joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800456e0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x1800457bb
nop dword [rax]
cmp rbx, qword [section..data]
jb 0x18004572e
cmp rbx, qword [0x180082008]
ja 0x18004572e
sub rbx, 0x8000000
jmp 0x1800457b2
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800457bb
cmp dword [rsp + 0x40], 0x10000
jne 0x180045796
cmp qword [rsp + 0x38], 0x10000
jb 0x180045796
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1800457bd
sub rbx, 0x10000
jmp 0x1800457b2
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x180045710
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x1800457d0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x1800457f2
sub rbx, rax
add rbx, 0x10000
cmp rbx, rdi
jae 0x1800458ad
nop dword [rax + rax]
cmp rbx, qword [section..data]
jb 0x18004581e
cmp rbx, qword [0x180082008]
ja 0x18004581e
add rbx, 0x8000000
jmp 0x1800458a4
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800458ad
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x180045889
cmp rcx, 0x10000
jb 0x180045889
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1800458af
add rbx, 0x10000
jmp 0x1800458a4
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x1800458a4
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x180045800
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1800458c0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
lea rdi, [rcx - 0x7ff80000]
mov rbx, rcx
cmp rcx, 0x7ff80000
ja 0x1800458e2
mov edi, 0x80000
mov qword [rsp + 0x38], rsi
lea rsi, [rcx + 0x7ff80000]
cmp rbx, 0xffffffff80000000
jb 0x1800458fe
mov rsi, 0xfffffffffff80000
movzx eax, byte [rcx]
cmp al, 0xff
jne 0x180045915
cmp byte [rcx + 1], 0x25
jne 0x180045959
movsxd rcx, dword [rcx + 2]
add rcx, 6
jmp 0x180045921
cmp al, 0xe9
jne 0x180045959
movsxd rcx, dword [rcx + 1]
add rcx, 5
add rcx, rbx
cmp rcx, rbx
jae 0x180045944
cmp rcx, 0xffffffff80000000
jae 0x18004593b
lea rsi, [rcx + 0x7ff80000]
jmp 0x180045959
mov rsi, 0xfffffffffff80000
jmp 0x180045959
lea rdi, [rcx - 0x7ff80000]
cmp rcx, 0x7ff80000
ja 0x180045959
mov edi, 0x80000
mov rdx, qword [0x180082318]
mov rax, qword [0x180082310]
mov qword [rsp + 0x30], rbp
test rdx, rdx
jne 0x180045980
test rax, rax
je 0x180045997
mov rdx, rax
mov qword [0x180082318], rax
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x180045997
cmp rcx, rdi
jb 0x180045997
cmp rcx, rsi
jbe 0x180045aea
mov qword [0x180082318], rax
mov rdx, rax
test rax, rax
je 0x1800459e2
mov rcx, rax
nop dword [rax]
test rax, rax
je 0x1800459cc
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1800459cc
cmp rax, rdi
jb 0x1800459cc
cmp rax, rsi
jbe 0x180045aea
mov rdx, qword [rdx + 8]
mov qword [0x180082318], rdx
mov rcx, rdx
mov rax, rdx
test rdx, rdx
jne 0x1800459b0
movzx eax, bx
sub rbx, rax
cmp rbx, 0x40000000
jbe 0x180045a0c
lea rdx, [rbx - 0x40000000]
mov rcx, rdi
call fcn.1800456e0
mov rdx, rax
test rax, rax
jne 0x180045a98
movabs rbp, 0xffffffff40000000
cmp rbx, rbp
jae 0x180045a32
lea rcx, [rbx + 0x40000000]
mov rdx, rsi
call fcn.1800457d0
mov rdx, rax
test rax, rax
jne 0x180045a98
cmp rbx, 0x40000000
jbe 0x180045a52
lea rcx, [rbx - 0x40000000]
mov rdx, rbx
call fcn.1800457d0
mov rdx, rax
test rax, rax
jne 0x180045a98
cmp rbx, rbp
jae 0x180045a6e
lea rdx, [rbx + 0x40000000]
mov rcx, rbx
call fcn.1800456e0
mov rdx, rax
test rax, rax
jne 0x180045a98
mov rdx, rbx
mov rcx, rdi
call fcn.1800456e0
mov rdx, rax
test rax, rax
jne 0x180045a98
mov rdx, rsi
mov rcx, rbx
call fcn.1800457d0
mov rdx, rax
test rax, rax
je 0x180045b21
mov dword [rdx], 0x52727464
lea rcx, [rdx + 0xffa8]
xor r8d, r8d
mov qword [0x180082318], rdx
mov qword [rdx + 0x10], r8
mov r9d, 0x2a7
mov rax, qword [0x180082310]
mov qword [rdx + 8], rax
lea rax, [rdx + 0xff60]
mov qword [0x180082310], rdx
mov qword [rcx], r8
lea rcx, [rcx - 0x60]
mov r8, rax
sub rax, 0x60
sub r9, 1
jne 0x180045ad2
mov qword [rdx + 0x10], r8
mov rax, qword [rdx + 0x10]
cmp rax, rdi
jb 0x180045b21
cmp rax, rsi
ja 0x180045b21
mov rcx, qword [rax + 0x48]
movdqa xmm0, xmmword [0x18004a630]
mov qword [rdx + 0x10], rcx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
jmp 0x180045b23
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180045d80
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x180045dae
xor al, al
jmp 0x180045df0
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x180045dbf
xor al, al
jmp 0x180045df0
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x180045de6
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x180045de6
mov al, 1
jmp 0x180045df0
xor al, al
add rsp, 0x50
pop rbx
ret
add rsp, 0x50
pop rbx
ret
Function at 0x1800462d0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
cmp dword [0x180082328], 0
jne 0x180046377
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x180082328], ecx
jne 0x180046377
mov qword [rsp + 0x38], rbx
mov rbx, qword [0x180082310]
mov qword [rsp + 0x20], rdi
xor edi, edi
mov qword [0x180082340], rdi
mov qword [0x180082338], rdi
mov qword [0x180082330], rdi
test rbx, rbx
je 0x180046360
nop word [rax + rax]
lea r9, [rsp + 0x30]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180046358
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x180046330
jmp 0x180046360
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov dword [0x18008232c], edi
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, 0x10dd
add rsp, 0x28
ret
Function at 0x180046990
Capabilities:
Suspend thread

Disassembly:
push rdi
sub rsp, 0x20
mov eax, dword [0x18008232c]
mov rdi, rcx
test eax, eax
jne 0x180046a33
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
jne 0x1800469ba
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov ecx, 0x10
mov qword [rsp + 0x30], rbx
call fcn.180047780
mov rbx, rax
test rax, rax
jne 0x1800469d6
lea edi, [rax + 8]
jmp 0x1800469f9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x180046a17
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov edx, 0x10
mov rcx, rbx
call fcn.180047b44
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov dword [0x18008232c], edi
mov qword [0x180082330], 0
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x180082338]
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 8], rdi
mov qword [0x180082338], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180046b10
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r10, rcx
test rcx, rcx
jne 0x180046b2b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r10, rax
mov eax, 0x5a4d
cmp word [r10], ax
je 0x180046b48
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180046c20
movsxd rbx, dword [r10 + 0x3c]
add rbx, r10
cmp dword [rbx], 0x4550
je 0x180046b69
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180046c20
movzx eax, word [rbx + 0x14]
test ax, ax
jne 0x180046b84
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180046c20
lea r11, [rbx + rax]
xor edx, edx
lea rdi, str..detour
mov dword [rsp + 0x20], edx
movzx eax, word [rbx + 6]
cmp edx, eax
jae 0x180046c04
lea rcx, [rdx + rdx*4]
lea r8, [rcx*8]
lea r9, [r8 + r11]
xor ecx, ecx
nop
movzx eax, byte [r9 + rcx + 0x18]
inc rcx
cmp al, byte [rdi + rcx - 1]
jne 0x180046c00
cmp rcx, 8
jne 0x180046bb0
mov eax, dword [r11 + r8 + 0x24]
test eax, eax
je 0x180046c04
cmp dword [r11 + r8 + 0x28], 0
je 0x180046c04
lea rbx, [r10 + rax]
mov eax, dword [rbx]
cmp eax, 0x40
jb 0x180046c04
cmp dword [rbx + 4], 0x727444
jne 0x180046c04
cmp dword [rbx + 8], 0
jne 0x180046bf3
mov dword [rbx + 8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
jmp 0x180046c20
inc edx
jmp 0x180046b91
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180046c20
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180046c30
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
lea rbx, [rcx + 0x10000]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
mov edi, 0x5a4d
nop dword [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180046c84
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
cmp dword [rsp + 0x40], 0x1000
jne 0x180046cc7
mov eax, dword [rsp + 0x44]
cmp al, 1
je 0x180046cc7
bt eax, 8
jb 0x180046cc7
cmp word [rbx], di
jne 0x180046cc0
mov eax, dword [rbx + 0x3c]
cmp rax, qword [rsp + 0x38]
ja 0x180046cc0
cmp eax, 0x40
jb 0x180046cc0
cdqe
cmp dword [rax + rbx], 0x4550
jne 0x180046cc7
mov rax, rbx
jmp 0x180046c79
jmp 0x180046cc7
mov rbx, qword [rsp + 0x38]
add rbx, qword [rsp + 0x20]
jmp 0x180046c60
Function at 0x1409be630
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1409be7b7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1409be661
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409be647
add dl, dl
jne 0x1409be66e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409be6ce
xor eax, eax
add dl, dl
jne 0x1409be67d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409be785
add dl, dl
jne 0x1409be68e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409be69b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409be6a8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409be6b5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409be6c2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1409be656
mov eax, 1
add dl, dl
jne 0x1409be6de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409be6eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409be6d3
sub eax, ebx
mov ebx, 1
jne 0x1409be724
mov ecx, 1
add dl, dl
jne 0x1409be706
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409be713
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409be6fb
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409be656
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1409be740
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409be74d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409be735
cmp eax, 0x7d00
jae 0x1409be773
cmp eax, 0x500
jb 0x1409be76e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409be656
cmp eax, 0x7f
ja 0x1409be776
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409be656
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409be7aa
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1409be656
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140004af8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004b42
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004b42
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004b42
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004b42
cmp dword [rcx + 0x84], 0xe
jbe 0x140004b42
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004b44
xor al, al
add rsp, 0x28
ret
Function at 0x1800143d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rcx + 0x10]
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov ebx, dword [rax + r11 + 0x88]
add rbx, r11
cmp rbx, r11
je 0x18001448b
mov r10d, dword [rbx + 0x18]
xor r9d, r9d
test r10d, r10d
je 0x18001448b
mov r8d, dword [rbx + 0x20]
add r8, r11
nop dword [rax + rax]
mov eax, dword [r8]
mov edx, 0x811c9dc5
add rax, r11
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x18001447f
nop word [rax + rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x180014460
cmp edx, 0xaf07e45d
je 0x180014490
inc r9d
add r8, 4
cmp r9d, r10d
jb 0x180014440
mov rdi, qword [rdi]
jmp 0x180014410
mov eax, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x1c]
add rax, r11
mov r8, qword [rsp + 0x50]
add rcx, r11
movzx edx, word [rax + r9*2]
mov r9, qword [rsp + 0x20]
mov r10d, dword [rcx + rdx*4]
mov edx, 0x200
add r10, r11
lea rcx, [0x180318c00]
call r10
lea rax, [0x180318c00]
add rsp, 0x38
pop rdi
pop rbx
ret

Function at 0x180015b40
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
test rcx, rcx
jne 0x180015b4d
xor eax, eax
jmp 0x180015bc6
mov r9, qword [rcx]
test r9, r9
jne 0x180015b59
xor eax, eax
jmp 0x180015bc6
mov r9, qword [r9 + 0x10]
test r9, r9
jne 0x180015b66
xor eax, eax
jmp 0x180015bc6
mov r10, r9
mov qword [rsp + 8], r9
xor edx, edx
mov r8d, 0xffffffff
lea r11, [0x1801688c0]
mov dword [rsp], edx
mov ecx, r8d
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x180015b90
cmp edx, eax
jae 0x180015bbc
movsx eax, byte [r10]
xor rax, rcx
movzx ecx, al
shr r8d, 8
xor r8d, dword [r11 + rcx*4]
inc r10
mov qword [rsp + 8], r10
inc edx
jmp 0x180015b7d
not r8d
mov eax, r8d
jmp 0x180015bc6
add rsp, 0x18
ret

Function at 0x180015e30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test rcx, rcx
je 0x180015e90
mov r8, qword [rcx]
test r8, r8
je 0x180015e90
mov r8, qword [r8 + 0x10]
mov eax, 0xffffffff
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [r8 + rcx], 0
jne 0x180015e50
test ecx, ecx
je 0x180015e8d
mov r9d, ecx
lea r10, [0x1801688c0]
nop dword [rax + rax]
movsx edx, byte [r8]
lea r8, [r8 + 1]
mov ecx, eax
shr eax, 8
xor rdx, rcx
movzx ecx, dl
xor eax, dword [r10 + rcx*4]
sub r9, 1
jne 0x180015e70
not eax
ret
xor eax, eax
ret
Function at 0x180017c20
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x180318107], 0
mov rbx, rcx
je 0x180017c88
mov ecx, dword [0x180318210]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180017c88
lea rcx, [rbx + 0xb0]
cmp rcx, 0x40000
jbe 0x180017c88
lea rax, [rcx + 8]
movabs rdx, 0x7fffffff0000
cmp rax, rdx
jae 0x180017c88
mov rcx, qword [rcx]
add rcx, 0x1fc
cmp rcx, 0x40000
jbe 0x180017c88
lea rax, [rcx + 4]
cmp rax, rdx
jae 0x180017c88
mov dword [rcx], 0x3c23d70a
add rsp, 0x20
pop rbx
ret
Function at 0x180024790
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
cmp byte [0x180318239], 0
jne 0x1800247f0
lea rcx, [rsp + 0x30]
mov byte [0x180318239], 1
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm0, xmm0
xorps xmm1, xmm1
cvtsi2ss xmm0, qword [rsp + 0x38]
cvtsi2ss xmm1, qword [rsp + 0x30]
movss dword [0x18031823c], xmm0
movss dword [0x1803182f4], xmm1
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rsp + 0x30]
subss xmm0, dword [0x1803182f4]
divss xmm0, dword [0x18031823c]
add rsp, 0x28
ret
Function at 0x180028af0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x70
call fcn.180018870
mov rcx, rax
call fcn.180018780
mov rbx, rax
test rax, rax
je 0x180028cba
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.180017a70
cmp dword [rsp + 0x20], 0
je 0x180028cba
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x180028cba
cmp eax, 0xfffffffe
jne 0x180028bcc
mov rcx, rbx
call fcn.180017c90
cmp byte [0x1803180ec], 0
je 0x180028cba
add rbx, 0xb0
cmp rbx, 0x40000
jbe 0x180028cba
lea rax, [rbx + 8]
movabs rcx, 0x7fffffff0000
cmp rax, rcx
jae 0x180028cba
mov rdx, qword [rbx]
mov r8, rdx
lea r9, [rdx + 0x390]
cmp r9, 0x40000
jbe 0x180028b9f
lea rax, [r9 + 1]
cmp rax, rcx
jae 0x180028b9f
mov byte [r9], 1
lea rdx, [r8 + 0x394]
cmp rdx, 0x40000
jbe 0x180028cba
lea rax, [rdx + 4]
cmp rax, rcx
jae 0x180028cba
mov dword [rdx], 0x3f800000
add rsp, 0x70
pop rbx
ret
cmp eax, 3
jne 0x180028be6
mov rcx, rbx
call fcn.180017c90
mov rcx, rbx
add rsp, 0x70
pop rbx
jmp fcn.180017c20
cmp eax, 2
jne 0x180028c3f
mov rcx, rbx
call fcn.180017c90
mov rcx, rbx
call fcn.180017c20
cmp byte [0x1803180e6], 0
je 0x180028cba
add rbx, 0xb0
cmp rbx, 0x40000
jbe 0x180028cba
lea rax, [rbx + 8]
movabs rcx, 0x7fffffff0000
cmp rax, rcx
jae 0x180028cba
mov rdx, qword [rbx]
add rdx, 0x290
jmp 0x180028ca5
cmp eax, 0xffffffff
jne 0x180028cba
mov rcx, rbx
call fcn.180017c90
cmp byte [0x1803180f7], 0
je 0x180028cba
add rbx, 0xb0
cmp rbx, 0x40000
jbe 0x180028cba
lea rax, [rbx + 8]
movabs rcx, 0x7fffffff0000
cmp rax, rcx
jae 0x180028cba
mov rdx, qword [rbx]
mov r8, rdx
lea r9, [rdx + 0x390]
cmp r9, 0x40000
jbe 0x180028c9e
lea rax, [r9 + 4]
cmp rax, rcx
jae 0x180028c9e
mov dword [r9], 0x3f800000
lea rdx, [r8 + 0x3a0]
cmp rdx, 0x40000
jbe 0x180028cba
lea rax, [rdx + 1]
cmp rax, rcx
jae 0x180028cba
mov byte [rdx], 1
add rsp, 0x70
pop rbx
ret
Function at 0x18002ba50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18002bac8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x18002bac8
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x18002bab5
nop
cmp rbx, rcx
jae 0x18002bac8
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x18002baa0
cmp rbx, rcx
jae 0x18002bac8
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x18002baca
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180047ae0
Capabilities:
Delete file

Disassembly:
sub rsp, 0xa8
movdqa xmm1, xmmword [0x1802a31e0]
xorps xmm0, xmm0
mov r8, qword [0x180316590]
mov rcx, 0xffffffffffffffff
movups xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x40], 0
movdqu xmmword [rsp + 0x50], xmm1
inc rcx
cmp byte [rdx + rcx], 0
jne 0x180047b10
movabs rax, 0x7fffffffffffffff
sub rax, r8
cmp rax, rcx
jb 0x180047cdb
cmp qword [0x180316598], 0x10
lea r9, [0x180316580]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x60]
cmovae r9, qword [0x180316580]
movaps xmmword [rsp + 0x90], xmm6
mov qword [rsp + 0x28], rdx
movaps xmmword [rsp + 0x80], xmm7
mov qword [rsp + 0x20], r8
call fcn.180063be0
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x180047bb0
lea rax, [rcx + 4]
cmp rdx, 0x10
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
cmovae rax, qword [rsp + 0x60]
mov dword [rax + rcx], 0x696e692e
mov byte [rax + rcx + 4], 0
lea rax, [rsp + 0x60]
jmp 0x180047bcf
lea r9, str..ini
mov qword [rsp + 0x20], 4
mov edx, 4
lea rcx, [rsp + 0x60]
call fcn.180062e00
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180047c22
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180047c1d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180047c60
call fcn.180110640
mov rdx, qword [rsp + 0x78]
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
cmp rdx, 0x10
jb 0x180047c6c
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180047c67
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180047c67
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180110640
cmp qword [rsp + 0x58], 0x10
lea rcx, [rsp + 0x40]
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180047cc3
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180047cbe
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180047cbe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180110640
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0x80]
add rsp, 0xa8
ret
call fcn.180007650
int3