joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14017ee44
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1403dd6e0
mov rax, rcx
neg rcx
test rax, 7
je 0x1403dd6fd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1403dd758
test al, 7
jne 0x1403dd6f0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1403dd711
mov rdx, qword [rax - 8]
test dl, dl
je 0x1403dd782
test dh, dh
je 0x1403dd77c
shr rdx, 0x10
test dl, dl
je 0x1403dd776
test dh, dh
je 0x1403dd770
shr rdx, 0x10
test dl, dl
je 0x1403dd76a
test dh, dh
je 0x1403dd764
shr edx, 0x10
test dl, dl
je 0x1403dd75e
test dh, dh
jne 0x1403dd711
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x14017eea3
Capabilities:
Query environment variable

Disassembly:
jmp 0x14045e240
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14045ddc0
lea rcx, [rsp + 0x20]
call fcn.14045de10
movzx eax, al
test eax, eax
jne 0x14045e285
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.14045ddf0
mov rax, qword [rsp + 0x40]
jmp 0x14045e37f
lea rcx, [rsp + 0x20]
call fcn.14045df10
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.14045deb0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.14017f439
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14017e38b
lea rcx, [rsp + 0x28]
call fcn.14017fc77
movzx eax, al
test eax, eax
jne 0x14045e31f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.140181eeb
lea rcx, [rsp + 0x20]
call fcn.14045ddf0
mov rax, qword [rsp + 0x50]
jmp 0x14045e37f
lea rcx, [rsp + 0x20]
call fcn.14045df10
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.14018399e
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.14017f2f9
lea rcx, [rsp + 0x28]
call fcn.140184952
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.140181eeb
lea rcx, [rsp + 0x20]
call fcn.14045ddf0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x14017f565
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x14019f970
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x1405af018]
call fcn.140183b24
mov qword [rbp + 8], 0x137
mov qword [rbp + 0x28], 0x9c
mov qword [rbp + 0x48], 0
jmp 0x14019f9b4
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0x9c
jae 0x14019fa5d
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x48]
mov rax, qword [rax + rcx*8 + 0x9c8]
and rax, 0xffffffff80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rcx + rdx*8 + 0x9d0]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
and rax, 1
test rax, rax
je 0x14019fa1c
movabs rax, 0xb5026f5aa96619e9
mov qword [rbp + 0x1b8], rax
jmp 0x14019fa27
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0x68]
shr rax, 1
xor rax, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
xor rax, qword [rcx + rdx*8 + 0xea8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14019f9a9
mov qword [rbp + 0x88], 0x9c
jmp 0x14019fa7b
mov rax, qword [rbp + 0x88]
inc rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0x137
jae 0x14019fb3c
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x88]
mov rax, qword [rax + rcx*8 + 0x9c8]
and rax, 0xffffffff80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rcx + rdx*8 + 0x9d0]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
and rax, 1
test rax, rax
je 0x14019faf2
movabs rax, 0xb5026f5aa96619e9
mov qword [rbp + 0x1b8], rax
jmp 0x14019fafd
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0xa8]
shr rax, 1
xor rax, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
xor rax, qword [rcx + rdx*8 - 0x4d8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14019fa6a
mov qword [rbp + 0xc8], 0x137
mov eax, 8
imul rax, rax, 0x26f
mov rcx, qword [rbp + 0x1e0]
mov rax, qword [rcx + rax + 8]
and rax, 0xffffffff80000000
mov ecx, 8
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x1e0]
mov rcx, qword [rdx + rcx + 8]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
and rax, 1
test rax, rax
je 0x14019fbae
movabs rax, 0xb5026f5aa96619e9
mov qword [rbp + 0x1b8], rax
jmp 0x14019fbb9
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0xe8]
shr rax, 1
xor rax, qword [rbp + 0x1b8]
mov ecx, 8
imul rcx, rcx, 0x9b
mov rdx, qword [rbp + 0x1e0]
xor rax, qword [rdx + rcx + 8]
mov ecx, 8
imul rcx, rcx, 0x137
mov rdx, qword [rbp + 0x1e0]
mov qword [rdx + rcx + 8], rax
mov rax, qword [rbp + 0x1e0]
mov dword [rax], 0
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x14017f6eb
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x14037c0a0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14037ba20
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14037c0df
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1405b1020]
jmp 0x14037c0e9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x14017fb00
Capabilities:
Query environment variable

Disassembly:
jmp 0x14045df90
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14045ddc0
lea rcx, [rsp + 0x40]
call fcn.14045df40
movzx eax, al
test eax, eax
jne 0x14045dfd8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.14045ddf0
mov rax, qword [rsp + 0x70]
jmp 0x14045e1a9
lea rcx, [rsp + 0x40]
call fcn.14045df10
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.14045deb0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.14045df10
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1401818a1
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14045e07e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.14045ddf0
mov rax, qword [rsp + 0x80]
jmp 0x14045e1a9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.14017f439
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14017f0bf
lea rcx, [rsp + 0x48]
call fcn.14017e6f6
movzx eax, al
test eax, eax
jne 0x14045e0e5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.14017c586
lea rcx, [rsp + 0x40]
call fcn.14045ddf0
mov rax, qword [rsp + 0x88]
jmp 0x14045e1a9
lea rcx, [rsp + 0x48]
call fcn.140180366
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.14045df10
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1401818a1
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14045e17b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.14017c586
lea rcx, [rsp + 0x40]
call fcn.14045ddf0
mov rax, qword [rsp + 0xa0]
jmp 0x14045e1a9
lea rcx, [rsp + 0x48]
call fcn.14017f056
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.14017c586
lea rcx, [rsp + 0x40]
call fcn.14045ddf0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x14017fb2d
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x14037bfd0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.14037b9a0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14037c011
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1405b1020]
jmp 0x14037c017
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x14017fc81
Capabilities:
Get geographical location

Disassembly:
jmp 0x140434980
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1404338b0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1404349e7
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1405b1030]
jmp 0x140434a09
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.14017e610
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x14017fca9
Capabilities:
Terminate process

Disassembly:
jmp 0x140357960
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1401802a3
Capabilities:
Print debug messages

Disassembly:
jmp 0x140468a60
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x14057cc40]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140468a86
jmp 0x140468b03
mov rcx, qword [rbp + 0x30]
call fcn.14017ee44
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x140468a9f
jmp 0x140468b03
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x140468abc
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14017c914
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.14017d355
test eax, eax
jne 0x140468b03
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.14017f2b8
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x1401804ec
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x1401d91c0
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x208
lea rbp, [rsp + 0x20]
lea rcx, [0x1405af5d2]
call fcn.140183b24
mov eax, 0x104
mov eax, eax
mov ecx, dword [0x140588d0c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x140587ef8], eax
jle 0x1401d9254
lea rcx, [0x140587ef8]
call fcn.140182b9d
cmp dword [0x140587ef8], 0xffffffff
jne 0x1401d9254
lea rdx, str._none_
lea rcx, [0x140587ed0]
call fcn.14017ef1b
lea rcx, [0x1404908a0]
call fcn.14017e66f
nop
lea rcx, [0x140587ef8]
call fcn.140182fbc
cvtsi2ss xmm0, dword [rbp + 0x218]
cvtsi2ss xmm1, dword [rbp + 0x210]
movaps xmm2, xmm0
lea rcx, [rbp + 0xe4]
call fcn.140180767
mov qword [rbp + 0x1b8], rax
lea rcx, [0x140587ed0]
call fcn.14017bc7b
mov qword [rbp + 0x1c0], rax
mov rdx, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1c0]
call fcn.14017ded1
movzx eax, al
test eax, eax
je 0x1401d92ae
mov byte [0x140587ec8], 1
movzx eax, byte [0x140587ec8]
test eax, eax
je 0x1401d9337
mov dword [rbp + 4], 1
jmp 0x1401d92ca
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0x100
jge 0x1401d931f
mov ecx, dword [rbp + 4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1401d931d
cmp dword [rbp + 4], 0xc
je 0x1401d931d
cmp dword [rbp + 4], 0x1b
jne 0x1401d92fe
mov dword [rbp + 0x1b4], 0
jmp 0x1401d9307
mov eax, dword [rbp + 4]
mov dword [rbp + 0x1b4], eax
mov rax, qword [rbp + 0x208]
mov ecx, dword [rbp + 0x1b4]
mov dword [rax], ecx
mov byte [0x140587ec8], 0
jmp 0x1401d92c2
lea rdx, [0x1404b0934]
lea rcx, [0x140587ed0]
call fcn.14017b505
jmp 0x1401d9440
movzx eax, byte [0x140587ec8]
test eax, eax
jne 0x1401d9366
mov rax, qword [rbp + 0x208]
cmp dword [rax], 0
jne 0x1401d9366
lea rdx, str._none_
lea rcx, [0x140587ed0]
call fcn.14017b505
jmp 0x1401d9440
movzx eax, byte [0x140587ec8]
test eax, eax
jne 0x1401d9440
mov rax, qword [rbp + 0x208]
cmp dword [rax], 0
je 0x1401d9440
mov rax, qword [rbp + 0x208]
mov r8d, dword [rax]
lea rdx, [rbp + 0x108]
mov rcx, qword [rbp + 0x200]
call fcn.140180e42
mov qword [rbp + 0x1b8], rax
mov rax, qword [rbp + 0x1b8]
mov qword [rbp + 0x1c0], rax
mov r8, qword [rbp + 0x1c0]
lea rdx, [0x140495544]
lea rcx, [rbp + 0x148]
call fcn.140183eb7
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp + 0x1c8]
mov qword [rbp + 0x1d0], rax
lea r8, [0x1404dada0]
mov rdx, qword [rbp + 0x1d0]
lea rcx, [rbp + 0x188]
call fcn.140182ea4
mov qword [rbp + 0x1d8], rax
mov rdx, qword [rbp + 0x1d8]
lea rcx, [0x140587ed0]
call fcn.14017d535
lea rcx, [rbp + 0x188]
call fcn.14017c991
nop
lea rcx, [rbp + 0x148]
call fcn.14017c991
nop
lea rcx, [rbp + 0x108]
call fcn.14017c991
lea rsp, [rbp + 0x1e8]
pop rdi
pop rbp
ret
Function at 0x140180857
Capabilities:
Get geographical location

Disassembly:
jmp 0x1402f2c90
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1402f2ccd
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.140183aca
add rsp, 0x58
ret

Function at 0x1401809fb
Capabilities:
Set environment variable

Disassembly:
jmp 0x1404600f0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x140180c30
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1401e7860
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x1405af0d6]
call fcn.140183b24
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x140498f00]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x1401e79a5
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x1401e78f9
mov dword [rbp + 0x160], 1
jmp 0x1401e7903
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x1401e79a0
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x1401e797a
cmp qword [rbp + 0x198], 2
jb 0x1401e797a
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401e797a
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401e797a
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1401e78c4
jmp 0x1401e7a3f
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x1401e7a3f
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x1401e7a16
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401e7a16
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401e7a16
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1401e79a5
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x140180f7d
Capabilities:
Parse pe header

Disassembly:
jmp 0x140359010
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140359030
xor al, al
jmp 0x1403590b1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140359043
xor al, al
jmp 0x1403590b1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14035906d
xor al, al
jmp 0x1403590b1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140359081
xor al, al
jmp 0x1403590b1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140359093
xor al, al
jmp 0x1403590b1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1403590af
xor al, al
jmp 0x1403590b1
mov al, 1
add rsp, 0x38
ret
Function at 0x140181d0b
Capabilities:
Terminate process

Disassembly:
jmp 0x14037d390
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14037d3be
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1401830de
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14018265c
Capabilities:
Create directory

Disassembly:
jmp 0x1402f6080
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14057cc40]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1402f60bd
mov byte [rsp + 0x24], 1
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x24]
jmp 0x1402f6132
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xb7
jne 0x1402f6120
mov edx, 1
mov ecx, 2
call fcn.14017b492
mov r9d, 0xffffffff
mov r8d, eax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.14017d76a
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x1402f6120
mov edx, 0x10
mov ecx, dword [rsp + 0x48]
call fcn.14017c0d6
movzx eax, al
test eax, eax
jne 0x1402f6120
mov dword [rsp + 0x20], 0xb7
mov byte [rsp + 0x2c], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2c]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14017f2b8
add rsp, 0x68
ret

Function at 0x140183061
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1401e7740
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x1405af0d6]
call fcn.140183b24
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x140498f00]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1401e77bf
mov dword [rbp + 0x120], 1
jmp 0x1401e77c9
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x1401e7812
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x1401e778a
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1401831ab
Capabilities:
Print debug messages

Disassembly:
jmp 0x140431fd0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140183408
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x14037c110
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14037ba60
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14037c159
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1405b1020]
jmp 0x14037c168
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x14018358e
Capabilities:
Get graphical window text

Disassembly:
jmp 0x1402ee500
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x408
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, ILFree
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x428]
mov rax, qword [0x14057cc40]
xor rax, rbp
mov qword [rbp + 0x3d8], rax
mov dword [rbp + 0x3c4], 0
lea rcx, [0x1405af601]
call fcn.140183b24
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1402ee588
mov rcx, qword [rbp + 0x400]
call fcn.140181b2b
mov eax, dword [rbp + 0x3c4]
or eax, 1
mov dword [rbp + 0x3c4], eax
mov rax, qword [rbp + 0x400]
jmp 0x1402ee5c2
mov r8d, 0x80
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x400]
call fcn.14017decc
mov eax, dword [rbp + 0x3c4]
or eax, 1
mov dword [rbp + 0x3c4], eax
mov rax, qword [rbp + 0x400]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140509200]
call fcn.1401822b5
mov rax, rdi
mov rcx, qword [rbp + 0x3d8]
xor rcx, rbp
call fcn.14017f2b8
lea rsp, [rbp + 0x3e8]
pop rdi
pop rbp
ret