joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140041630
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x140462840]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword [rcx]
movsxd r10, edx
mov r13, r9
mov rdx, qword [rax + 0x20]
shl r10, 5
mov r12, r8
mov rbx, qword [r10 + rdx]
mov r15, rcx
mov r14d, 1
lea r8, str.sqlite_stat_d
lea rdx, [rsp + 0x30]
mov r9d, r14d
mov ecx, 0x18
call fcn.14000e530
mov rdi, qword [r15]
xor r10d, r10d
mov ebp, dword [rdi + 0x28]
xor r11d, r11d
test ebp, ebp
jle 0x14004183c
movzx esi, byte [rsp + 0x30]
mov r9d, r11d
cmp r11d, 2
jge 0x1400416b0
xor r9d, 1
test rbx, rbx
je 0x140041721
mov rax, qword [rdi + 0x20]
movsxd rcx, r9d
mov rdx, rbx
shl rcx, 5
mov r8, qword [rcx + rax]
movzx eax, byte [rbx]
test al, al
je 0x140041701
lea rbp, [0x1402d61f0]
nop word [rax + rax]
movzx ecx, al
movzx eax, byte [r8]
movzx eax, byte [rax + rbp]
cmp byte [rcx + rbp], al
jne 0x1400416fe
movzx eax, byte [rdx + 1]
inc rdx
inc r8
test al, al
jne 0x1400416e0
mov ebp, dword [rdi + 0x28]
movzx eax, byte [r8]
lea r8, [0x1402d61f0]
movzx ecx, byte [rax + r8]
movzx eax, byte [rdx]
movzx eax, byte [rax + r8]
cmp eax, ecx
jne 0x14004180a
mov rax, qword [rdi + 0x20]
movsxd rcx, r9d
shl rcx, 5
mov r10, qword [rcx + rax + 0x18]
mov r9, qword [r10 + 0x18]
test r9, r9
je 0x14004178a
xor eax, eax
lea r8, [rsp + 0x30]
movzx ecx, sil
test sil, sil
je 0x140041772
lea rbp, [0x1402d61f0]
movzx ecx, cl
lea r8, [r8 + 1]
movzx edx, byte [rcx + rbp]
lea ecx, [rax*8]
xor edx, ecx
movzx ecx, byte [r8]
xor eax, edx
test cl, cl
jne 0x140041751
mov ebp, dword [rdi + 0x28]
xor edx, edx
div dword [r10 + 8]
mov ecx, edx
shl rcx, 4
add rcx, r9
mov r9, qword [rcx + 8]
mov r10d, dword [rcx]
jmp 0x140041792
mov r9, qword [r10 + 0x10]
mov r10d, dword [r10 + 0xc]
test r10d, r10d
je 0x140041807
nop word [rax + rax]
mov rax, qword [r9 + 0x18]
dec r10d
lea r8, [rsp + 0x30]
movzx ecx, byte [rax]
test cl, cl
je 0x1400417e3
lea rsi, [0x1402d61f0]
nop word [rax + rax]
movzx edx, cl
movzx ecx, byte [r8]
movzx ecx, byte [rcx + rsi]
cmp byte [rdx + rsi], cl
jne 0x1400417de
movzx ecx, byte [rax + 1]
inc rax
inc r8
test cl, cl
jne 0x1400417c0
movzx esi, byte [rsp + 0x30]
movzx ecx, byte [r8]
lea r8, [0x1402d61f0]
movzx edx, byte [rcx + r8]
movzx ecx, byte [rax]
movzx eax, byte [rcx + r8]
cmp eax, edx
je 0x140041867
mov r9, qword [r9]
test r10d, r10d
jne 0x1400417a0
xor r10d, r10d
inc r11d
cmp r11d, ebp
jl 0x1400416a3
test r10, r10
je 0x14004183c
lea r9, [rsp + 0x30]
lea rdx, str.DELETE_FROM__Q._s_WHERE__s_Q
mov r8, rbx
mov rcx, r15
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
call fcn.140055520
inc r14d
cmp r14d, 4
jle 0x140041671
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140289bf0
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r10, qword [r9 + 0x10]
test r10, r10
jne 0x14004181b
jmp 0x14004180a
Function at 0x140048230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, qword [rcx + 0x10]
mov ebx, r9d
mov esi, r8d
mov r11, rdx
mov rdi, rcx
xor r10d, r10d
lea rax, [rcx + 0x88]
nop
cmp dword [rax + 0xc], 0
jle 0x140048273
cmp dword [rax], ebx
jne 0x140048273
movsx edx, word [rax + 4]
cmp edx, r8d
je 0x1400482c1
inc r10d
add rax, 0x14
cmp r10d, 0xa
jl 0x140048260
mov r9d, r8d
mov qword [rsp + 0x40], rbp
mov ebp, dword [rsp + 0x60]
mov r8d, ebx
mov rdx, r11
mov rcx, r14
mov dword [rsp + 0x20], ebp
call fcn.140048310
movzx r8d, byte [rsp + 0x68]
test r8b, r8b
je 0x1400482da
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x1400482ea
movsxd rax, dword [r14 + 0x3c]
lea rcx, [rax + rax*2]
mov byte [rdx + rcx*8 - 0x15], r8b
jmp 0x1400482ea
mov ecx, dword [rcx + 0x74]
mov dword [rax + 0x10], ecx
inc dword [rdi + 0x74]
mov edx, dword [rax + 0xc]
mov rcx, rdi
call fcn.140047a70
mov eax, dword [rax + 0xc]
jmp 0x1400482f1
mov r9d, ebp
mov r8d, esi
mov edx, ebx
mov rcx, rdi
call fcn.140047b70
mov eax, ebp
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14004a1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x14004a369
test rdx, rdx
je 0x14004a369
mov r9d, dword [rdx + 4]
mov r11d, dword [rcx + 4]
mov qword [rsp + 0x30], rsi
mov esi, r9d
or esi, r11d
bt esi, 0xa
jae 0x14004a254
and r9d, r11d
bt r9d, 0xa
jae 0x14004a35f
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x14004a35f
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx r8d, byte [rcx]
cmp r8b, byte [rdx]
je 0x14004a29c
cmp r8b, 0x5f
jne 0x14004a274
mov rcx, qword [rcx + 0x10]
mov r8d, ebp
call fcn.14004a1e0
cmp eax, 2
jl 0x14004a295
cmp byte [rbx], 0x5f
jne 0x14004a35f
mov rdx, qword [rbx + 0x10]
mov r8d, ebp
mov rcx, rdi
call fcn.14004a1e0
cmp eax, 2
jge 0x14004a35f
mov eax, 1
jmp 0x14004a23f
lea eax, [r8 + 0x66]
test al, 0xfd
je 0x14004a2dc
mov rax, qword [rcx + 8]
test rax, rax
je 0x14004a2dc
mov r10, qword [rdx + 8]
sub r10, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r10]
sub edx, ecx
jne 0x14004a2c7
inc rax
test ecx, ecx
jne 0x14004a2b4
test edx, edx
je 0x14004a2dc
xor ecx, ecx
cmp r8b, 0x5f
setne cl
lea eax, [rcx + 1]
jmp 0x14004a23f
xor r9d, r11d
test r9b, 0x10
jne 0x14004a35f
bt esi, 0xe
jb 0x14004a23d
bt esi, 0xb
jb 0x14004a35f
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
mov r8d, ebp
call fcn.14004a1e0
test eax, eax
jne 0x14004a35f
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
mov r8d, ebp
call fcn.14004a1e0
test eax, eax
jne 0x14004a35f
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
mov r8d, ebp
call fcn.14004b090
test eax, eax
jne 0x14004a35f
bt esi, 0xd
jb 0x14004a23d
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x14004a35f
mov ecx, dword [rdi + 0x2c]
mov eax, dword [rbx + 0x2c]
cmp ecx, eax
je 0x14004a23d
cmp ecx, ebp
jne 0x14004a35f
test eax, eax
js 0x14004a23d
mov eax, 2
jmp 0x14004a23f
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
xor ecx, ecx
cmp rdx, rdi
mov eax, 2
cmove eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x14004c0f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
xor r9d, r9d
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x14004c1c9
mov qword [rsp + 0x48], r14
lea r14, [0x1402d61f0]
nop
mov eax, ebx
cmp ebx, 2
jge 0x14004c12a
xor eax, 1
movsxd r8, eax
shl r8, 5
add r8, qword [rsi + 0x20]
mov r10, qword [r8 + 0x18]
test rdi, rdi
je 0x14004c185
movzx edx, byte [rdi]
mov r8, qword [r8]
mov rax, rdi
test dl, dl
je 0x14004c170
nop dword [rax + rax]
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + r14]
cmp byte [rdx + r14], cl
jne 0x14004c170
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x14004c150
movzx ecx, byte [r8]
movzx edx, byte [rcx + r14]
movzx ecx, byte [rax]
movzx eax, byte [rcx + r14]
cmp eax, edx
jne 0x14004c1a9
lea rcx, [r10 + 0x20]
lea r8, [rsp + 0x40]
mov rdx, rbp
call fcn.1400244a0
test rax, rax
je 0x14004c1a6
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x14004c1b4
jmp 0x14004c1a9
xor r9d, r9d
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x14004c120
mov rax, r9
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov rax, r9
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x14004c1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
xor r10d, r10d
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x14004c2c9
mov qword [rsp + 0x48], r14
lea r14, [0x1402d61f0]
nop
mov r9d, ebx
cmp ebx, 2
jge 0x14004c21c
xor r9d, 1
test rsi, rsi
je 0x14004c275
mov rcx, qword [rdi + 0x20]
movsxd rdx, r9d
mov rax, rsi
shl rdx, 5
mov r8, qword [rdx + rcx]
movzx edx, byte [rsi]
test dl, dl
je 0x14004c260
nop word [rax + rax]
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + r14]
cmp byte [rdx + r14], cl
jne 0x14004c260
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x14004c240
movzx ecx, byte [r8]
movzx edx, byte [rcx + r14]
movzx ecx, byte [rax]
movzx eax, byte [rcx + r14]
cmp eax, edx
jne 0x14004c2a9
mov rax, qword [rdi + 0x20]
movsxd rcx, r9d
lea r8, [rsp + 0x40]
shl rcx, 5
mov rdx, rbp
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.1400244a0
test rax, rax
je 0x14004c2a6
mov r10, qword [rax + 0x10]
test r10, r10
jne 0x14004c2b4
jmp 0x14004c2a9
xor r10d, r10d
inc ebx
cmp ebx, dword [rdi + 0x28]
jl 0x14004c210
mov rax, r10
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov rax, r10
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400551e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r12
push r15
sub rsp, 0x30
mov r12d, r8d
movsxd r15, edx
mov rbx, rcx
call fcn.140050be0
mov rsi, rax
test rax, rax
je 0x1400553aa
movzx eax, byte [rbx + 0x1f]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r14
test al, al
jne 0x140055228
inc dword [rbx + 0x54]
mov r14d, dword [rbx + 0x54]
jmp 0x140055235
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r14d, dword [rbx + rax*4 + 0x24]
movzx eax, byte [rbx + 0x1f]
test al, al
jne 0x140055245
inc dword [rbx + 0x54]
mov ebp, dword [rbx + 0x54]
jmp 0x140055251
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov ebp, dword [rbx + rax*4 + 0x24]
mov r9d, r14d
mov r8d, r15d
mov edx, 0x33
mov rcx, rsi
mov dword [rsp + 0x20], 2
call fcn.140068970
mov ecx, r15d
mov r8d, 1
shl r8d, cl
or dword [rsi + 0x94], r8d
cmp r15d, 1
je 0x1400552a5
mov rax, qword [rsi]
mov rdx, r15
mov rcx, qword [rax + 0x20]
shl rdx, 5
mov rax, qword [rdx + rcx + 8]
cmp byte [rax + 0x11], 0
je 0x1400552a5
or dword [rsi + 0x98], r8d
xor edi, edi
mov r9d, ebp
mov r8d, r12d
lea edx, [rdi + 0x19]
mov rcx, rsi
mov dword [rsp + 0x20], edi
call fcn.140068970
lea edx, [rdi + 0x53]
xor r9d, r9d
mov r8d, ebp
mov rcx, rsi
mov dword [rsp + 0x20], r14d
call fcn.140068970
mov r12d, eax
mov rax, qword [rsi + 8]
test rax, rax
je 0x1400552eb
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rcx + rcx*2]
mov byte [rax + rdx*8 - 0x15], 0x90
mov r9d, 2
mov r8d, r15d
mov rcx, rsi
lea edx, [r9 + 0x32]
mov dword [rsp + 0x20], ebp
call fcn.140068970
mov edx, dword [rsi + 0x3c]
cmp edx, r12d
jbe 0x140055318
mov rax, qword [rsi + 8]
lea rcx, [r12 + r12*2]
mov dword [rax + rcx*8 + 8], edx
mov ecx, dword [rsi + 0x3c]
mov rax, qword [rsi + 0x30]
dec ecx
mov dword [rax + 0x64], ecx
test r14d, r14d
je 0x140055362
movzx edx, byte [rbx + 0x1f]
cmp dl, 8
jae 0x140055362
mov ecx, edi
lea rax, [rbx + 0x88]
nop dword [rax + rax]
cmp dword [rax + 0xc], r14d
je 0x14005535e
inc ecx
add rax, 0x14
cmp ecx, 0xa
jl 0x140055340
movzx eax, dl
mov dword [rbx + rax*4 + 0x24], r14d
inc byte [rbx + 0x1f]
jmp 0x140055362
mov byte [rax + 6], 1
mov r14, qword [rsp + 0x60]
test ebp, ebp
je 0x1400553a0
movzx ecx, byte [rbx + 0x1f]
cmp cl, 8
jae 0x1400553a0
lea rax, [rbx + 0x88]
nop dword [rax + rax]
cmp dword [rax + 0xc], ebp
je 0x14005539c
inc edi
add rax, 0x14
cmp edi, 0xa
jl 0x140055380
movzx eax, cl
mov dword [rbx + rax*4 + 0x24], ebp
inc byte [rbx + 0x1f]
jmp 0x1400553a0
mov byte [rax + 6], 1
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r12
pop rsi
ret
Function at 0x140072640
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, qword [rcx + 0x48]
mov r14, qword [rcx + 0x10]
xor ebx, ebx
mov rdi, qword [rsi + 0x30]
mov r15, r9
mov ebp, r8d
mov r13, rdx
test rdi, rdi
jne 0x1400726d0
movzx eax, word [r14 + 6]
imul ecx, eax, 0x38
add ecx, 0x58
test ecx, ecx
jle 0x1400726a1
movsxd rdx, ecx
mov rcx, qword [r14 + 0x10]
call fcn.140044680
mov rdi, rax
test rax, rax
jne 0x1400726a4
mov edi, ebx
jmp 0x1400726bb
mov rdi, rbx
lea rax, [rdi + 0x20]
mov qword [rdi], r14
mov qword [rdi + 0x10], rax
movzx eax, word [r14 + 6]
inc ax
mov word [rdi + 8], ax
mov qword [rsi + 0x30], rdi
test rdi, rdi
jne 0x1400726cc
lea eax, [rdi + 7]
jmp 0x140072757
mov word [rdi + 8], bp
cmp byte [rsi + 0x58], bl
je 0x140072708
cmp byte [rsi + 0x59], bl
je 0x1400726e7
mov rax, qword [rsi + 0x10]
mov edx, dword [rax + 0x14]
mov r8, qword [rax + 0x28]
jmp 0x140072712
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rcx + rcx*4]
shl rax, 4
add rax, qword [rdx + 0x18]
mov edx, dword [rax + 0x14]
mov r8, qword [rax + 0x28]
jmp 0x140072712
mov rax, qword [rsi + 0x38]
mov edx, dword [rax]
lea r8, [rax + 0x10]
mov r9, rdi
mov rcx, r14
call fcn.140071ce0
test ebp, ebp
jle 0x14007273f
mov rax, qword [rdi + 0x10]
add rax, 8
nop dword [rax]
test byte [rax], 1
jne 0x140072776
inc ebx
add rax, 0x38
cmp ebx, ebp
jl 0x140072730
mov rdx, qword [r13 + 0x10]
mov ecx, dword [r13 + 0xc]
xor r9d, r9d
mov r8, rdi
call fcn.14007b970
mov dword [r15], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
ret
mov dword [r15], 0xffffffff
jmp 0x140072755

Function at 0x140077c00
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
movzx ecx, byte [rcx]
xor eax, eax
test cl, cl
je 0x140077c41
lea r10, [0x1402d61f0]
nop dword [rax]
nop word [rax + rax]
movzx edx, cl
lea ecx, [rax*8]
lea r9, [r9 + 1]
movzx r8d, byte [rdx + r10]
xor r8d, ecx
movzx ecx, byte [r9]
xor eax, r8d
test cl, cl
jne 0x140077c20
ret

Function at 0x14007a8a0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x20], 0
mov rbx, rcx
je 0x14007a8fd
mov rcx, qword [rcx]
call fcn.14007c780
mov ecx, eax
test eax, eax
jne 0x14007a91b
movups xmm1, xmmword [rbx + 0x28]
movups xmm0, xmmword [rbx + 0x38]
movups xmmword [rbx + 0x28], xmm0
movups xmmword [rbx + 0x38], xmm1
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x30], rax
jne 0x14007a8e6
mov eax, ecx
mov dword [rbx + 0x1c], 1
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx]
lea rdx, [0x14007a880]
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400644c0
call fcn.14007a570
movups xmm0, xmmword [rbx + 0x38]
movups xmmword [rbx + 0x28], xmm0
mov rcx, qword [rbx + 0x10]
cmp qword [rbx + 0x30], rcx
jne 0x14007a91b
mov dword [rbx + 0x1c], 1
add rsp, 0x20
pop rbx
ret
Function at 0x14008f5f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rdi, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
call qword [sym.imp.mfc120u.dll_Ordinal_296]
mov dword [rsp + 0x30], 1
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x50], rbp
lea rdx, [rsp + 0xa8]
lea ecx, [rbp + 2]
call fcn.140195770
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov r8, rax
mov rdx, 0xffffffff80000002
mov r9d, 0x20019
lea rcx, [rsp + 0x40]
call fcn.14008ff80
test eax, eax
jne 0x14008f70a
mov edx, Ordinal_261
mov rcx, rdi
call qword [sym.imp.mfc120u.dll_Ordinal_4855]
mov rsi, rax
mov dword [rsp + 0x98], Ordinal_528
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xa0]
xor r8d, r8d
lea rdx, str.SerialNumber
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008f6eb
mov eax, dword [rsp + 0xa0]
dec eax
cmp eax, 1
ja 0x14008f6eb
test rsi, rsi
je 0x14008f6eb
cmp dword [rsp + 0x98], ebp
jne 0x14008f6eb
mov word [rsi], bp
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.mfc120u.dll_Ordinal_12110]
test rbx, rbx
je 0x14008f70f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
jmp 0x14008f70f
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x14008f71e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
mov rax, rdi
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140092eb0
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x2f0], rbx
mov rax, qword [0x140462840]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x50], rdx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov qword [rdx + 0x18], InitCommonControls
mov qword [rdx + 0x10], r15
mov byte [rdx], r15b
mov dword [rsp + 0x30], 1
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8005
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400930c3
lea rax, vtable.CefStringBase_struct_CefStringTraitsUTF16_.0
mov qword [rsp + 0x38], rax
mov edi, r15d
mov qword [rsp + 0x40], r15
xor sil, sil
mov byte [rsp + 0x48], sil
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], r15
mov word [rsp + 0x60], r15w
cmp word [rbp - 0x60], di
jne 0x140092f72
mov r8d, r15d
jmp 0x140092f8a
lea rax, [rbp - 0x60]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], di
jne 0x140092f80
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.1400916a0
nop
cmp qword [rsp + 0x70], 0
je 0x140092feb
mov ecx, 0x18
call sub.mfc120u.dll_Ordinal_1484
mov rdi, rax
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov sil, 1
mov byte [rsp + 0x48], sil
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
lea r9d, [rax + 1]
mov r8, rdi
mov rdx, qword [rsp + 0x70]
call sub.libcef.dll_cef_string_utf16_set
nop
cmp qword [rsp + 0x78], 8
jb 0x140092ffd
mov rcx, qword [rsp + 0x60]
call sub.mfc120u.dll_Ordinal_1486
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], r15
mov word [rsp + 0x60], r15w
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x38]
call fcn.1400925c0
lea rax, [rbp - 0x80]
cmp rbx, rax
je 0x140093052
cmp qword [rbx + 0x18], 0x10
jb 0x140093037
mov rcx, qword [rbx]
call sub.mfc120u.dll_Ordinal_1486
mov qword [rbx + 0x18], InitCommonControls
mov qword [rbx + 0x10], r15
mov byte [rbx], 0
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.140095f70
cmp qword [rbp - 0x68], 0x10
jb 0x140093062
mov rcx, qword [rbp - 0x80]
call sub.mfc120u.dll_Ordinal_1486
mov qword [rbp - 0x68], InitCommonControls
mov qword [rbp - 0x70], r15
mov byte [rbp - 0x80], 0
test rdi, rdi
je 0x14009308c
test sil, sil
je 0x14009308c
mov rcx, rdi
call sub.libcef.dll_cef_string_utf16_clear
mov rcx, rdi
call sub.mfc120u.dll_Ordinal_1486
mov r8, r14
lea rdx, [0x1402dfad0]
lea rcx, [rbp - 0x80]
call fcn.140091a00
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.1400963e0
nop
cmp qword [rbp - 0x68], 0x10
jb 0x1400930c3
mov rcx, qword [rbp - 0x80]
call sub.mfc120u.dll_Ordinal_1486
mov rax, rbx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140289bf0
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2c0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140096b70
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
xor ebx, ebx
mov rdi, rdx
lea ecx, [rbx + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
mov eax, 2
lea ecx, [rax + 0xf]
cmovne ebx, eax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x140096bb0
or ebx, 4
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x140096bc5
or ebx, 8
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x140096bd8
bts ebx, 8
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x140096bea
or ebx, 1
lea rax, [rsi - 0xc]
cmp rax, 0x84
ja case.0x140096c0f.14
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x96cf4]
mov ecx, dword [rdx + rax*4 + 0x96cd0]
add rcx, rdx
jmp rcx
bt rdi, 0x18
jae case.0x140096c0f.14
bts ebx, 9
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
bt rdi, 0x18
jb case.0x140096c0f.14
bts ebx, 9
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne case.0x140096c0f.91
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je case.0x140096c0f.14
bts ebx, 0xb
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne case.0x140096c0f.91
mov ecx, 0xa3
jmp 0x140096c62
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne case.0x140096c0f.91
mov ecx, 0xa5
jmp 0x140096c62
mov rsi, qword [rsp + 0x38]
bts ebx, 0xa
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400972f0
Capabilities:
Get file version info

Disassembly:
push rsi
push r12
push r14
push r15
sub rsp, reloc.mfc120u.dll_Ordinal_2136
mov rax, qword [0x140462840]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov r12, rdx
mov rsi, r8
mov r15, rcx
lea rdx, [rsp + 0x30]
mov r8d, 0x400
xor ecx, ecx
mov r14, r9
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140097420
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x848], rbp
mov dword [rsp + 0x20], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
je 0x140097418
mov rdx, rbp
mov ecx, 2
mov qword [rsp + Ordinal_2134], rbx
mov qword [rsp + Ordinal_2113], rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rax
mov r8d, ebp
mov rbx, rax
call sub.VERSION.dll_GetFileVersionInfoW
lea r9, [rsp + 0x24]
lea r8, [rsp + 0x28]
lea rdx, [0x1402dfd40]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
mov rbx, qword [rsp + 0x850]
test eax, eax
je 0x1400973fc
mov rcx, qword [rsp + 0x28]
test r15, r15
je 0x1400973d8
movzx eax, word [rcx + 0xa]
mov dword [r15], eax
test r12, r12
je 0x1400973e5
movzx eax, word [rcx + 8]
mov dword [r12], eax
test rsi, rsi
je 0x1400973f0
movzx eax, word [rcx + 0xe]
mov dword [rsi], eax
test r14, r14
je 0x1400973fc
movzx eax, word [rcx + 0xc]
mov dword [r14], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rdi, qword [rsp + 0x840]
mov al, 1
mov rbp, qword [rsp + 0x848]
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140289bf0
add rsp, reloc.mfc120u.dll_Ordinal_2136
pop r15
pop r14
pop r12
pop rsi
ret