joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459840
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4598ef
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00459940]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00461400
xorps xmm15, xmm15
mov r14, qword [0x005f8db8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00461520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00459840
Function at 0x463320
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x404343
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.0040a0e0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x404320
cmp byte [0x005f8bad], 0
je 0x463335
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x460560
jmp 0x404320

Function at 0x463340
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005f8ea0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005f8bad], 0
je 0x463375
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005f91c0]
aesenc xmm0, xmmword [0x005f91d0]
aesenc xmm0, xmmword [0x005f91e0]
movq rax, xmm0
ret
jmp 0x40a300

Function at 0x463380
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005f8ea0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005f8bad], 0
je 0x4633b6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005f91c0]
aesenc xmm0, xmmword [0x005f91d0]
aesenc xmm0, xmmword [0x005f91e0]
movq rax, xmm0
ret
jmp 0x40a360

Function at 0x465140
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x465174
mov rcx, 0x28
jmp 0x46517f
shl rcx, 3
add rcx, 0x1480
mov qword [0x005f8db8], rcx
pop rbp
ret

Function at 0x46d270
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x46d2ea
mov rax, 0
nop word [rax + rax]
nop dword [rax]
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x46d2a0
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x46d2c0
cmp rdx, 0
je 0x46d30c
test rdx, 0xf
je 0x46d28d
test rdx, 7
jne 0x46d2c0
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x46d28d
ret
Function at 0x47a900
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x47a93f
jb 0x47a954
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x47a9c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x47aa94
jb 0x47aaf3
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.0047a8a0
aeskeygenassist xmm1, xmm0, 1
call fcn.0047a8c0
aeskeygenassist xmm1, xmm2, 2
call fcn.0047a8a0
aeskeygenassist xmm1, xmm0, 2
call fcn.0047a8c0
aeskeygenassist xmm1, xmm2, 4
call fcn.0047a8a0
aeskeygenassist xmm1, xmm0, 4
call fcn.0047a8c0
aeskeygenassist xmm1, xmm2, 8
call fcn.0047a8a0
aeskeygenassist xmm1, xmm0, 8
call fcn.0047a8c0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0047a8a0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0047a8c0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0047a8a0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0047a8c0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0047a8a0
jmp 0x47ab61
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.0047a800
aeskeygenassist xmm1, xmm2, 2
call fcn.0047a860
aeskeygenassist xmm1, xmm2, 4
call fcn.0047a800
aeskeygenassist xmm1, xmm2, 8
call fcn.0047a860
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0047a800
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0047a860
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0047a800
aeskeygenassist xmm1, xmm2, 0x80
call fcn.0047a860
jmp 0x47ab61
aeskeygenassist xmm1, xmm0, 1
call fcn.0047a7c0
aeskeygenassist xmm1, xmm0, 2
call fcn.0047a7c0
aeskeygenassist xmm1, xmm0, 4
call fcn.0047a7c0
aeskeygenassist xmm1, xmm0, 8
call fcn.0047a7c0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0047a7c0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0047a7c0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.0047a7c0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.0047a7c0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.0047a7c0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.0047a7c0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x47ab6e
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x480a40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x480b0a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004038a0
xorps xmm15, xmm15
mov r14, qword [0x005f8db8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x480aef
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004acac0]
xor ebx, ebx
mov rcx, rdx
call fcn.00449c00
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00481580
inc rbx
cmp rcx, rbx
jae 0x480ade
mov edi, 1
lea rsi, [0x004acac0]
call fcn.00449ce0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004e9cb8]
lea rsi, [0x004e94c0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00480a40
Function at 0x14012f94c
Capabilities:
Write file on windows

Disassembly:
jmp 0x140326390
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140529702]
call fcn.1401357fc
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x1403263e7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1403264f3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14032648c
cmp qword [rbp + 0x28], 0
jle 0x14032648c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14032642c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140135171
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x1403264e2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x1403264e2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14012fe24
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x140384470
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x20]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1404efd40]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, str.libOSMesa.dll
mov qword [rsp + 0x38], rax
lea rax, str.OSMesa.dll
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
cmp qword [0x140505fc8], 0
je 0x1403844cb
mov eax, 1
jmp 0x14038464b
mov dword [rsp + 0x20], 0
jmp 0x1403844df
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp qword [rsp + rax*8 + 0x38], 0
je 0x140384511
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + rax*8 + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140505fc8], rax
cmp qword [0x140505fc8], 0
je 0x14038450f
jmp 0x140384511
jmp 0x1403844d5
cmp qword [0x140505fc8], 0
jne 0x140384533
lea rdx, str.OSMesa:_Library_not_found
mov ecx, 0x10006
call fcn.140132804
xor eax, eax
jmp 0x14038464b
lea rdx, str.OSMesaCreateContextExt
mov rcx, qword [0x140505fc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140505fd0], rax
lea rdx, str.OSMesaCreateContextAttribs
mov rcx, qword [0x140505fc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140505fd8], rax
lea rdx, str.OSMesaDestroyContext
mov rcx, qword [0x140505fc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140505fe0], rax
lea rdx, str.OSMesaMakeCurrent
mov rcx, qword [0x140505fc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140505fe8], rax
lea rdx, str.OSMesaGetColorBuffer
mov rcx, qword [0x140505fc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140505ff0], rax
lea rdx, str.OSMesaGetDepthBuffer
mov rcx, qword [0x140505fc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140505ff8], rax
lea rdx, str.OSMesaGetProcAddress
mov rcx, qword [0x140505fc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140506000], rax
cmp qword [0x140505fd0], 0
je 0x14038462c
cmp qword [0x140505fe0], 0
je 0x14038462c
cmp qword [0x140505fe8], 0
je 0x14038462c
cmp qword [0x140505ff0], 0
je 0x14038462c
cmp qword [0x140505ff8], 0
je 0x14038462c
cmp qword [0x140506000], 0
jne 0x140384646
lea rdx, str.OSMesa:_Failed_to_load_required_entry_points
mov ecx, 0x10008
call fcn.140132804
call fcn.14012fd7a
xor eax, eax
jmp 0x14038464b
mov eax, 1
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14042ae00]
call fcn.1401345d7
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14013220a
add rsp, 0x70
pop rdi
ret
Function at 0x140130437
Capabilities:
Create thread

Disassembly:
jmp 0x1402940f0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x1404efd40]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14052972b]
call fcn.1401357fc
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140130e19
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.140132372
nop
lea rax, [0x1401333a3]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14013356f
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x1402941ca
lea rcx, [rbp + 8]
call fcn.140131c5b
jmp 0x1402941e3
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.140130658
nop
lea rcx, [rbp + 8]
call fcn.140131aa3
lea rcx, [rbp - 0x30]
lea rdx, [0x1403fac20]
call fcn.1401345d7
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.14013220a
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x140130559
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1402e46f0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x1404efd40]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x1405296d5]
call fcn.1401357fc
xor edx, edx
mov ecx, 2
call fcn.140132110
mov qword [rbp + 8], rax
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rbp + 0x30], 0x238
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x1402e476b
xor eax, eax
jmp 0x1402e47cb
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140132ef8
test eax, eax
jne 0x1402e4780
xor eax, eax
jmp 0x1402e47cb
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1401348b1
test eax, eax
je 0x1402e47bf
mov rcx, qword [rbp + 0x420]
call fcn.140131323
mov rdx, rax
lea rcx, [rbp + 0x5c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x1402e47bd
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x38]
jmp 0x1402e47cb
jmp 0x1402e4780
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1403f1250]
call fcn.1401345d7
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.14013220a
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret
Function at 0x140130667
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x1402e5580
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0xa20
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1c0
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa48]
mov rax, qword [0x1404efd40]
xor rax, rbp
mov qword [rbp + 0x9f8], rax
lea rcx, [0x1405296d5]
call fcn.1401357fc
mov rax, qword [rbp + 0xa20]
mov qword [rax], 0
mov rax, qword [rbp + 0xa20]
mov qword [rax + 8], 0
mov rax, qword [rbp + 0xa20]
mov qword [rax + 0x10], 0
mov edx, dword [rbp + 0xa28]
mov ecx, 0x18
call fcn.140132110
mov qword [rbp + 0x38], rax
cmp qword [rbp + 0x38], 0xffffffffffffffff
jne 0x1402e565c
mov r9, qword [rbp + 0xa30]
lea r8, str.Failed_to_get__s__invalid_handle_value
mov edx, 0xff
lea rcx, [rbp + 0x60]
call fcn.140130ca7
mov r9d, 0x10
lea r8, str.ERROR
lea rdx, [rbp + 0x60]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rax, qword [rbp + 0xa20]
jmp 0x1402e56fa
mov dword [rbp + 0x280], 0x438
lea rdx, [rbp + 0x280]
mov rcx, qword [rbp + 0x38]
call fcn.14013306a
test eax, eax
je 0x1402e56e9
mov rdx, qword [rbp + 0xa30]
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x1402e56d5
mov rax, qword [rbp + 0x298]
mov qword [rbp + 0x9d8], rax
mov rax, qword [rbp + 0x2a8]
mov qword [rbp + 0x9e0], rax
mov eax, dword [rbp + 0x2a0]
mov qword [rbp + 0x9e8], rax
lea rax, [rbp + 0x9d8]
mov rdi, qword [rbp + 0xa20]
mov rsi, rax
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
jmp 0x1402e56e9
lea rdx, [rbp + 0x280]
mov rcx, qword [rbp + 0x38]
call fcn.14012ff0a
test eax, eax
jne 0x1402e567a
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0xa20]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1403f11b0]
call fcn.1401345d7
mov rax, rdi
mov rcx, qword [rbp + 0x9f8]
xor rcx, rbp
call fcn.14013220a
lea rsp, [rbp + 0xa00]
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401316ac
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x1402ed190
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1405296ec]
call fcn.1401357fc
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rbp + 8], rax
mov rax, qword [0x1404fae68]
cmp qword [rbp + 8], rax
je 0x1402ed1e3
mov rax, qword [0x1404fae70]
cmp qword [rbp + 8], rax
je 0x1402ed1e3
xor edx, edx
mov rcx, qword [0x1404fae70]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1402ed270
mov edx, 5
mov rcx, qword [0x1404fae70]
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x1404fae38]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1402ed270
movzx eax, byte [0x140462bc9]
test eax, eax
jne 0x1402ed220
mov dword [rbp + 0xd4], 1
jmp 0x1402ed22a
mov dword [rbp + 0xd4], 0
movzx eax, byte [rbp + 0xd4]
mov byte [0x140462bc9], al
movzx eax, byte [0x140462bc9]
test eax, eax
jne 0x1402ed24e
mov dword [rbp + 0xd4], 1
jmp 0x1402ed258
mov dword [rbp + 0xd4], 0
mov r8d, dword [rbp + 0xd4]
mov edx, 0x2000d
mov rcx, qword [0x1404faee8]
call fcn.14013614d
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140131c74
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x14037ea40
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
cmp dword [rax], 1
je 0x14037ea75
mov r8d, 0x46
lea rdx, [0x1404e95b0]
lea rcx, str.tls__win32.allocated__GLFW_TRUE
call qword [sym.imp.ucrtbased.dll__wassert]
xor eax, eax
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x20
pop rdi
ret

Function at 0x140131eea
Capabilities:
Log keystrokes

Disassembly:
jmp 0x140378e80
push rdi
sub rsp, 0x220
lea rdi, [rsp + 0x40]
mov ecx, 0x78
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1404efd40]
xor rax, rsp
mov qword [rsp + 0x210], rax
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov r8d, 0x6d1
xor edx, edx
lea rcx, [0x140505672]
call fcn.140133dc6
mov dword [rsp + 0x40], 0x20
jmp 0x140378ee5
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x15c
jg 0x1403790e9
movsxd rax, dword [rsp + 0x40]
lea rcx, [0x1405053b8]
movsx eax, word [rcx + rax*2]
mov dword [rsp + 0x168], eax
cmp dword [rsp + 0x168], 0xffffffff
jne 0x140378f16
jmp 0x140378edb
cmp dword [rsp + 0x40], 0x140
jl 0x140378ff2
cmp dword [rsp + 0x40], 0x14e
jg 0x140378ff2
mov dword [rsp + 0x1b8], 0x60
mov dword [rsp + 0x1bc], 0x61
mov dword [rsp + 0x1c0], 0x62
mov dword [rsp + 0x1c4], 0x63
mov dword [rsp + 0x1c8], 0x64
mov dword [rsp + 0x1cc], 0x65
mov dword [rsp + 0x1d0], 0x66
mov dword [rsp + 0x1d4], 0x67
mov dword [rsp + 0x1d8], 0x68
mov dword [rsp + 0x1dc], 0x69
mov dword [rsp + 0x1e0], 0x6e
mov dword [rsp + 0x1e4], 0x6f
mov dword [rsp + 0x1e8], 0x6a
mov dword [rsp + 0x1ec], 0x6d
mov dword [rsp + 0x1f0], 0x6b
mov eax, dword [rsp + 0x40]
sub eax, 0x140
cdqe
mov eax, dword [rsp + rax*4 + 0x1b8]
mov dword [rsp + 0x164], eax
jmp 0x14037900b
mov edx, 1
mov ecx, dword [rsp + 0x168]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [rsp + 0x164], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x168]
mov ecx, dword [rsp + 0x164]
call qword [sym.imp.USER32.dll_ToUnicode]
mov dword [rsp + 0x16c], eax
cmp dword [rsp + 0x16c], 0xffffffff
jne 0x140379085
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x168]
mov ecx, dword [rsp + 0x164]
call qword [sym.imp.USER32.dll_ToUnicode]
mov dword [rsp + 0x16c], eax
cmp dword [rsp + 0x16c], 1
jge 0x140379094
jmp 0x140378edb
movsxd rax, dword [rsp + 0x40]
imul rax, rax, 5
lea rcx, [0x140505672]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [rsp + 0x178]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x140378edb
mov rcx, rsp
lea rdx, [0x140429580]
call fcn.1401345d7
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.14013220a
add rsp, 0x220
pop rdi
ret