov dword [rsp + 0x50], edi
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
xor ecx, ecx
call fcn.1400dd570
lea rcx, [rsp + 0x40]
mov r9d, 0xff
cmp eax, 8
mov edx, r15d
cmovle rcx, rdi
xor r8d, r8d
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0x1388
mov rcx, rsi
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0x200
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x1400017b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateNamedPipe_failed_with__d._n
mov edx, eax
call fcn.1400e5e38
xor eax, eax
jmp 0x1400017e2
mov ecx, 0x448
call fcn.1400e5d3c
test rax, rax
je 0x1400017df
mov r9d, ebp
mov r8, rsi
mov rdx, r14
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.1400019d0
mov rdi, rax
mov rax, rdi
mov r14, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r15, qword [rsp + 0x60]
add rsp, 0x68
pop rsi
pop rbp
ret

Function at 0x140001c50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x24], 0
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
jne 0x140001ccd
cmp dword [rcx + 0x20], 0
je 0x140001c79
call fcn.140001e90
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140001c8c
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rcx, qword [rbx + 8]
mov edx, 1
call fcn.140001810
mov qword [rbx + 0x10], rax
test rax, rax
je 0x140001cb5
mov rcx, rbx
mov qword [rax + 0x438], rbx
call fcn.140001e20
mov dword [rbx + 0x24], eax
cmp dword [rbx + 0x24], 0
jne 0x140001ccd
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x10]
mov r8d, edi
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400015f0
Function at 0x140001e20
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rdi, rcx
je 0x140001e78
cmp dword [rcx + 0x20], 0
jne 0x140001e78
mov r9, rcx
mov qword [rsp + 0x40], rbx
xor ebx, ebx
lea r8, [0x140001f40]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, 0xffffffffffffffff
mov qword [rdi + 0x18], rax
mov eax, 1
setne bl
mov dword [rdi + 0x20], ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x140002910
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
mov r11, qword [rcx + 0x28]
mov edi, r9d
mov rsi, r8
cmp rax, r11
je 0x140002944
mov r10, qword [rax]
cmp rdx, qword [r10 + 0x18]
je 0x140002956
add rax, 8
cmp rax, r11
jne 0x140002932
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, r10
test r10, r10
je 0x140002944
mov rdx, rbx
call fcn.140003c50
test eax, eax
je 0x140002944
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400015f0

Function at 0x140002990
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov edi, edx
mov rbp, rcx
mov eax, 0x3d
cmp edx, eax
cmovg edi, eax
lea ecx, [rax + 0x6b]
call fcn.1400e5d3c
mov qword [rsp + 0x70], rax
xor esi, esi
test rax, rax
je 0x1400029d6
mov rcx, rax
call fcn.140002100
mov rbx, rax
jmp 0x1400029d9
mov rbx, rsi
mov rcx, rbx
call fcn.1400022c0
test eax, eax
je 0x140002a4e
test edi, edi
jle 0x140002a0d
nop dword [rax]
mov edx, 1
mov rcx, rbp
call fcn.140001670
mov rdx, rax
mov rcx, rbx
call fcn.1400023e0
dec rdi
jne 0x1400029f0
cmp dword [rbx + 8], 0
je 0x140002a4e
cmp dword [rbx + 0xc], 0
jne 0x140002a4e
mov dword [rsp + 0x68], esi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x140003110]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x78], rax
cmp rax, 0xffffffffffffffff
setne sil
mov dword [rbx + 0xc], esi
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x140005cf0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
lea rdi, [0x140179838]
mov ecx, dword [rdi]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140005d28
inc ebx
add rdi, 4
cmp ebx, 7
jb 0x140005d03
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140006c70
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.SynECR.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx], rax
test rax, rax
jne 0x140006c9c
xor edi, edi
mov dword [rbx + 8], edi
jmp 0x140006d6f
lea rdx, str.SynCR_Init
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.SynCR_SetParam
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.SynCR_GetParam
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.SynCR_Recog
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.SynCR_CleanUp
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x30], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140006d0e
call rax
mov dword [rbx + 8], eax
cmp qword [rbx + 0x10], 0
je 0x140006d47
cmp qword [rbx + 0x18], 0
je 0x140006d47
cmp qword [rbx + 0x20], 0
je 0x140006d47
cmp qword [rbx + 0x28], 0
je 0x140006d47
cmp qword [rbx + 0x30], 0
je 0x140006d47
cmp dword [rbx + 8], 0
je 0x140006d47
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rbx + 8]
xor edi, edi
test ecx, ecx
je 0x140006d5e
mov rax, qword [rbx + 0x30]
test rax, rax
je 0x140006d5b
call rax
mov dword [rbx + 8], edi
mov rcx, qword [rbx]
test rcx, rcx
je 0x140006d6f
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx], rdi
mov qword [rbx + 0x30], rdi
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x140008ff0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x10020
call fcn.1400e75f0
sub rsp, rax
mov rsi, rdx
mov rdi, r8
lea rdx, [rsp + 0x20]
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
cmp eax, 0x7fff
jbe 0x14000902c
xor eax, eax
jmp 0x140009045
test eax, eax
je 0x140009028
lea r8, [rsp + 0x20]
mov r9, rdi
mov rdx, rdi
mov rcx, rsi
call fcn.1400e7210
mov eax, ebx
lea r11, [rsp + 0x10020]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000c110
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x14000c143
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14000c189
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14000c184
nop
cmp rbx, rcx
jae 0x14000c189
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
dec edi
jne 0x14000c170
cmp rbx, rcx
jb 0x14000c18d
xor eax, eax
jmp 0x14000c199
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001ea50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx + 0x788]
test rcx, rcx
jne fcn.14006e1c0
ret
Function at 0x1400244d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp dword [0x1402711d8], 0
mov edi, r8d
mov esi, edx
mov rbx, rcx
je 0x14002450d
mov ecx, 0x30
call qword [sym.imp.USER32.dll_MessageBeep]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x18
call fcn.1400e5d3c
mov r9, rax
test rax, rax
je 0x14002452e
xor eax, eax
mov qword [r9], rax
mov qword [r9 + 8], rax
mov qword [r9 + 0x10], rax
jmp 0x140024531
xor r9d, r9d
mov rax, qword [0x1402711d0]
xor ecx, ecx
mov qword [r9], rcx
mov qword [r9 + 8], rax
mov dword [r9], esi
mov dword [r9 + 4], edi
mov qword [r9 + 0x10], rbx
cmp qword [rbx + 0x90], rcx
jne 0x140024581
cmp dword [0x1402711d8], ecx
jne 0x140024581
lea rax, [rsp + 0x58]
lea r8, [0x1400245a0]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x90], rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x140029f40
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
lea rax, vtable.CManagedPointingDeviceList.0
mov qword [rcx], rax
mov rcx, qword [rcx + 0x68]
test rcx, rcx
je 0x140029f71
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rdx, qword [rbx + 0x50]
test rdx, rdx
je 0x140029f82
mov rcx, rbx
call fcn.14002c040
mov rdx, qword [rbx + 0x58]
test rdx, rdx
je 0x140029f93
mov rcx, rbx
call fcn.14002c040
mov rdx, qword [rbx + 0x60]
test rdx, rdx
je 0x140029fa4
mov rcx, rbx
call fcn.14002c040
mov rcx, rbx
call fcn.14002aff0
nop
lea rax, vtable.CSynList_class_CManagedPointingDevice_.0
mov qword [rbx], rax
mov rcx, rbx
call fcn.14002fb10
lea rcx, [rbx + 0x20]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]