joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007ad0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.140008310
mov rcx, qword [rsp + 0x78]
call fcn.140006480
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140008440
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400084e0
nop
lea rcx, [rsp + 0x38]
call fcn.140008360
lea rax, [0x140008530]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
call fcn.140001840
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x140007b99
lea rcx, [rsp + 0x50]
call fcn.140008330
jmp 0x140007bb1
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rcx, [rsp + 0x50]
call fcn.140008360
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140008c30
add rsp, 0x68
ret

Function at 0x140007bd0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.140008310
mov rcx, qword [rsp + 0x78]
call fcn.140006480
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140008440
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400084e0
nop
lea rcx, [rsp + 0x38]
call fcn.140008360
lea rax, [0x1400085c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
call fcn.140001840
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x140007c99
lea rcx, [rsp + 0x50]
call fcn.140008330
jmp 0x140007cb1
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rcx, [rsp + 0x50]
call fcn.140008360
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140008c30
add rsp, 0x68
ret
Function at 0x140007cd0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.140008310
mov rcx, qword [rsp + 0x78]
call fcn.140006480
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140008440
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400084e0
nop
lea rcx, [rsp + 0x38]
call fcn.140008360
lea rax, [0x140008650]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
call fcn.140001840
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x140007d99
lea rcx, [rsp + 0x50]
call fcn.140008330
jmp 0x140007db1
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rcx, [rsp + 0x50]
call fcn.140008360
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140008c30
add rsp, 0x68
ret

Function at 0x140007dd0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.140008310
mov rcx, qword [rsp + 0x78]
call fcn.140006480
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140008440
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400084e0
nop
lea rcx, [rsp + 0x38]
call fcn.140008360
lea rax, [0x1400086e0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
call fcn.140001840
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x140007e99
lea rcx, [rsp + 0x50]
call fcn.140008330
jmp 0x140007eb1
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rcx, [rsp + 0x50]
call fcn.140008360
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140008c30
add rsp, 0x68
ret
Function at 0x140007ed0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.140008310
mov rcx, qword [rsp + 0x78]
call fcn.140006480
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140008440
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400084e0
nop
lea rcx, [rsp + 0x38]
call fcn.140008360
lea rax, [0x140008770]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
call fcn.140001840
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x140007f99
lea rcx, [rsp + 0x50]
call fcn.140008330
jmp 0x140007fb1
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rcx, [rsp + 0x50]
call fcn.140008360
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140008c30
add rsp, 0x68
ret

Function at 0x140007fd0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.140008310
mov rcx, qword [rsp + 0x78]
call fcn.140006480
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140008440
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400084e0
nop
lea rcx, [rsp + 0x38]
call fcn.140008360
lea rax, [0x140008800]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
call fcn.140001840
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x140008099
lea rcx, [rsp + 0x50]
call fcn.140008330
jmp 0x1400080b1
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rcx, [rsp + 0x50]
call fcn.140008360
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140008c30
add rsp, 0x68
ret
Function at 0x1400080d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.140008310
mov rcx, qword [rsp + 0x78]
call fcn.140006480
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140008440
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400084e0
nop
lea rcx, [rsp + 0x38]
call fcn.140008360
lea rax, [0x140008890]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
call fcn.140001840
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x140008199
lea rcx, [rsp + 0x50]
call fcn.140008330
jmp 0x1400081b1
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rcx, [rsp + 0x50]
call fcn.140008360
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140008c30
add rsp, 0x68
ret
Function at 0x180008fd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov edx, dword [rcx]
mov r9d, 0x138
mov r10, rcx
cmp edx, r9d
jne 0x180009037
lea r8, [rcx + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x180008ff2
mov edx, dword [r10]
jmp 0x180009139
cmp edx, 0x270
jb 0x180009139
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [rcx + 0x9c8]
mov qword [rsp], rdi
mov r9, qword [rbx]
mov edi, 0x9c
mov r8, qword [rbx + 8]
lea rbx, [rbx + 8]
xor r9, r8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rbx + 0x4d8]
xor rcx, r9
mov r9, r8
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x180009065
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
mov r8, qword [rbx + 8]
lea rbx, [rbx + 8]
xor r9, r8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rbx - 0xea8]
xor rcx, r9
mov r9, r8
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x1800090b4
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
xor edx, edx
mov qword [r10 + 0x9c0], rcx
mov dword [r10], edx
mov eax, edx
xorps xmm0, xmm0
mov rcx, qword [r10 + rax*8 + 8]
lea eax, [rdx + 1]
mov dword [r10], eax
movabs rdx, 0x38eb3ffff6d3
mov rax, rcx
shr rax, 0x1d
and rax, qword [r10 + 0x1388]
xor rcx, rax
mov rax, rcx
and rax, rdx
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rdx, rcx
shr rdx, 0x2b
xor rdx, rcx
js 0x18000919f
cvtsi2sd xmm0, rdx
mulsd xmm0, qword [0x180267b80]
add rsp, 8
ret
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, qword [0x180267b80]
add rsp, 8
ret
Function at 0x180009650
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, qword [0x1803e4008]
mov rbx, r8
lea rsi, [rdi + 0x164]
lea rcx, [rdi + 0x16c]
mov dword [rsi], 1
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + 0x168], ebx
add rbx, 8
je 0x18000972b
mov rax, qword [rdi]
test rax, rax
je 0x1800096db
mov rcx, qword [rax + 8]
cmp rcx, 0xffffffffffffffff
je 0x1800096db
test rsi, rsi
je 0x1800096db
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x1800096db
cmp dword [rsp + 0x40], ebx
je 0x18000972b
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x1800096fa
mov eax, dword [rdi + 8]
dec eax
test eax, 0xfffffffd
jne 0x1800096fa
mov ecx, dword [rdi + 0x60]
lea rdx, [rdi + 0x64]
call r8
mov rbx, qword [rdi]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
xor al, al
mov byte [rbx], 0
mov dword [rdi + 8], 0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov al, 1
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18001aa60
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rcx + 0x10]
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov ebx, dword [rax + r11 + 0x88]
add rbx, r11
cmp rbx, r11
je 0x18001ab1b
mov r10d, dword [rbx + 0x18]
xor r9d, r9d
test r10d, r10d
je 0x18001ab1b
mov r8d, dword [rbx + 0x20]
add r8, r11
nop dword [rax + rax]
mov eax, dword [r8]
mov edx, 0x811c9dc5
add rax, r11
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x18001ab0f
nop word [rax + rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x18001aaf0
cmp edx, 0xaf07e45d
je 0x18001ab20
inc r9d
add r8, 4
cmp r9d, r10d
jb 0x18001aad0
mov rdi, qword [rdi]
jmp 0x18001aaa0
mov eax, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x1c]
add rax, r11
mov r8, qword [rsp + 0x50]
add rcx, r11
movzx edx, word [rax + r9*2]
mov r9, qword [rsp + 0x20]
mov r10d, dword [rcx + rdx*4]
mov edx, 0x200
add r10, r11
lea rcx, [0x1803f8ad0]
call r10
lea rax, [0x1803f8ad0]
add rsp, 0x38
pop rdi
pop rbx
ret

Function at 0x18001b130
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test rcx, rcx
je 0x18001b190
mov r8, qword [rcx]
test r8, r8
je 0x18001b190
mov r8, qword [r8 + 0x10]
mov eax, 0xffffffff
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [r8 + rcx], 0
jne 0x18001b150
test ecx, ecx
je 0x18001b18d
mov r9d, ecx
lea r10, [0x18025ccd0]
nop dword [rax + rax]
movsx edx, byte [r8]
lea r8, [r8 + 1]
mov ecx, eax
shr eax, 8
xor rdx, rcx
movzx ecx, dl
xor eax, dword [r10 + rcx*4]
sub r9, 1
jne 0x18001b170
not eax
ret
xor eax, eax
ret

Function at 0x18001c510
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
test rcx, rcx
jne 0x18001c51d
xor eax, eax
jmp 0x18001c596
mov r9, qword [rcx]
test r9, r9
jne 0x18001c529
xor eax, eax
jmp 0x18001c596
mov r9, qword [r9 + 0x10]
test r9, r9
jne 0x18001c536
xor eax, eax
jmp 0x18001c596
mov r10, r9
mov qword [rsp + 8], r9
xor edx, edx
mov r8d, 0xffffffff
lea r11, [0x18025ccd0]
mov dword [rsp], edx
mov ecx, r8d
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x18001c560
cmp edx, eax
jae 0x18001c58c
movsx eax, byte [r10]
xor rax, rcx
movzx ecx, al
shr r8d, 8
xor r8d, dword [r11 + rcx*4]
inc r10
mov qword [rsp + 8], r10
inc edx
jmp 0x18001c54d
not r8d
mov eax, r8d
jmp 0x18001c596
add rsp, 0x18
ret
Function at 0x18001cb30
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x1803c267a], 0
mov rbx, rcx
je 0x18001cba1
mov ecx, dword [0x1803c2774]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18001cba1
cmp dword [0x1803c2698], 1
jne 0x18001cba1
lea rcx, [rbx + 0x98]
cmp rcx, 0x40000
jbe 0x18001cba1
lea rax, [rcx + 8]
movabs rdx, 0x7fffffff0000
cmp rax, rdx
jae 0x18001cba1
mov rcx, qword [rcx]
add rcx, 0x1dc
cmp rcx, 0x40000
jbe 0x18001cba1
lea rax, [rcx + 4]
cmp rax, rdx
jae 0x18001cba1
mov dword [rcx], 0x3c23d70a
add rsp, 0x20
pop rbx
ret
Function at 0x180025e40
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
cmp byte [0x1803c2544], 0
jne 0x180025ea0
lea rcx, [rsp + 0x30]
mov byte [0x1803c2544], 1
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm0, xmm0
xorps xmm1, xmm1
cvtsi2ss xmm0, qword [rsp + 0x38]
cvtsi2ss xmm1, qword [rsp + 0x30]
movss dword [0x1803c2520], xmm0
movss dword [0x1803c25bc], xmm1
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rsp + 0x30]
subss xmm0, dword [0x1803c25bc]
divss xmm0, dword [0x1803c2520]
add rsp, 0x28
ret
Function at 0x18002a220
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x70
call fcn.18001d3f0
mov rcx, rax
call fcn.18001d280
mov rbx, rax
test rax, rax
je 0x18002a438
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.18001c980
cmp dword [rsp + 0x20], 0
je 0x18002a438
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x18002a438
cmp eax, 0xfffffffe
jne 0x18002a2fc
mov rcx, rbx
call fcn.18001cbb0
cmp byte [0x1803c261f], 0
je 0x18002a438
add rbx, 0x98
cmp rbx, 0x40000
jbe 0x18002a438
lea rax, [rbx + 8]
movabs rcx, 0x7fffffff0000
cmp rax, rcx
jae 0x18002a438
mov rdx, qword [rbx]
mov r8, rdx
lea r9, [rdx + 0x340]
cmp r9, 0x40000
jbe 0x18002a2cf
lea rax, [r9 + 1]
cmp rax, rcx
jae 0x18002a2cf
mov byte [r9], 1
lea rdx, [r8 + 0x344]
cmp rdx, 0x40000
jbe 0x18002a438
lea rax, [rdx + 4]
cmp rax, rcx
jae 0x18002a438
mov dword [rdx], 0x3f800000
add rsp, 0x70
pop rbx
ret
cmp eax, 3
jne 0x18002a364
mov rcx, rbx
call fcn.18001cbb0
cmp byte [0x1803c2664], 0
je 0x18002a357
lea rdx, [rbx + 0x98]
cmp rdx, 0x40000
jbe 0x18002a357
lea rax, [rdx + 8]
movabs rcx, 0x7fffffff0000
cmp rax, rcx
jae 0x18002a357
mov rdx, qword [rdx]
add rdx, 0x1dc
cmp rdx, 0x40000
jbe 0x18002a357
lea rax, [rdx + 4]
cmp rax, rcx
jae 0x18002a357
mov dword [rdx], 0x3c23d70a
mov rcx, rbx
add rsp, 0x70
pop rbx
jmp fcn.18001cb30
cmp eax, 2
jne 0x18002a3bd
mov rcx, rbx
call fcn.18001cbb0
mov rcx, rbx
call fcn.18001cb30
cmp byte [0x1803c261e], 0
je 0x18002a438
add rbx, 0x98
cmp rbx, 0x40000
jbe 0x18002a438
lea rax, [rbx + 8]
movabs rcx, 0x7fffffff0000
cmp rax, rcx
jae 0x18002a438
mov rdx, qword [rbx]
add rdx, 0x270
jmp 0x18002a423
cmp eax, 0xffffffff
jne 0x18002a438
mov rcx, rbx
call fcn.18001cbb0
cmp byte [0x1803c266c], 0
je 0x18002a438
add rbx, 0x98
cmp rbx, 0x40000
jbe 0x18002a438
lea rax, [rbx + 8]
movabs rcx, 0x7fffffff0000
cmp rax, rcx
jae 0x18002a438
mov rdx, qword [rbx]
mov r8, rdx
lea r9, [rdx + 0x340]
cmp r9, 0x40000
jbe 0x18002a41c
lea rax, [r9 + 4]
cmp rax, rcx
jae 0x18002a41c
mov dword [r9], 0x3f800000
lea rdx, [r8 + 0x350]
cmp rdx, 0x40000
jbe 0x18002a438
lea rax, [rdx + 1]
cmp rax, rcx
jae 0x18002a438
mov byte [rdx], 1
add rsp, 0x70
pop rbx
ret
Function at 0x18002d4b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18002d528
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x18002d528
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x18002d515
nop
cmp rbx, rcx
jae 0x18002d528
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x18002d500
cmp rbx, rcx
jae 0x18002d528
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x18002d52a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180046db0
Capabilities:
Delete file

Disassembly:
sub rsp, 0xa8
movdqa xmm1, xmmword [0x180268460]
xorps xmm0, xmm0
mov r8, qword [0x1803c0aa0]
mov rcx, 0xffffffffffffffff
movups xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x40], 0
movdqu xmmword [rsp + 0x50], xmm1
inc rcx
cmp byte [rdx + rcx], 0
jne 0x180046de0
movabs rax, 0x7fffffffffffffff
sub rax, r8
cmp rax, rcx
jb 0x180046fab
cmp qword [0x1803c0aa8], 0x10
lea r9, [0x1803c0a90]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x60]
cmovae r9, qword [0x1803c0a90]
movaps xmmword [rsp + 0x90], xmm6
mov qword [rsp + 0x28], rdx
movaps xmmword [rsp + 0x80], xmm7
mov qword [rsp + 0x20], r8
call fcn.18005e410
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x180046e80
lea rax, [rcx + 4]
cmp rdx, 0x10
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
cmovae rax, qword [rsp + 0x60]
mov dword [rax + rcx], 0x696e692e
mov byte [rax + rcx + 4], 0
lea rax, [rsp + 0x60]
jmp 0x180046e9f
lea r9, str..ini
mov qword [rsp + 0x20], 4
mov edx, 4
lea rcx, [rsp + 0x60]
call fcn.18005d6f0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180046ef2
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180046eed
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180046f30
call fcn.18010785c
mov rdx, qword [rsp + 0x78]
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
cmp rdx, 0x10
jb 0x180046f3c
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180046f37
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180046f37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18010785c
cmp qword [rsp + 0x58], 0x10
lea rcx, [rsp + 0x40]
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180046f93
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180046f8e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180046f8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18010785c
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0x80]
add rsp, 0xa8
ret
call fcn.180006be0
int3