joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d2540
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xa0
movups xmm0, xmmword [str.x_RSPEkuVOHYKM3.0m2p2_0I]
movzx eax, word [0x140120b28]
xor r8d, r8d
cmp dword [0x1402567d0], 2
mov rbx, rcx
movups xmm1, xmmword [0x140120b08]
mov word [rsp + 0x50], ax
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [0x140120b18]
movups xmmword [rsp + 0x30], xmm1
movups xmmword [rsp + 0x40], xmm0
jl 0x1400d26f7
movdqa xmm5, xmmword [0x140119390]
lea rcx, [rsp + 0x20]
movdqa xmm4, xmmword [0x14011a500]
mov eax, 5
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [str.9999]
movaps xmmword [r11 - 0x38], xmm8
movd xmm6, eax
mov eax, 0x1f
movaps xmmword [r11 - 0x48], xmm9
movdqa xmm9, xmmword [str.11111111]
movd xmm8, eax
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 0x10]
paddd xmm2, xmm5
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
pxor xmm3, xmm0
movq qword [rcx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
pxor xmm3, xmm0
movq qword [rcx - 8], xmm3
cmp r8d, 0x18
jl 0x1400d25e0
movaps xmm9, xmmword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
cmp r8d, 0x19
jge 0x1400d2748
movsxd rax, r8d
lea r9, [rsp + 0x20]
lea r9, [r9 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r9, [r9 + 2]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x39
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x31
xor word [r9 - 2], ax
cmp r8d, 0x19
jl 0x1400d2710
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [0x1402562d0]
call fcn.1400b7b60
mov qword [rbx + 0x78], rax
add rsp, 0xa0
pop rbx
ret
Function at 0x1400daf10
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
xor esi, esi
mov rdi, rcx
mov r15d, select
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov qword [rsp + 0x40], rsi
mov r14d, esi
mov qword [rsp + 0x48], r15
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400db0c2
lea ecx, [rsi + 1]
mov qword [rsp + 0x70], rbx
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
je 0x1400dafa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400daf9b
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], sil
jne 0x1400daf76
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140019700
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
test r14, r14
je 0x1400db07d
cmp r15, 0x10
lea rax, [rsp + 0x30]
lea rbx, [rsp + 0x30]
cmovae rax, rsi
cmovae rbx, rsi
add r14, rax
cmp rbx, r14
je 0x1400db07d
movabs r12, 0x7ffffffffffffff
nop dword [rax]
cmp byte [0x140256648], 0
movsx ebp, byte [rbx]
je 0x1400db071
mov rcx, qword [rdi + 0x270]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov word [rsp + 0x20], bp
mov rbp, qword [rdi + 0x260]
cmp qword [rdi + 0x268], r12
je 0x1400db0d4
mov ecx, 0x20
call fcn.1400e9e14
movsd xmm0, qword [rsp + 0x20]
movsd qword [rax + 0x10], xmm0
mov dword [rax + 0x18], 3
inc qword [rdi + 0x268]
mov rcx, qword [rbp + 8]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov qword [rbp + 8], rax
mov qword [rcx], rax
mov byte [rdi + 0x279], 1
mov rcx, qword [rdi + 0x270]
cmp dword [rcx + 8], 0xffffffff
jge 0x1400db071
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
inc rbx
cmp rbx, r14
jne 0x1400daff0
cmp r15, 0x10
jb 0x1400db0b0
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400db0a8
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400db0e1
mov rcx, rsi
call fcn.1400e9e50
mov rbp, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
lea rcx, str.list_too_long
call fcn.1400e8420
int3
call fcn.1400f0b0c
int3
Function at 0x1400db200
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x80
mov esi, edx
movzx r12d, r9b
mov byte [rcx + 0x2c4], 0
movzx ebp, r8b
mov rbx, rcx
test r8b, r8b
je 0x1400db457
movzx edi, byte [rsp + 0xc0]
test r9b, r9b
jne 0x1400db291
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r8d, 0x40
lea rdx, [rsp + 0x40]
mov ecx, eax
mov eax, edi
shl eax, 0x18
shl ecx, 0x10
or ecx, eax
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
test eax, eax
jle 0x1400db291
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400db276
lea rcx, [rbx + 0x2a0]
lea rdx, [rsp + 0x40]
call fcn.140019700
cmp dword [rbx + 0x2c0], 0xa2
jne 0x1400db441
cmp esi, 0xa4
jne 0x1400db441
test dil, dil
je 0x1400db2b9
mov byte [rbx + 0x2c4], 1
mov rcx, qword [rbx + 0x270]
mov qword [rsp + 0xa0], r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test r12b, r12b
jne 0x1400db35c
mov r8d, esi
mov qword [rsp + 0xa8], r15
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400db0f0
mov r14, qword [rsp + 0x20]
mov r15, qword [rsp + 0x28]
mov rdi, r14
cmp r14, r15
je 0x1400db316
mov rcx, qword [rdi]
movzx edx, bpl
call fcn.1400dbc80
add rdi, 8
cmp rdi, r15
jne 0x1400db301
mov r15, qword [rsp + 0xa8]
test r14, r14
je 0x1400db35c
mov rdx, qword [rsp + 0x30]
mov rax, r14
sub rdx, r14
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1400db354
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400db49e
mov rcx, r14
call fcn.1400e9e50
cmp byte [0x140256648], 0
je 0x1400db403
cmp esi, 0x256
jae 0x1400db39b
mov byte [rsi + rbx + 8], bpl
cmp byte [rbx + 0xaa], 0
je 0x1400db39b
lea eax, [rsi - 0x56]
test eax, 0xffffffdf
jne 0x1400db39b
test bpl, bpl
je 0x1400db39b
test r12b, r12b
jne 0x1400db39b
mov rcx, rbx
call fcn.1400daf10
mov rdi, qword [rbx + 0x260]
movabs rax, 0x7ffffffffffffff
mov dword [rsp + 0x20], esi
mov byte [rsp + 0x24], bpl
mov byte [rsp + 0x25], r12b
cmp qword [rbx + 0x268], rax
je 0x1400db491
mov ecx, 0x20
call fcn.1400e9e14
movsd xmm0, qword [rsp + 0x20]
movsd qword [rax + 0x10], xmm0
mov dword [rax + 0x18], 4
inc qword [rbx + 0x268]
mov rcx, qword [rdi + 8]
mov qword [rax], rdi
mov qword [rax + 8], rcx
mov qword [rdi + 8], rax
mov qword [rcx], rax
mov byte [rbx + 0x279], 1
test bpl, bpl
je 0x1400db40e
mov dword [rbx + 0x2c0], esi
mov rcx, qword [rbx + 0x270]
cmp dword [rcx + 8], 0xffffffff
jge 0x1400db421
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r14, qword [rsp + 0xa0]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
cmp esi, 0x2e
jne 0x1400db457
lea rcx, [0x1402595f0]
call fcn.1400d7970
jmp 0x1400db2b9
cmp esi, 0x2d
jne 0x1400db2b9
test bpl, bpl
je 0x1400db2b9
test r12b, r12b
jne 0x1400db2b9
cmp byte [0x140256648], r12b
lea rcx, [0x140256640]
sete dl
call fcn.1400d32a0
mov byte [rbx + 0x279], 1
jmp 0x1400db429
lea rcx, str.list_too_long
call fcn.1400e8420
int3
call fcn.1400f0b0c
int3
Function at 0x1400fc910
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400fc73c

Function at 0x140111590
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
mov eax, 0xffffffff
test edx, edx
je 0x1401115ce
mov r10d, edx
lea r11, [0x140130810]
nop word [rax + rax]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
mov edx, eax
shr eax, 8
xor r8, rdx
movzx ecx, r8b
xor eax, dword [r11 + rcx*4]
sub r10, 1
jne 0x1401115b0
not eax
ret
Function at 0x1400111ef
Capabilities:
Terminate process

Disassembly:
jmp 0x140012ea0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011276
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400141f0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014210
xor al, al
jmp 0x140014291
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014223
xor al, al
jmp 0x140014291
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001424d
xor al, al
jmp 0x140014291
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014261
xor al, al
jmp 0x140014291
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014273
xor al, al
jmp 0x140014291
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001428f
xor al, al
jmp 0x140014291
mov al, 1
add rsp, 0x38
ret
Function at 0x140011203
Capabilities:
Terminate process

Disassembly:
jmp 0x140013020
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14001128a
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014370
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014390
xor al, al
jmp 0x140014411
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400143a3
xor al, al
jmp 0x140014411
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400143cd
xor al, al
jmp 0x140014411
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400143e1
xor al, al
jmp 0x140014411
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400143f3
xor al, al
jmp 0x140014411
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001440f
xor al, al
jmp 0x140014411
mov al, 1
add rsp, 0x38
ret
Function at 0xe22da0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xe22dad
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xe22dbd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xe22da5
lea eax, [rcx + 1]
jmp 0xe22dcb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xe22dde
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xe22dc4
sub eax, 3
jb 0xe22dfe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xe22e4d
sar eax, 1
movsxd rbp, eax
jb 0xe22e34
jmp 0xe22e0c
add ebx, ebx
jne 0xe22e0a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xe22e34
inc ecx
add ebx, ebx
jne 0xe22e1a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xe22e34
call r11
adc ecx, ecx
add ebx, ebx
jne 0xe22e2d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xe22e1c
add ecx, 2
jmp 0xe22e39
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00e22d62
jmp 0xe22dad
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x53d600
mov dl, 0x5a
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xe22e99
cmp rsi, rcx
jae 0xe22ea1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xe22e80
cmp al, 0x8f
ja 0xe22e80
cmp byte [rsi - 2], 0xf
je 0xe22e86
sub al, 0xe8
cmp al, 1
ja 0xe22e6a
cmp rsi, rcx
jae 0xe22ea1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xe22e70
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xe22ea1
lodsb al, byte [rsi]
jmp 0xe22e80
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xa17000]
mov eax, dword [rdi]
or eax, eax
je 0xe22efe
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xa22000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xe22eae
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xe22ef8
mov qword [rbx], rax
add rbx, 8
jmp 0xe22ece
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xe22f42
cmp al, 0xef
ja 0xe22f2a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xe22f0a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xe22f19
mov eax, dword [rdi]
add rdi, 4
jmp 0xe22f19
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xe22f96
sub rsp, 0xffffffffffffff80
jmp 0x46d580
Function at 0x1400cef96
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14013f9b0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x14013f9d8
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x14013fa22
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14013f9cd
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret
Function at 0x1400d03fa
Capabilities:
Enumerate gui resources

Disassembly:
jmp 0x1400fae50
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x1402d4080]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x1402f1100]
call fcn.1400d39a6
nop
mov rax, qword [rbp + 0x120]
mov qword [rax + 0x20], 0
mov rax, qword [rbp + 0x120]
add rax, 0x20
mov rdx, rax
lea rcx, [0x1400d36e0]
call qword [sym.imp.USER32.dll_EnumWindows]
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x20], 0
jne 0x1400faede
mov ecx, 1
call fcn.1400ce6d6
nop
lea rdx, [0x1402864a8]
mov rax, qword [rbp + 0x120]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.USER32.dll_SetWindowTextW]
nop
mov edx, 0xfffffff0
mov rax, qword [rbp + 0x120]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
and rax, 0xfffffffffffcffff
mov qword [rbp + 8], rax
mov r8, qword [rbp + 8]
mov edx, 0xfffffff0
mov rax, qword [rbp + 0x120]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
nop
mov dword [rsp + 0x30], 0x27
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rbp + 0x120]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.USER32.dll_SetWindowPos]
nop
mov rax, qword [rbp + 0x120]
mov dword [rax + 8], 0x341
mov rax, qword [rbp + 0x120]
mov dword [rax + 0xc], 0xf9
mov rax, qword [rbp + 0x120]
mov rax, qword [rax + 8]
mov qword [rbp + 0x28], rax
lea rdx, [rbp + 0x28]
mov rax, qword [rbp + 0x120]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x1400fafe3
mov rax, qword [rbp + 0x120]
mov ecx, dword [rbp + 0x28]
mov dword [rax], ecx
mov rax, qword [rbp + 0x120]
mov ecx, dword [rbp + 0x2c]
mov dword [rax + 4], ecx
mov rax, qword [rbp + 0x120]
mov byte [rax + 0x70], 1
mov rcx, qword [rbp + 0x120]
call fcn.1400ce4f6
nop
jmp 0x1400fafee
mov ecx, 1
call fcn.1400ce6d6
nop
lea rcx, [rbp - 0x40]
lea rdx, [0x1402827a0]
call fcn.1400d2a10
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.1400d0ad0
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400d07b0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1401f0e10
mov rax, rcx
neg rcx
test rax, 7
je 0x1401f0e2d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1401f0e88
test al, 7
jne 0x1401f0e20
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1401f0e41
mov rdx, qword [rax - 8]
test dl, dl
je 0x1401f0eb2
test dh, dh
je 0x1401f0eac
shr rdx, 0x10
test dl, dl
je 0x1401f0ea6
test dh, dh
je 0x1401f0ea0
shr rdx, 0x10
test dl, dl
je 0x1401f0e9a
test dh, dh
je 0x1401f0e94
shr edx, 0x10
test dl, dl
je 0x1401f0e8e
test dh, dh
jne 0x1401f0e41
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x1400d07f6
Capabilities:
Query environment variable

Disassembly:
jmp 0x14024e5e0
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14024e160
lea rcx, [rsp + 0x20]
call fcn.14024e1b0
movzx eax, al
test eax, eax
jne 0x14024e625
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.14024e190
mov rax, qword [rsp + 0x40]
jmp 0x14024e71f
lea rcx, [rsp + 0x20]
call fcn.14024e2b0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.14024e250
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400d0bbb
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400d00e4
lea rcx, [rsp + 0x28]
call fcn.1400d1101
movzx eax, al
test eax, eax
jne 0x14024e6bf
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1400d279f
lea rcx, [rsp + 0x20]
call fcn.14024e190
mov rax, qword [rsp + 0x50]
jmp 0x14024e71f
lea rcx, [rsp + 0x20]
call fcn.14024e2b0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1400d38a2
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400d0af8
lea rcx, [rsp + 0x28]
call fcn.1400d42f2
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1400d279f
lea rcx, [rsp + 0x20]
call fcn.14024e190
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x1400d0d82
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1401938b0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140193230
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401938ef
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402f2020]
jmp 0x1401938f9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1400d1016
Capabilities:
Query environment variable

Disassembly:
jmp 0x14024e330
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14024e160
lea rcx, [rsp + 0x40]
call fcn.14024e2e0
movzx eax, al
test eax, eax
jne 0x14024e378
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.14024e190
mov rax, qword [rsp + 0x70]
jmp 0x14024e549
lea rcx, [rsp + 0x40]
call fcn.14024e2b0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.14024e250
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.14024e2b0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400d238f
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14024e41e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.14024e190
mov rax, qword [rsp + 0x80]
jmp 0x14024e549
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400d0bbb
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400d0986
lea rcx, [rsp + 0x48]
call fcn.1400d0328
movzx eax, al
test eax, eax
jne 0x14024e485
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400cedf2
lea rcx, [rsp + 0x40]
call fcn.14024e190
mov rax, qword [rsp + 0x88]
jmp 0x14024e549
lea rcx, [rsp + 0x48]
call fcn.1400d159d
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.14024e2b0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400d238f
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14024e51b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400cedf2
lea rcx, [rsp + 0x40]
call fcn.14024e190
mov rax, qword [rsp + 0xa0]
jmp 0x14024e549
lea rcx, [rsp + 0x48]
call fcn.1400d0936
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400cedf2
lea rcx, [rsp + 0x40]
call fcn.14024e190
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x1400d102f
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1401937e0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1401931b0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140193821
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402f2020]
jmp 0x140193827
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x1400d110b
Capabilities:
Get geographical location

Disassembly:
jmp 0x140235b90
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.140234ac0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140235bf7
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1402f2030]
jmp 0x140235c19
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400d0292
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400d111f
Capabilities:
Terminate process

Disassembly:
jmp 0x140171000
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret