joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800b6960
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov r13, rdx
mov r12, rcx
je 0x1800b6a42
mov r15d, dword [rdx + 8]
cmp r15d, dword [rcx + 0x20]
jne 0x1800b69af
mov rdx, qword [rcx + 0x18]
mov r8d, r15d
mov rcx, qword [r13]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b6a42
mov r14, qword [r12 + 8]
xor esi, esi
dec r14
mov edx, 0x811c9dc5
mov ecx, esi
test r15, r15
je 0x1800b69e5
mov r8, qword [r13]
nop dword [rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r15
jb 0x1800b69d0
mov edi, edx
and rdi, r14
nop word [rax + rax]
mov rbx, rdi
shl rbx, 4
add rbx, qword [r12]
mov ebp, dword [rbx + 8]
cmp ebp, r15d
jne 0x1800b6a16
mov rdx, qword [r13]
mov r8d, ebp
mov rcx, qword [rbx]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b6a61
cmp ebp, dword [r12 + 0x20]
jne 0x1800b6a31
mov rdx, qword [r12 + 0x18]
mov r8, rbp
mov rcx, qword [rbx]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b6a42
inc rdi
add rdi, rsi
inc rsi
and rdi, r14
cmp rsi, r14
jbe 0x1800b69f0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rbx
jmp 0x1800b6a44

Function at 0x1800b7290
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, qword [rcx + 8]
xor esi, esi
mov r15d, dword [rdx + 8]
dec r14
mov r13, rdx
mov r12, rcx
mov r9d, 0x811c9dc5
mov r8d, esi
test r15, r15
je 0x1800b72e7
mov r10, qword [rdx]
movzx eax, byte [r10 + r8]
inc r8
xor eax, r9d
imul r9d, eax, 0x1000193
cmp r8, r15
jb 0x1800b72d0
mov edi, r9d
and rdi, r14
nop dword [rax]
mov rbx, rdi
shl rbx, 4
add rbx, qword [r12]
mov ebp, dword [rbx + 8]
cmp ebp, dword [r12 + 0x20]
jne 0x1800b7319
mov rdx, qword [r12 + 0x18]
mov r8d, ebp
mov rcx, qword [rbx]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b7361
cmp ebp, r15d
jne 0x1800b7331
mov rdx, qword [r13]
mov r8, rbp
mov rcx, qword [rbx]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b736e
inc rdi
add rdi, rsi
inc rsi
and rdi, r14
cmp rsi, r14
jbe 0x1800b72f0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movups xmm0, xmmword [r13]
movups xmmword [rbx], xmm0
inc qword [r12 + 0x10]
mov rax, rbx
jmp 0x1800b7344
Function at 0x1800b8ad0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
sub rsp, 0x98
movups xmm0, xmmword [rcx + 0x18]
mov qword [rax - 8], rbx
mov rbx, qword [rcx + 8]
mov qword [rax - 0x10], rbp
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x30], r13
mov r13, rcx
mov qword [rax - 0x40], r15
lea r15, [rcx + 0x18]
mov rdi, r15
movups xmmword [rax - 0x60], xmm0
test rbx, rbx
jne 0x1800b8b33
mov ecx, 0x100
mov ebx, 0x10
call fcn.1800b2e74
mov rsi, rax
mov qword [rsp + 0xa0], rax
mov ebp, ebx
mov qword [rsp + 0xa8], rbx
jmp 0x1800b8b73
xor esi, esi
xor ebp, ebp
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rbp
add rbx, rbx
je 0x1800b8b91
mov rcx, rbx
shl rcx, 4
call fcn.1800b2e74
mov qword [rsp + 0xa0], rax
mov rsi, rax
mov qword [rsp + 0xa8], rbx
mov rbp, rbx
test rbx, rbx
je 0x1800b8b91
mov rax, rsi
nop word [rax + rax]
lea rax, [rax + 0x10]
movups xmm0, xmmword [rdi]
movups xmmword [rax - 0x10], xmm0
sub rbx, 1
jne 0x1800b8b80
cmp qword [r13 + 8], 0
mov qword [rsp + 0xb8], 0
jbe 0x1800b8cea
xor ecx, ecx
mov qword [rsp + 0x70], r12
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0x60], r14
nop dword [rax]
mov r12, qword [r13]
add r12, rcx
mov r14d, dword [r12 + 8]
cmp r14d, dword [r15 + 8]
jne 0x1800b8be9
mov rdx, qword [r15]
mov r8d, r14d
mov rcx, qword [r12]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b8c9f
xor ecx, ecx
lea r15, [rbp - 1]
mov edx, 0x811c9dc5
test r14, r14
je 0x1800b8c15
mov r8, qword [r12]
nop dword [rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r14
jb 0x1800b8c00
mov edi, edx
and rdi, r15
xor ebp, ebp
nop dword [rax]
mov rbx, rdi
shl rbx, 4
add rbx, rsi
mov esi, dword [rbx + 8]
cmp esi, dword [rsp + 0x40]
jne 0x1800b8c47
mov rdx, qword [rsp + 0x38]
mov r8d, esi
mov rcx, qword [rbx]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b8c7a
cmp esi, r14d
jne 0x1800b8c5f
mov rdx, qword [r12]
mov r8, rsi
mov rcx, qword [rbx]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b8c86
inc rdi
add rdi, rbp
inc rbp
and rdi, r15
cmp rbp, r15
ja 0x1800b8c84
mov rsi, qword [rsp + 0xa0]
jmp 0x1800b8c20
movups xmm0, xmmword [r12]
movups xmmword [rbx], xmm0
jmp 0x1800b8c86
xor ebx, ebx
mov rax, qword [r13]
lea r15, [r13 + 0x18]
mov rcx, qword [rsp + 0xb0]
movups xmm0, xmmword [rcx + rax]
movups xmmword [rbx], xmm0
jmp 0x1800b8ca7
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xb8]
add rcx, 0x10
mov rsi, qword [rsp + 0xa0]
inc rdx
mov rbp, qword [rsp + 0xa8]
mov qword [rsp + 0xb8], rdx
mov qword [rsp + 0xb0], rcx
cmp rdx, qword [r13 + 8]
jb 0x1800b8bc0
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x70]
mov rcx, qword [r13]
mov rax, qword [rsp + 0xa8]
mov r15, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
mov qword [r13], rsi
mov rsi, qword [rsp + 0x80]
mov qword [r13 + 8], rax
mov r13, qword [rsp + 0x68]
test rcx, rcx
je 0x1800b8d2f
call fcn.1800b2eb0
add rsp, 0x98
ret
Function at 0x1800bc550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1800ee0f8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov r8b, 1
xor edx, edx
add rcx, 8
call fcn.1800b7570
xor ebp, ebp
mov ecx, dword [rax]
lea eax, [rcx - 0x11a]
test eax, 0xfffffffc
jne 0x1800bc73a
cmp ecx, 0x11c
je 0x1800bc73a
cmp byte [rbx + 1], 0
je 0x1800bc5f8
mov eax, dword [rbx + 0x28]
mov dword [rsp + 0x20], eax
movups xmm0, xmmword [rbx + 0x2c]
movups xmmword [rsp + 0x24], xmm0
lea rcx, [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
cmp rdx, qword [rbx + 0x98]
je 0x1800bc5ee
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdx], xmm0
mov eax, dword [rsp + 0x30]
mov dword [rdx + 0x10], eax
add qword [rbx + 0x90], 0x14
jmp 0x1800bc5f8
lea r8, [rsp + 0x20]
call fcn.1800b9e10
mov eax, dword [rbx + 0x28]
cmp eax, 0x11d
je 0x1800bc73a
cmp eax, 0x11a
jne 0x1800bc720
mov ecx, dword [rbx + 0x3c]
test ecx, ecx
je 0x1800bc720
mov r9, qword [rbx + 0x40]
cmp byte [r9], 0x21
jne 0x1800bc720
nop word [rax + rax]
lea edx, [rcx - 1]
movzx eax, byte [rdx + r9]
cmp al, 0x20
je 0x1800bc642
sub al, 9
cmp al, 4
ja 0x1800bc648
mov ecx, edx
test edx, edx
jne 0x1800bc630
movzx eax, byte [rbx + 0xb8]
mov byte [rsp + 0x38], al
movups xmm0, xmmword [rbx + 0x2c]
movups xmmword [rsp + 0x3c], xmm0
mov r8d, ecx
add r8, r9
lea rdx, [r9 + 1]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
cmp rdx, r8
je 0x1800bc69a
sub r8, rdx
lea rcx, [rsp + 0x50]
call fcn.1800111b0
movups xmm0, xmmword [rsp + 0x3c]
movzx eax, byte [rsp + 0x38]
mov rdx, qword [rbx + 0xa8]
cmp rdx, qword [rbx + 0xb0]
je 0x1800bc6d6
mov byte [rdx], al
movups xmmword [rdx + 4], xmm0
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rdx + 0x18], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rdx + 0x28], xmm1
mov edx, 0xf
mov byte [rsp + 0x50], 0
add qword [rbx + 0xa8], 0x38
jmp 0x1800bc6ec
lea r8, [rsp + 0x38]
lea rcx, [rbx + 0xa0]
call fcn.1800ba030
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1800bc720
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800bc71b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800bc733
call fcn.1800b2e40
xor r8d, r8d
xor edx, edx
lea rcx, [rbx + 8]
call fcn.1800b7570
jmp 0x1800bc589
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800b2e20
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400c4fa0
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14011be00
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x14011be28
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x14011be72
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14011be1d
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret
Function at 0x1400c67e7
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1401d9350
mov rax, rcx
neg rcx
test rax, 7
je 0x1401d936d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1401d93c8
test al, 7
jne 0x1401d9360
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1401d9381
mov rdx, qword [rax - 8]
test dl, dl
je 0x1401d93f2
test dh, dh
je 0x1401d93ec
shr rdx, 0x10
test dl, dl
je 0x1401d93e6
test dh, dh
je 0x1401d93e0
shr rdx, 0x10
test dl, dl
je 0x1401d93da
test dh, dh
je 0x1401d93d4
shr edx, 0x10
test dl, dl
je 0x1401d93ce
test dh, dh
jne 0x1401d9381
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400c6823
Capabilities:
Query environment variable

Disassembly:
jmp 0x14022fd10
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14022f890
lea rcx, [rsp + 0x20]
call fcn.14022f8e0
movzx eax, al
test eax, eax
jne 0x14022fd55
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.14022f8c0
mov rax, qword [rsp + 0x40]
jmp 0x14022fe4f
lea rcx, [rsp + 0x20]
call fcn.14022f9e0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.14022f980
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400c6be3
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400c6102
lea rcx, [rsp + 0x28]
call fcn.1400c70ed
movzx eax, al
test eax, eax
jne 0x14022fdef
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1400c86be
lea rcx, [rsp + 0x20]
call fcn.14022f8c0
mov rax, qword [rsp + 0x50]
jmp 0x14022fe4f
lea rcx, [rsp + 0x20]
call fcn.14022f9e0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1400c9762
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400c6b20
lea rcx, [rsp + 0x28]
call fcn.1400ca18a
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1400c86be
lea rcx, [rsp + 0x20]
call fcn.14022f8c0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x1400c6d96
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1401767f0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140176170
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14017682f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402d6020]
jmp 0x140176839
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1400c701b
Capabilities:
Query environment variable

Disassembly:
jmp 0x14022fa60
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14022f890
lea rcx, [rsp + 0x40]
call fcn.14022fa10
movzx eax, al
test eax, eax
jne 0x14022faa8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.14022f8c0
mov rax, qword [rsp + 0x70]
jmp 0x14022fc79
lea rcx, [rsp + 0x40]
call fcn.14022f9e0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.14022f980
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.14022f9e0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400c82bd
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14022fb4e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.14022f8c0
mov rax, qword [rsp + 0x80]
jmp 0x14022fc79
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400c6be3
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400c69a9
lea rcx, [rsp + 0x48]
call fcn.1400c6364
movzx eax, al
test eax, eax
jne 0x14022fbb5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400c4e01
lea rcx, [rsp + 0x40]
call fcn.14022f8c0
mov rax, qword [rsp + 0x88]
jmp 0x14022fc79
lea rcx, [rsp + 0x48]
call fcn.1400c7552
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.14022f9e0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400c82bd
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14022fc4b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400c4e01
lea rcx, [rsp + 0x40]
call fcn.14022f8c0
mov rax, qword [rsp + 0xa0]
jmp 0x14022fc79
lea rcx, [rsp + 0x48]
call fcn.1400c6959
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400c4e01
lea rcx, [rsp + 0x40]
call fcn.14022f8c0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x1400c7034
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140176720
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1401760f0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140176761
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402d6020]
jmp 0x140176767
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x1400c70f7
Capabilities:
Get geographical location

Disassembly:
jmp 0x14020f3f0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.14020e360
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14020f457
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1402d6030]
jmp 0x14020f479
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400c62bf
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400c7115
Capabilities:
Terminate process

Disassembly:
jmp 0x140153660
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400c74da
Capabilities:
Print debug messages

Disassembly:
jmp 0x14023ce40
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1402b7138]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x14023ce66
jmp 0x14023cee3
mov rcx, qword [rbp + 0x30]
call fcn.1400c67e7
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14023ce7f
jmp 0x14023cee3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x14023ce9c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400c5054
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1400c56d0
test eax, eax
jne 0x14023cee3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1400c6afd
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x1400c7953
Capabilities:
Set environment variable

Disassembly:
jmp 0x140231bc0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x1400c7ccd
Capabilities:
Parse pe header

Disassembly:
jmp 0x140155050
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140155070
xor al, al
jmp 0x1401550f1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140155083
xor al, al
jmp 0x1401550f1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1401550ad
xor al, al
jmp 0x1401550f1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1401550c1
xor al, al
jmp 0x1401550f1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1401550d3
xor al, al
jmp 0x1401550f1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1401550ef
xor al, al
jmp 0x1401550f1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400c84f7
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
jmp 0x1400dfcd0
mov byte [rsp + 8], cl
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
movzx ecx, byte [rsp + 0x1b8]
mov rax, qword [0x1402b7138]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1402d50fd]
call fcn.1400c986b
movsx eax, byte [rbp + 0x190]
xor edx, edx
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp + 4], ax
movsx ax, byte [rbp + 0x190]
movzx ecx, ax
call qword [sym.imp.USER32.dll_VkKeyScanW]
mov word [rbp + 0x24], ax
lea rax, [rbp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x50
rep stosb byte [rdi], al
mov eax, 0x28
imul rax, rax, 0
mov dword [rbp + rax + 0x50], 1
mov eax, 0x28
imul rax, rax, 0
movzx ecx, word [rbp + 0x24]
mov word [rbp + rax + 0x58], cx
mov eax, 0x28
imul rax, rax, 0
movzx ecx, word [rbp + 4]
mov word [rbp + rax + 0x5a], cx
mov eax, 0x28
imul rax, rax, 0
mov dword [rbp + rax + 0x5c], 8
mov eax, 0x28
imul rax, rax, 1
mov dword [rbp + rax + 0x50], 1
mov eax, 0x28
imul rax, rax, 1
movzx ecx, word [rbp + 0x24]
mov word [rbp + rax + 0x58], cx
mov eax, 0x28
imul rax, rax, 1
movzx ecx, word [rbp + 4]
mov word [rbp + rax + 0x5a], cx
mov eax, 0x28
imul rax, rax, 1
mov dword [rbp + rax + 0x5c], 0xa
mov r8d, 0x28
lea rdx, [rbp + 0x50]
mov ecx, 2
call qword [sym.imp.USER32.dll_SendInput]
lea rcx, [rbp - 0x20]
lea rdx, [0x140263d90]
call fcn.1400c8916
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.1400c6afd
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret

Function at 0x1400c85a1
Capabilities:
Terminate process

Disassembly:
jmp 0x140177800
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14017782e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1400c921c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400c92a3
Capabilities:
Print debug messages

Disassembly:
jmp 0x14020aed0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1400c941a
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140176860
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1401761b0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401768a9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402d6020]
jmp 0x1401768b8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x1400c9532
Capabilities:
Set environment variable

Disassembly:
jmp 0x14024cb80
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.1400c60b2
lea rcx, [rsp + 0x48]
call fcn.1400c60b2
call fcn.1400c6f8f
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.1400c5d5b
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14024cbef
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.1400c667a
lea rcx, [rsp + 0x78]
call fcn.1400c667a
mov eax, dword [rsp + 0x24]
jmp 0x14024cc80
call fcn.1400c6f8f
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.1400c5d5b
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x14024cc36
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.1400c667a
lea rcx, [rsp + 0x78]
call fcn.1400c667a
mov eax, dword [rsp + 0x2c]
jmp 0x14024cc80
lea rcx, [rsp + 0x48]
call fcn.1400c5fd1
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.1400c5fd1
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.1400c667a
lea rcx, [rsp + 0x78]
call fcn.1400c667a
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret