joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180053010
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x18006e040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov r14d, edx
mov rbx, rcx
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
xor edx, edx
mov ebp, r8d
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18005313b
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x180053132
nop dword [rax]
cmp dword [rsp + 0x20], 0x10
jb 0x180053114
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180053114
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180053114
mov rdx, qword [rbx]
test rdx, rdx
jne 0x1800530d2
mov rcx, qword [0x18006edb0]
mov r8d, 0x200
mov dword [rbx + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x180053132
jmp 0x180053107
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x180053107
mov rcx, qword [0x18006edb0]
lea r9d, [rax + rax]
mov r8, rdx
shl r9, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x180053132
mov eax, dword [rbx + 8]
add eax, eax
mov qword [rbx], rdx
mov dword [rbx + 8], eax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180053080
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], rsi
je 0x180053193
cmp dword [rbx + 0xc], esi
jbe 0x180053193
nop word [rax + rax]
mov r8, qword [rbx]
xor edx, edx
mov eax, esi
lea ecx, [rdx + 0x5a]
mov r8d, dword [r8 + rax*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18005318c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.180052e60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [rbx + 0xc]
jb 0x180053150
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180059ba0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1800531c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x18006e040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x1800705f0]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180053233
mov eax, 0xa
jmp 0x1800532c6
test esi, esi
je 0x180053255
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180053278
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180053278
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180053271
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180053278
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180059ba0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1800532f0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, ecx
mov ecx, dword [0x1800705fc]
mov ebx, edi
test ecx, ecx
je 0x18005342b
mov rax, qword [0x1800705f0]
add rax, 0x20
nop
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x180053348
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180053320
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x18005342b
mov r8d, edi
lea rcx, [rsp + 0x20]
test esi, esi
mov edx, 0xffffffff
setne r8b
call fcn.180053010
mov r8d, dword [0x1800705fc]
cmp ebx, r8d
jae 0x1800533b8
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x1800705f0]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x1800533b1
mov edx, esi
mov ecx, ebx
call fcn.1800531c0
mov edi, eax
test eax, eax
jne 0x1800533b8
mov r8d, dword [0x1800705fc]
inc ebx
cmp ebx, r8d
jb 0x180053380
cmp qword [rsp + 0x20], 0
je 0x18005342b
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180053417
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180053408
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x1800533e0
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x18006edb0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800537a0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x18006eda8], ebp
je 0x1800537f7
cmp rbx, 0x20
jae 0x1800537e0
xor ecx, ecx
jmp 0x1800537e2
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x18006eda8], ebp
jne 0x1800537d6
cmp qword [0x18006edb0], r15
je 0x1800538f1
test rdi, rdi
jne 0x180053817
mov ecx, esi
call fcn.1800532f0
mov ebp, eax
jmp 0x1800538f6
mov ecx, dword [0x1800705fc]
mov ebx, r15d
test ecx, ecx
je 0x18005383f
mov r8, qword [0x1800705f0]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x180053849
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180053830
mov ebp, 4
jmp 0x1800538f6
cmp ebx, 0xffffffff
je 0x18005383f
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x1800538e8
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.180053010
mov edx, esi
mov ecx, ebx
call fcn.1800531c0
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x1800538f6
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800538d2
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x1800538c8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x1800538a0
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x18006edb0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800538f6
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x1800538f6
mov ebp, 2
xchg dword [0x18006eda8], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x180054130
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [0x180070310]
mov qword [rsp + 0x80], rdi
xor ebx, ebx
mov qword [0x180070310], rbx
mov qword [0x180070318], rbx
lea ecx, [rbx + 0x60]
call fcn.18005a040
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x180070310], rax
xorps xmm0, xmm0
movups xmmword [0x180070320], xmm0
mov qword [0x180070330], rbx
mov qword [0x180070338], rbx
lea r8d, [rbx + 0x4d]
lea rdx, str.Mozilla_5.0__Windows_NT_6.1__Win64__x64__rv:89.0__Gecko_20100101_Firefox_89.0
lea rcx, [0x180070320]
call fcn.1800097e0
nop
xorps xmm0, xmm0
movups xmmword [0x180070340], xmm0
mov qword [0x180070350], rbx
mov qword [0x180070358], 0xf
mov byte [0x180070340], bl
movups xmmword [0x180070360], xmm0
mov qword [0x180070370], rbx
mov qword [0x180070378], 0xf
mov byte [0x180070360], bl
movups xmmword [0x180070380], xmm0
mov qword [0x180070390], rbx
mov qword [0x180070398], 0xf
mov byte [0x180070380], bl
movups xmmword [0x1800703a0], xmm0
mov qword [0x1800703b0], rbx
mov qword [0x1800703b8], 0xf
mov byte [0x1800703a0], bl
movups xmmword [0x1800703c0], xmm0
mov qword [0x1800703d0], rbx
mov qword [0x1800703d8], 0xf
mov byte [0x1800703c0], bl
movups xmmword [0x1800703e0], xmm0
mov qword [0x1800703f0], rbx
mov qword [0x1800703f8], rbx
lea r8d, [rbx + 3]
lea rdx, [0x180063b20]
lea rcx, [0x1800703e0]
call fcn.1800097e0
nop
xorps xmm0, xmm0
movups xmmword [0x180070400], xmm0
mov qword [0x180070410], rbx
mov qword [0x180070418], 0xf
mov byte [0x180070400], bl
movups xmmword [0x180070420], xmm0
mov qword [0x180070430], rbx
mov qword [0x180070438], rbx
lea r8d, [rbx + 0xf]
lea rdx, str.www.example.com
lea rcx, [0x180070420]
call fcn.1800097e0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x40], xmm1
xor r8d, r8d
lea rdx, [0x180061a43]
lea rcx, [rsp + 0x30]
call fcn.1800097e0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x60], xmm1
xor r8d, r8d
lea rdx, [0x180061a43]
lea rcx, [rsp + 0x50]
call fcn.1800097e0
nop
lea rcx, [0x180070440]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
call fcn.1800081e0
nop
lea r9, [fcn.180005720]
lea edx, [rbx + 0x40]
lea r8d, [rbx + 1]
lea rcx, [rsp + 0x30]
call fcn.18005a07c
mov qword [0x180070450], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x1800123c0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x24]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0xe0]
call fcn.18000ab10
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0xe0]
call fcn.18000a7b0
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x80], rax
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0xb0]
call fcn.180009830
lea rcx, [rsp + 0xb0]
call fcn.18000a830
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov rax, qword [rsp + 0x30]
add rax, 0x10
mov ecx, 8
imul rcx, rcx, 0
mov qword [rsp + rcx + 0x40], rax
mov rax, qword [rsp + 0x30]
add rax, 0x20
mov ecx, 8
imul rcx, rcx, 1
mov qword [rsp + rcx + 0x40], rax
mov rax, qword [rsp + 0x30]
add rax, 0x30
mov ecx, 8
imul rcx, rcx, 2
mov qword [rsp + rcx + 0x40], rax
mov dword [rsp + 0x20], 0
jmp 0x1800124ef
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 3
jge 0x18001259e
movsxd rax, dword [rsp + 0x20]
mov rax, qword [rsp + rax*8 + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
jmp 0x18001251b
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
movsxd rax, dword [rsp + 0x20]
mov rax, qword [rsp + rax*8 + 0x40]
cmp qword [rsp + 0x28], rax
je 0x180012599
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x10
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x88]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x60]
call fcn.18000a890
test eax, eax
jne 0x180012594
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0xb0]
call fcn.18000a540
mov rcx, qword [rsp + 0xe0]
call fcn.18000a460
mov rax, qword [rsp + 0x90]
jmp 0x1800125cc
jmp 0x18001250e
jmp 0x1800124e5
mov qword [rsp + 0x98], 0
lea rcx, [rsp + 0xb0]
call fcn.18000a540
mov rcx, qword [rsp + 0xe0]
call fcn.18000a460
mov rax, qword [rsp + 0x98]
add rsp, 0xd8
ret
Function at 0x18002c880
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1801451b0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x18002c90e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x18002c8b2
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x18002c920
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1801451b0]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x18002ca24
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x18002ca1f
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x18002c9f4
cmp qword [rsp + 0x38], 2
jb 0x18002c9f4
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18002c9f4
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18002c9f4
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x18002c967
jmp 0x18002cab6
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x18002cab6
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x18002ca8c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18002ca8c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18002ca8c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x18002ca24
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x180062320
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
movss xmm0, dword [rsp + 0x78]
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rsp + 0x7c]
movss dword [rsp + 0x34], xmm0
movss xmm0, dword [rsp + 0x80]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x84]
movss dword [rsp + 0x3c], xmm0
movzx eax, byte [rsp + 0x88]
test eax, eax
je 0x1800623fb
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
mov rdi, rax
lea rsi, [rcx + 0x88]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
movss xmm0, dword [rsp + 0x40]
comiss xmm0, dword [rsp + 0x30]
jbe 0x1800623b0
movss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rsp + 0x44]
comiss xmm0, dword [rsp + 0x34]
jbe 0x1800623c9
movss xmm0, dword [rsp + 0x44]
movss dword [rsp + 0x34], xmm0
movss xmm0, dword [rsp + 0x38]
comiss xmm0, dword [rsp + 0x48]
jbe 0x1800623e2
movss xmm0, dword [rsp + 0x48]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x3c]
comiss xmm0, dword [rsp + 0x4c]
jbe 0x1800623fb
movss xmm0, dword [rsp + 0x4c]
movss dword [rsp + 0x3c], xmm0
movss xmm0, dword [rsp + 0x30]
comiss xmm0, dword [rsp + 0x38]
jb 0x180062416
movss xmm0, dword [rsp + 0x30]
movss dword [rsp + 0x20], xmm0
jmp 0x180062422
movss xmm0, dword [rsp + 0x38]
movss dword [rsp + 0x20], xmm0
movss xmm0, dword [rsp + 0x20]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x34]
comiss xmm0, dword [rsp + 0x3c]
jb 0x180062449
movss xmm0, dword [rsp + 0x34]
movss dword [rsp + 0x24], xmm0
jmp 0x180062455
movss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x24], xmm0
movss xmm0, dword [rsp + 0x24]
movss dword [rsp + 0x3c], xmm0
mov rax, qword [rsp + 0x70]
add rax, 0x58
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.180070970
mov rax, qword [rsp + 0x70]
lea rcx, [rsp + 0x30]
lea rdi, [rax + 0x88]
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x70]
call fcn.18006c900
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x1800c63f0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x58
xor eax, eax
cmp rax, 0x34cbfe8
jne 0x1800c6409
mov qword [rsp + 0x28], 0
jmp 0x1800c6456
mov rax, qword [0x1802562d0]
mov rax, qword [rax + 0x34cbfe8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1800c642f
mov qword [rsp + 0x28], 0
jmp 0x1800c6456
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1800c644c
mov qword [rsp + 0x28], 0
jmp 0x1800c6456
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jbe 0x1800c6483
movabs rax, 0x7fffffffffffff
cmp qword [rsp + 0x40], rax
jae 0x1800c6483
mov dword [rsp + 0x20], 1
jmp 0x1800c648b
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1800c6496
jmp 0x1800c64ea
movzx eax, byte [0x18024b014]
test eax, eax
je 0x1800c64d1
mov ecx, 0x58
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1800c64d1
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0xb8]
movss xmm0, dword [0x18024b010]
movss dword [rax + 0x18], xmm0
jmp 0x1800c64ea
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0xb8]
movss xmm0, dword [0x18024b00c]
movss dword [rax + 0x18], xmm0
add rsp, 0x58
ret

Function at 0x1800c6580
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
call fcn.1800c63f0
movzx ecx, byte [0x18024e200]
call fcn.1800c61f0
movzx eax, byte [0x18024b015]
test eax, eax
je 0x1800c65af
call fcn.1800c6680
movzx eax, byte [0x18024b016]
test eax, eax
je 0x1800c65bf
call fcn.1800c64f0
movzx eax, byte [0x18024e201]
test eax, eax
je 0x1800c65cf
call fcn.1800c6260
movzx eax, byte [0x18024e202]
test eax, eax
je 0x1800c6677
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1800c6677
call fcn.180105990
cdq
mov ecx, 0x3e7
idiv ecx
mov eax, edx
sub eax, 0x3e7
cvtsi2ss xmm0, eax
movss xmm3, dword [0x180143e88]
movaps xmm2, xmm0
movss xmm1, dword [0x180143e88]
lea rcx, [rsp + 0x20]
call fcn.1800c5c00
mov rax, qword [0x180256630]
mov rax, qword [rax + 0x6a0]
movss xmm0, dword [rsp + 0x20]
movss dword [rax + 0x3c], xmm0
mov rax, qword [0x180256630]
mov rax, qword [rax + 0x6a0]
movss xmm0, dword [rsp + 0x24]
movss dword [rax + 0x40], xmm0
mov rax, qword [0x180256630]
mov rax, qword [rax + 0x6a0]
movss xmm0, dword [rsp + 0x28]
movss dword [rax + 0x44], xmm0
add rsp, 0x38
ret
Function at 0x1800ec8c8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x1800d8c12
movzx eax, byte [rcx + rdx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x1800d8bf5
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x1800d8be0
Function at 0x180118348
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180118378
xor eax, eax
jmp 0x18011843b
mov rbp, rbx
cmp word [rax], si
je 0x18011839d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180118384
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180118380
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1801162bc
movsxd r14, eax
test eax, eax
jne 0x1801183db
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180118371
mov rcx, r14
call fcn.1801117c4
mov rdi, rax
test rax, rax
jne 0x1801183f4
xor ecx, ecx
call fcn.1801102a8
jmp 0x1801183d0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1801162bc
test eax, eax
jne 0x180118425
mov rcx, rdi
call fcn.1801102a8
jmp 0x18011842f
xor ecx, ecx
call fcn.1801102a8
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x180118458
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1801184df
mov rsi, rbx
cmp word [rax], bp
je 0x18011849e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x180118488
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x180118484
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1801117c4
mov rdi, rax
test rax, rax
je 0x1801184cc
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1801217a0
mov rbp, rdi
xor ecx, ecx
call fcn.1801102a8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18011b184
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.18010e578
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x18011b225
cmp ebx, dword [rsp + 0x30]
je 0x18011b21e
test esi, esi
je 0x18011b21e
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x18011b1f9
sub r8w, 0x61
cmp r8w, 0x19
ja 0x18011b206
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x18011b1e3
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x18011b20a
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x18011b227
mov eax, 1
jmp 0x18011b227
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret