joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6bac1b80
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x6bb0f5e4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x6bac1d28
mov rax, qword [0x6bb0f5e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x6bac1bcc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x6bac1c57
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x6bac1bb0
mov rcx, r12
call fcn.6bac2880
mov rbp, rax
test rax, rax
je 0x6bac1d62
mov rax, qword [0x6bb0f5e8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.6bac29b0
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6bb0f5e8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6bac1d71
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x6bac1c50
sub eax, 4
and eax, 0xfffffffb
jne 0x6bac1ce0
add dword [0x6bb0f5e4], 1
cmp ebx, 8
jae 0x6bac1c88
test bl, 4
jne 0x6bac1d30
test ebx, ebx
je 0x6bac1c79
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x6bac1d50
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x6bac1c79
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x6bac1cba
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x6bb0f5e8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6bac1c50
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.6bac1b10
nop dword [rax]
xor edi, edi
jmp 0x6bac1bd7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x6bac1c79
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x6bac1c79
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.6bac1b10
mov rax, qword [0x6bb0f5e8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.6bac1b10
nop
nop dword [rax]
Function at 0x6bac24f0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6bb0f8c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6bb0f8a0]
test rbx, rbx
je 0x6bac2544
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x6bac253b
test r12, r12
je 0x6bac253b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6bac2520
lea rcx, [0x6bb0f8c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x6bac2880
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x6bb0c260]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x6bac28f9
mov rcx, r10
call fcn.6bac2750
test eax, eax
je 0x6bac28f9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x6bac28f6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x6bac28ed
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x6bac28f9
add r8, 0x28
cmp r8, r9
jne 0x6bac28d8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140a03210
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140a03397
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140a03241
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a03227
add dl, dl
jne 0x140a0324e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a032ae
xor eax, eax
add dl, dl
jne 0x140a0325d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a03365
add dl, dl
jne 0x140a0326e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a0327b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a03288
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a03295
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140a032a2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140a03236
mov eax, 1
add dl, dl
jne 0x140a032be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a032cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a032b3
sub eax, ebx
mov ebx, 1
jne 0x140a03304
mov ecx, 1
add dl, dl
jne 0x140a032e6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a032f3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a032db
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a03236
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140a03320
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a0332d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a03315
cmp eax, 0x7d00
jae 0x140a03353
cmp eax, 0x500
jb 0x140a0334e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a03236
cmp eax, 0x7f
ja 0x140a03356
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a03236
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140a0338a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140a03236
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002098
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x20
mov edi, edx
test r8, r8
jne 0x140042b6a
mov eax, dword [0x1400e4e98]
cmp eax, 0xffffffff
je 0x140002172
movsxd rcx, eax
mov rax, qword [0x1400e4e80]
mov rcx, qword [rax + rcx*8]
mov rbx, qword [rcx]
cmp byte [rbx + 0x6a], 0
mov rbp, qword [rbx]
je 0x1400020ec
cmp dword [rbx + 0x2b8], 0
mov byte [rbx + 0x6a], 0
jge 0x140042b84
cmp edi, 8
jg 0x140042be0
je 0x14000211a
test edi, edi
je 0x140042bcc
cmp edi, 1
je 0x14000211a
mov edx, 6
cmp edi, 2
je 0x140002169
cmp edi, 3
je 0x140002160
jle 0x140002141
cmp edi, 5
jg 0x140002156
cmp byte [rbx + 0x68], 0
jne 0x140002172
mov edx, edi
mov rcx, rbp
call qword [sym.imp.USER32.dll_ShowWindow]
lea eax, [rdi - 4]
test eax, 0xfffffffb
je 0x14000213d
mov rdx, rbp
call fcn.14001a2d4
mov byte [rbx + 0x68], 1
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp edi, edx
je 0x140042bb3
jmp 0x140002141
mov byte [rbx + 0x68], 1
jmp 0x140042c47
mov byte [rbx + 0x68], 1
jmp 0x140042bb3
xor eax, eax
jmp 0x140002146
lea rcx, [0x1400e4de0]
mov rdx, r8
call fcn.1400042a0
mov dword [0x1400e4e98], eax
jmp 0x1400020b8
cmp byte [rbx + 0x2c4], 0
je 0x1400020ec
mov r8d, dword [rbx + 0x2c0]
lea rcx, [0x1400e4de0]
mov rdx, rbx
call fcn.1400a5334
mov byte [rbx + 0x2c4], 0
jmp 0x1400020ec
cmp byte [rbx + 0x68], 0
je 0x140002172
mov rcx, rbp
call qword [sym.imp.USER32.dll_ShowWindow]
nop
jmp 0x140002141
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_ShowWindow]
mov byte [rbx + 0x68], 0
jmp 0x140002141
mov ecx, edi
sub ecx, 9
je 0x140042c47
sub ecx, 0x37
je 0x140042c33
dec ecx
je 0x140042c2f
dec ecx
je 0x140042c1c
dec ecx
jne 0x140002141
mov byte [rbx + 0x69], cl
xor ecx, ecx
call qword [sym.imp.USER32.dll_LockWindowUpdate]
mov rcx, qword [rbx]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
nop
jmp 0x140002141
mov rcx, rbp
mov byte [rbx + 0x69], 1
call qword [sym.imp.USER32.dll_LockWindowUpdate]
nop
jmp 0x140002141
xor edx, edx
jmp 0x140042c38
mov edx, 1
mov rcx, rbp
call qword [sym.imp.USER32.dll_EnableWindow]
nop
jmp 0x140002141
cmp byte [rbx + 0x68], 0
je 0x140002172
mov edx, edi
mov rcx, rbp
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, rbp
call fcn.14001a2d4
nop
jmp 0x140002141
Function at 0x140003ee8
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rbx, qword [rdx]
mov rsi, rcx
lea rcx, [rbp + 0x20]
mov r14d, r8d
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rbp + 0x20]
lea rdx, [rbp + 0x20]
mov rcx, rbx
mov dword [rdi + 0x290], eax
mov eax, dword [rbp + 0x24]
mov dword [rdi + 0x294], eax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rbp + 0x20]
mov ecx, dword [rbp + 0x24]
cmp eax, dword [rdi + 0x298]
jne 0x140003fb8
cmp ecx, dword [rdi + 0x29c]
jne 0x140003fb8
mov ecx, dword [rsi + 0x18]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [rsi + 0x1c]
movzx r15d, ax
shr r15d, 0xf
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
shr ebx, 0xf
cmp r15d, dword [rdi + 0x2a0]
jne 0x140044bf9
test r14d, r14d
je 0x140003f88
mov dword [rdi + 0x2a0], r15d
cmp ebx, dword [rdi + 0x2a4]
jne 0x140044c80
test r14d, r14d
je 0x140003f9f
mov dword [rdi + 0x2a4], ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
mov dword [rdi + 0x298], eax
mov dword [rdi + 0x29c], ecx
cmp r14d, 1
jl 0x140003f4f
jmp 0x140044bdc
mov dword [rsp + 0x20], ecx
mov r9d, eax
mov r8, rdi
mov rcx, rsi
mov edx, 0xfffffff5
call fcn.14009e3b0
nop
jmp 0x140003f4f
cmp r14d, 1
jl 0x140003f7c
cmp byte [rdi + 0x2e0], 0
je 0x140003f7c
mov eax, dword [rbp + 0x24]
mov r9d, dword [rbp + 0x20]
mov r8, rdi
mov rcx, rsi
mov dword [rsp + 0x20], eax
test r15d, r15d
je 0x140044c2d
mov edx, 0xfffffff9
jmp 0x140044c6f
mov edx, 0xfffffff8
call fcn.14009e3b0
cmp byte [rdi + 0x2a8], 0
je 0x140044c74
mov rcx, qword [rdi]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r9d, dword [rbp + 0x20]
mov r8, rdi
bt eax, 0x18
mov eax, dword [rbp + 0x24]
mov rcx, rsi
mov dword [rsp + 0x20], eax
mov edx, 0xfffffffa
jb 0x140044c6f
mov edx, 0xfffffff4
call fcn.14009e3b0
mov byte [rdi + 0x2a8], 0
jmp 0x140003f7c
cmp r14d, 1
jl 0x140003f94
mov eax, dword [rbp + 0x24]
mov r9d, dword [rbp + 0x20]
mov r8, rdi
mov rcx, rsi
mov edx, 0xfffffff7
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x140044ca9
mov edx, 0xfffffff6
call fcn.14009e3b0
nop
jmp 0x140003f94

Function at 0x140004a10
Capabilities:
Hash data using djb2

Disassembly:
mov eax, dword [rdx + 8]
mov r10, qword [rdx]
xor r8d, r8d
add eax, eax
mov r9d, 0x1505
movsxd rdx, eax
test eax, eax
jle 0x140004a3c
movzx ecx, byte [r8 + r10]
imul r9d, r9d, 0x21
inc r8
add r9d, ecx
cmp r8, rdx
jl 0x140004a28
mov eax, r9d
ret
Function at 0x14001a2d4
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
cmp rdi, rax
jne 0x14004f26e
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
xor ebx, ebx
test rax, rax
jne 0x14004f287
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x14004f2a2
mov edx, 9
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x14004f3cc
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov rcx, rdi
mov r14d, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, 1
mov ecx, r14d
mov edx, eax
mov r8d, esi
mov r15d, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r8d, esi
mov edx, ebp
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r8d, esi
mov edx, r15d
mov ecx, ebp
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x14004f39a
lea esi, [rax + 0x12]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea r8d, [rsi - 0x10]
xor r9d, r9d
mov edx, eax
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea r8d, [rsi - 0x10]
xor r9d, r9d
mov edx, eax
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x14004f39f
lea ebx, [rsi - 0xe]
jmp 0x14004f39f
mov ebx, 3
xor r8d, r8d
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor r8d, r8d
mov edx, ebp
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor r8d, r8d
mov edx, r15d
mov ecx, ebp
call qword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x14004f3d1
mov ebx, 2
mov eax, ebx
jmp 0x14001a306
Function at 0x14001ab54
Capabilities:
Hide graphical window

Disassembly:
mov r11, rsp
sub rsp, 0x68
and qword [r11 - 0x10], 0
mov rax, qword [0x1400e44b8]
lea rdx, str.AutoIt_v3
mov qword [r11 - 0x18], rax
and qword [r11 - 0x20], 0
and qword [r11 - 0x28], 0
mov eax, 0x80000000
mov dword [rsp + 0x38], 0x64
mov dword [rsp + 0x30], 0x12c
mov dword [rsp + 0x28], eax
mov r9d, 0xcf0000
mov r8, rdx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
and qword [rsp + 0x58], 0
mov rcx, qword [0x1400e44b8]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [0x1400ab2e0]
mov r9d, 0x50b008c4
xor r8d, r8d
xor ecx, ecx
mov qword [0x1400e4510], rax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, qword [0x1400e4510]
xor edx, edx
mov qword [0x1400e4508], rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400e4510]
xor edx, edx
add rsp, 0x68
jmp qword [sym.imp.USER32.dll_ShowWindow]
Function at 0x14001ad58
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x1ff70]
mov eax, 0x20070
call fcn.1400396b0
sub rsp, rax
lea rcx, [rsp + 0x50]
mov rsi, rdx
call fcn.14001e830
lea rdx, [rsp + 0x70]
xor bl, bl
mov ecx, 0x7fff
mov byte [rbp + 0x1ffa0], bl
xor dil, dil
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea r8, [rbp + 0x1ffb0]
mov rdx, rsi
call fcn.14001a81c
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14004f7e0
mov eax, dword [0x1400e4570]
test eax, eax
je 0x14001aeea
mov r15d, 1
lea rcx, [0x1400e6320]
cmp eax, r15d
je 0x14004f802
lea rax, [rbp + 0x1ffa0]
lea r8, [0x1400e4570]
lea rdx, [0x1400e4598]
mov qword [rsp + 0x20], rax
call fcn.14001cd54
test al, al
je 0x14001aef3
mov al, byte [0x1400e6320]
mov rcx, qword [0x1400e4598]
mov dil, byte [0x1400e6321]
lea r9, [rbp + 0x1ffb8]
lea r8, [rbp + 0xff70]
mov edx, 0x7fff
mov byte [0x1400e4574], al
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov rdx, qword [rbp + 0x1ffb8]
lea rcx, [0x1400e4550]
call fcn.14001efe8
mov bl, byte [rbp + 0x1ffa0]
mov r8d, dword [0x1400e4570]
lea rdx, [0x1400e4598]
call fcn.14000bc80
test eax, eax
jne 0x14004f826
cmp dil, r15b
je 0x14004f849
call fcn.14001ac28
call fcn.14001ab54
cmp byte [0x1400e4574], 0
jne 0x14001ae97
lea rcx, [0x1400e4f50]
call fcn.1400016b0
lea rcx, [0x1400e45c0]
mov edx, r15d
call fcn.14000bd60
cmp byte [0x1400e4574], 0
jne 0x14001aebb
lea rcx, [0x1400e4f50]
call fcn.140001800
lea rcx, [0x1400e6320]
call fcn.14001cdec
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [rsp + 0x50]
call fcn.14001c48c
add rsp, 0x20070
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
or dword [0x1400e44c0], 0xffffffff
jmp 0x14001aec7
mov dword [0x1400e44c0], r15d
jmp 0x14001aec7
lea r8, [0x1400cf2a4]
lea rdx, str.This_is_a_third_party_compiled_AutoIt_script.
mov r9d, reloc.WSOCK32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
jmp 0x14001aed2
mov r8, qword [0x1400e4578]
or r9d, 0xffffffff
mov edx, r15d
call fcn.14001cca8
mov al, byte [0x1400e44c8]
mov byte [0x1400e6322], al
jmp 0x14001ae54
lea rcx, [0x1400e6320]
call fcn.14001cdec
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x1400e44c0], r15d
jmp 0x14001aed2
call fcn.140074dec
test al, al
jne 0x14001ae78
cmp byte [rbp + 0x1ffb0], al
jne 0x14001ae78
lea rcx, [rsp + 0x50]
call fcn.14001a5d8
lea rdx, [0x1400cb8a0]
lea rcx, [rsp + 0x30]
call fcn.14001f2ac
lea rcx, [rsp + 0x30]
test bl, bl
je 0x14004f8b1
lea rdx, [0x1400cf2d8]
call fcn.14001f110
lea rdx, [0x1400e4598]
lea rcx, [rsp + 0x30]
call fcn.14001ee50
lea rdx, [0x1400cf2d8]
lea rcx, [rsp + 0x30]
jmp 0x14004f8b4
mov rdx, rsi
call fcn.14001f110
mov rbx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x70]
lea rdx, str.runas
mov r9, rbx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x30]
call fcn.14001c48c
nop
jmp 0x14001aebb
Function at 0x14001b7ec
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x30], 0
cmp byte [rcx + 0x20], 0
mov r10, r9
mov r11, r8
mov rbx, rdx
jne 0x14004fabe
mov r9, qword [rsp + 0x50]
mov r8, r10
mov rdx, r11
mov rcx, rbx
call fcn.14002ba94
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx + 0x18]
imul r10d, r11d
lea r9, [rsp + 0x30]
mov rax, qword [rcx]
mov r8d, r10d
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rax, qword [rsp + 0x30]
jmp 0x14001b81e
Function at 0x14001c840
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x10], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x14001c8e8
xor edi, edi
test rsi, rsi
je 0x14001c893
nop
mov eax, dword [rbx + 0x10]
cmp dword [rbx + 0x14], eax
je 0x14001c8af
movsxd rdx, dword [rbx + 0x14]
mov rcx, qword [rbx + 8]
inc rdi
movzx edx, byte [rdx + rcx]
mov byte [rdi + rbp - 1], dl
inc dword [rbx + 0x14]
cmp rdi, rsi
jb 0x14001c870
add qword [rbx + 0x18], rdi
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx]
lea r9, [rsp + 0x40]
mov r8d, 0x10000
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001c893
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14001c893
mov dword [rbx + 0x10], eax
mov dword [rbx + 0x14], 0
jmp 0x14001c878
mov qword [rcx + 0x10], 0
call fcn.14001c900
mov qword [rbx + 0x18], rax
jmp 0x14001c867
Function at 0x140026314
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor ecx, ecx
mov r15, r9
mov r13, rdx
lea ebx, [rcx + 1]
mov edi, ecx
mov ebp, ecx
cmp qword [rdx + 8], rcx
je 0x140062f4e
mov rax, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xb0]
mov byte [rax], cl
mov byte [r12], cl
mov byte [r14], cl
mov byte [r9], cl
mov dword [r8], ecx
mov rsi, rax
movsxd rdx, edi
mov rcx, r13
call fcn.14001ed3c
movzx ecx, word [rax]
lea eax, [rcx - 0x21]
cmp ax, 0x3d
jbe 0x140062f55
movsxd rdx, edi
add edi, ebx
mov rcx, r13
mov dword [rsp + 0x90], edi
call fcn.14001ed3c
mov rsi, qword [rsp + 0xa0]
movzx ecx, word [rax]
cmp cx, 0x7b
jne 0x140062fde
lea rcx, [rsp + 0x30]
mov edx, 0x40
call fcn.14001edac
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x30]
mov edx, 0x7d
mov r8, r13
mov qword [rsp + 0x20], rax
call fcn.14002646c
test al, al
je 0x140026466
lea rdi, [0x1400ba470]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rdi]
call fcn.140027bac
test eax, eax
je 0x140026415
lea rax, [0x1400ba788]
add rdi, 8
add ebp, ebx
cmp rdi, rax
jl 0x1400263f2
cmp ebp, 0x63
je 0x140062f9a
lea rcx, [0x140000000]
movsxd rax, ebp
cmp byte [rax + rcx + 0xba400], 0
jne 0x140026466
movzx eax, byte [rax + rcx + 0xba390]
mov dword [rsi], eax
lea rcx, [rsp + 0x30]
call fcn.14001c48c
and dword [rsi], 0xff
mov al, bl
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor bl, bl
jmp 0x14002643c
lea rcx, [rsp + 0x30]
call fcn.14001c48c
xor al, al
jmp 0x14002644e
movabs rdx, 0x2000000000000405
bt rdx, rax
jae 0x140026390
cmp cx, 0x2b
jne 0x140062f74
mov byte [r15], bl
jmp 0x140062f93
cmp cx, 0x5e
jne 0x140062f7f
mov byte [r14], bl
jmp 0x140062f93
cmp cx, 0x21
jne 0x140062f8b
mov byte [r12], bl
jmp 0x140062f93
cmp cx, 0x23
jne 0x140062f93
mov byte [rsi], bl
add edi, ebx
jmp 0x140026375
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.14001ed74
movzx ecx, word [rax]
call qword [sym.imp.USER32.dll_VkKeyScanW]
movsx ecx, ax
mov dword [rsi], ecx
cmp ecx, 0xffffffff
je 0x140062f44
bt ecx, 9
jae 0x140062fc2
mov byte [r14], bl
bt ecx, 0xa
jae 0x140062fcc
mov byte [r12], bl
bt ecx, 8
jae 0x14002643c
mov byte [r15], bl
jmp 0x14002643c
call qword [sym.imp.USER32.dll_VkKeyScanW]
movsx ecx, ax
mov dword [rsi], ecx
cmp ecx, 0xffffffff
je 0x140062f4e
bt ecx, 9
jae 0x140062ffb
mov byte [r14], bl
bt ecx, 0xa
jae 0x140063005
mov byte [r12], bl
bt ecx, 8
jae 0x140026446
mov byte [r15], bl
jmp 0x140026446