joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140064656
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x148
lea rbp, [0x1401a3754]
lea rdi, [0x1401a375d]
mov rbx, rdx
xor edx, edx
mov rsi, rcx
mov dword [rsp + 0xb4], edx
mov rcx, rbx
lea rdx, [0x1401a3820]
call fcn.14006463a
test eax, eax
jne 0x140064881
movzx eax, byte [rbx + 0xf]
lea r12, [rsp + 0xc0]
mov edx, pe_nt_image_headers64
lea r8, str.SystemCurrentControlSetControlMediaCategories_02X_02X_02X_02X__02X_02X__02X_02X__02X_02X__02X_02X_02X_02X_02X_02X
mov rcx, r12
mov dword [rsp + 0x90], eax
movzx eax, byte [rbx + 0xe]
mov dword [rsp + 0x88], eax
movzx eax, byte [rbx + 0xd]
mov dword [rsp + 0x80], eax
movzx eax, byte [rbx + 0xc]
mov dword [rsp + 0x78], eax
movzx eax, byte [rbx + 0xb]
mov dword [rsp + 0x70], eax
movzx eax, byte [rbx + 0xa]
mov dword [rsp + 0x68], eax
movzx eax, byte [rbx + 9]
mov dword [rsp + 0x60], eax
movzx eax, byte [rbx + 8]
mov dword [rsp + 0x58], eax
movzx eax, byte [rbx + 6]
mov dword [rsp + 0x50], eax
movzx eax, byte [rbx + 7]
mov dword [rsp + 0x48], eax
movzx eax, byte [rbx + 4]
mov dword [rsp + 0x40], eax
movzx eax, byte [rbx + 5]
mov dword [rsp + 0x38], eax
movzx eax, byte [rbx]
mov dword [rsp + 0x30], eax
movzx eax, byte [rbx + 1]
mov dword [rsp + 0x28], eax
movzx eax, byte [rbx + 2]
mov dword [rsp + 0x20], eax
movzx r9d, byte [rbx + 3]
call fcn.140041a6b
mov rcx, r12
call fcn.14004169a
mov r8, r12
mov rdx, rdi
mov rcx, rbp
lea r9, [rax + 1]
call fcn.14004114c
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov r9d, 1
mov rbx, rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, rbx
mov r12d, eax
call fcn.14004149f
test r12d, r12d
jne 0x140064881
xor eax, eax
lea r15, [rsp + 0xb4]
xor r9d, r9d
xor r8d, r8d
lea r14, str.Name
mov qword [rsp + 0x28], r15
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r12, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdx, r14
call r12
mov r13, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1400647e0
mov rcx, qword [rsp + 0xb8]
jmp 0x140064800
mov ecx, dword [rsp + 0xb4]
add rcx, 2
call fcn.1400413db
mov rcx, qword [rsp + 0xb8]
test rax, rax
mov rbx, rax
jne 0x140064805
call r13
jmp 0x140064881
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], r15
mov rdx, r14
mov qword [rsp + 0x20], rax
call r12
mov rcx, qword [rsp + 0xb8]
mov r12d, eax
call r13
test r12d, r12d
je 0x140064838
mov rcx, rbx
call fcn.14004149f
jmp 0x140064881
mov eax, dword [rsp + 0xb4]
mov rcx, rbx
shr eax, 1
mov word [rbx + rax*2], 0
call fcn.14004169f
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
lea r9, [rax + 1]
add r9, r9
call fcn.14004114c
mov rcx, rbx
mov qword [rsp + 0xa8], rax
call fcn.14004149f
mov rax, qword [rsp + 0xa8]
test rax, rax
jne 0x14006489e
mov rcx, rsi
call fcn.14004169f
mov r8, rsi
mov rdx, rbp
mov rcx, rdi
lea r9, [rax + 1]
add r9, r9
call fcn.14004114c
add rsp, 0x148
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140064cf3
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
xor edx, edx
xor edi, edi
mov rbx, rcx
xor ecx, ecx
call fcn.140012794
mov ecx, 0x17
mov esi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov rbp, qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 1
test eax, eax
setne dil
call rbp
test ax, ax
js 0x140064d46
mov dword [rsp + 0x20], 1
mov r9, rbx
mov r8d, edi
mov edx, esi
xor ecx, ecx
call fcn.140064c42
mov ecx, 2
call rbp
test ax, ax
js 0x140064d69
mov dword [rsp + 0x20], 3
mov r9, rbx
mov r8d, edi
mov edx, esi
xor ecx, ecx
call fcn.140064c42
mov ecx, 4
call rbp
test ax, ax
js 0x140064d8c
mov dword [rsp + 0x20], 2
mov r9, rbx
mov r8d, edi
mov edx, esi
xor ecx, ecx
call fcn.140064c42
mov ecx, 5
call rbp
test ax, ax
js 0x140064daf
mov dword [rsp + 0x20], 4
mov r9, rbx
mov r8d, edi
mov edx, esi
xor ecx, ecx
call fcn.140064c42
mov ecx, 6
call rbp
test ax, ax
js 0x140064dd2
mov dword [rsp + 0x20], 5
mov r9, rbx
mov r8d, edi
mov edx, esi
xor ecx, ecx
call fcn.140064c42
mov qword [rbx + 0x50], 0xffffffffffffffff
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140064de3
Capabilities:
Log keystrokes via polling

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbx, qword [rcx + 0xd8]
mov r12, qword [rbx + 8]
mov rsi, rcx
mov edi, edx
call fcn.140011709
cmp rsi, rax
sete bpl
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, r12
sete dl
cmp bpl, dl
je 0x140064ffd
and edi, 1
cmp dil, dl
jne 0x140064ffd
cmp rax, r12
jne 0x140064f84
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov rdi, qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 1
mov ebp, eax
call rdi
test ax, ax
je 0x140064e61
cmp ebp, 1
sbb edx, edx
and edx, 0xfffffffd
add edx, 4
or byte [rbx + 0x74], dl
mov ecx, 2
call rdi
test ax, ax
je 0x140064e7a
cmp ebp, 1
sbb eax, eax
and eax, 3
inc eax
or byte [rbx + 0x74], al
mov ecx, 4
call rdi
test ax, ax
je 0x140064e8a
or byte [rbx + 0x74], 2
mov ecx, 5
call rdi
test ax, ax
je 0x140064e9a
or byte [rbx + 0x74], 8
mov ecx, 6
call rdi
test ax, ax
je 0x140064eaa
or byte [rbx + 0x74], 0x10
mov rcx, rsi
call fcn.1400117f3
call fcn.1400126a2
cmp dword [rax + 0x84], 0
jne 0x140064f10
lea rdi, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x44]
mov qword [rsp + 0x40], rax
mov rcx, qword [rbx]
call fcn.14006d32c
mov eax, dword [rsp + 0x44]
mov r9d, dword [rsp + 0x40]
xor edx, edx
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.14001347b
mov rcx, rbx
call fcn.140064cf3
mov rcx, rsi
call fcn.14006d3de
mov rcx, qword [rbx + 0xb0]
call fcn.1400c91ad
mov rsi, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x14
call rsi
mov ecx, 0x2000
mov edx, eax
and edx, 1
call fcn.140011b48
mov ecx, 0x90
call rsi
mov ecx, 0x1000
mov edx, eax
and edx, 1
call fcn.140011b48
mov ecx, 0x91
call rsi
mov ecx, 0x8000
mov edx, eax
and edx, 1
call fcn.140011b48
mov rcx, qword [rbx]
mov edx, 1
call fcn.14006cce2
jmp 0x140064ffd
mov dword [rbx + 0x88], 1
xor ecx, ecx
call fcn.1400117f3
call fcn.1400126a2
cmp dword [rax + 0x84], 0
je 0x140064faa
xor ecx, ecx
call fcn.140012e09
call fcn.140068342
lea rdi, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClipCursor]
test eax, eax
je 0x140064ff5
lea rsi, [rbx + 0x8c]
mov r8d, 0x10
mov rcx, rdi
mov rdx, rsi
call fcn.140041695
test eax, eax
jne 0x140064ff5
xor ecx, ecx
call qword [sym.imp.USER32.dll_ClipCursor]
mov r8d, 0x10
xor edx, edx
mov rcx, rsi
call fcn.140041675
xor eax, eax
mov dword [rbx + 0x88], eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140067195
Capabilities:
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp qword [rbx + 0x160], rax
je 0x1400671d5
mov edx, eax
mov qword [rbx + 0x160], rax
and dx, 0x3ff
cmp dx, 0x12
setne dl
cmp ax, 0x804
setne al
movzx eax, al
and eax, edx
mov dword [rbx + 0x12c], eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400671db
Capabilities:
Log keystrokes via input method manager

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor r9d, r9d
movzx edi, word [rcx + 0x160]
mov rbp, rdx
mov r12d, r8d
mov rbx, rcx
xor r8d, r8d
mov edx, r12d
mov rcx, rbp
call sub.IMM32.dll_ImmGetCompositionStringW
mov esi, eax
test eax, eax
jle 0x14006723e
cmp dword [rbx + 0xe0], eax
jge 0x14006723e
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
je 0x140067225
call fcn.14004149f
movsxd rcx, esi
add rcx, 2
call fcn.1400413db
mov dword [rbx + 0xe0], esi
mov qword [rbx + 0xd8], rax
mov r9d, dword [rbx + 0xe0]
mov r8, qword [rbx + 0xd8]
mov edx, r12d
mov rcx, rbp
call sub.IMM32.dll_ImmGetCompositionStringW
xor edx, edx
mov rcx, rbp
test eax, eax
mov esi, edx
mov edx, pe_nt_image_headers64
cmovns esi, eax
xor r9d, r9d
xor r8d, r8d
sub edi, 0x404
call sub.IMM32.dll_ImmGetCompositionStringW
movsxd rsi, esi
movzx eax, ax
shr rsi, 1
and edi, 0xfffffbff
mov dword [rbx + 0x104], eax
mov r12d, esi
jne 0x1400672e7
test eax, eax
je 0x1400672e7
movsxd rdx, dword [rbx + 0xe0]
shr rdx, 1
cmp eax, edx
jge 0x1400672e7
mov rdx, qword [rbx + 0xd8]
mov dx, word [rdx]
cmp dx, 0x3000
je 0x1400672bc
cmp dx, 0x20
jne 0x1400672e7
inc eax
movsxd rdx, eax
add rdx, rdx
mov rcx, qword [rbx + 0xd8]
cmp eax, r12d
jge 0x1400672e3
mov r8w, word [rcx + rdx]
inc eax
mov word [rcx + rdx - 2], r8w
add rdx, 2
jmp 0x1400672c4
lea r12d, [rsi - 1]
mov rdx, qword [rbx + 0xd8]
movsxd rax, r12d
mov word [rdx + rax*2], 0
cmp dword [rbx + 0x104], 0
jne 0x140067394
test r12d, r12d
jle 0x140067394
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
mov rcx, rbp
call sub.IMM32.dll_ImmGetCompositionStringW
xor esi, esi
mov edi, eax
test eax, eax
jle 0x14006738e
movsxd rcx, eax
xor esi, esi
add rcx, 2
call fcn.1400413db
mov r9d, edi
mov edx, 0x10
mov rcx, rbp
mov r8, rax
mov r12, rax
call sub.IMM32.dll_ImmGetCompositionStringW
mov al, byte [r12 + rsi]
and eax, 0xfffffffd
dec al
je 0x140067366
lea rax, [rsi + 1]
cmp edi, eax
jle 0x140067364
mov rsi, rax
jmp 0x14006734c
inc esi
movsxd rax, esi
cmp edi, eax
jle 0x140067381
mov dl, byte [r12 + rax]
lea rcx, [rax + 1]
and edx, 0xfffffffd
dec dl
jne 0x140067381
mov rax, rcx
jmp 0x140067369
cmp edi, esi
mov rcx, r12
cmovne esi, eax
call fcn.14004149f
mov dword [rbx + 0x104], esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140067f63
Capabilities:
Log keystrokes

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x828
xor ebx, ebx
lea r13, [0x1401a4160]
lea rbp, [rsp + 0x20]
mov edi, ecx
mov rcx, rbp
call fcn.14001153f
mov r12, qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov esi, dword [r13 + rbx*4]
test esi, esi
je 0x140067fd0
test byte [rsp + rsi*4 + 0x23], 0x40
jne 0x140067fd0
mov ecx, ebx
mov edx, 1
call r12
mov ecx, eax
test eax, eax
je 0x140067fd0
mov edx, 2
call r12
and eax, 0x7fff
je 0x140067fd0
lea ecx, [rax - 0x41]
lea edx, [rax + 0x20]
cmp ecx, 0x1a
cmovb eax, edx
mov dword [rsp + rsi*4 + 0x20], eax
inc rbx
cmp rbx, 0x80
jne 0x140067f91
mov r9d, edi
mov r8d, 0x200
mov rdx, rbp
xor ecx, ecx
call fcn.140011551
nop
add rsp, 0x828
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x140068000
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
xor r8d, r8d
xor edx, edx
xor eax, eax
mov rbx, qword [rcx + 0x5f8]
xor ecx, ecx
mov qword [rbx + 0xa0], rdx
mov qword [rbx + 0xa8], rdx
mov dword [rbx + 0xb0], ecx
mov ecx, 0x42
mov qword [rbx + 0xb8], r8
mov qword [rbx + 0xc0], r8
mov qword [rbx + 0xd0], r8
mov dword [rbx + 0x98], eax
mov dword [rbx + 0xe0], 0x40
call fcn.1400413db
xor r9d, r9d
xor r10d, r10d
xor edx, edx
mov qword [rbx + 0xd8], rax
lea rcx, [rbx + 0x134]
mov r8d, 0x10
mov word [rax], 0
mov eax, 1
shl rax, 0x20
mov qword [rbx + 0x104], r9
mov qword [rbx + 0x110], r9
mov qword [rbx + 0x118], r9
mov qword [rbx + 0x120], r9
mov dword [rbx + 0x130], r10d
mov word [rbx + 0xe4], 0
mov qword [rbx + 0x128], rax
call fcn.140041675
mov r8d, 0x10
xor edx, edx
lea rcx, [rbx + 0x144]
call fcn.140041675
xor eax, eax
xor r11d, r11d
xor ecx, ecx
mov dword [rbx + 0x1a0], eax
xor eax, eax
mov qword [rbx + 0x1a8], rax
xor eax, eax
mov qword [rbx + 0x154], r11
mov qword [rbx + 0x160], r11
mov qword [rbx + 0x168], r11
mov qword [rbx + 0x170], r11
mov qword [rbx + 0x178], r11
mov qword [rbx + 0x180], r11
mov qword [rbx + 0x188], r11
mov qword [rbx + 0x190], r11
mov qword [rbx + 0x198], r11
mov qword [rbx + 0x1c0], rax
mov qword [rbx + 0x1c8], rax
mov qword [rbx + 0x1b0], 0xffffffffffffffff
mov qword [rbx + 0x1b8], 0xffffffffffffffff
call fcn.140067f63
lea rdx, str.Menu
mov ecx, 0x65
call fcn.1400116f3
lea rdx, str.Left_Windows
mov ecx, 0xe3
call fcn.1400116f3
lea rdx, str.Right_Windows
mov ecx, 0xe7
call fcn.1400116f3
mov rbx, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x14
call rbx
mov ecx, 0x2000
mov edx, eax
and edx, 1
call fcn.140011b48
mov ecx, 0x90
call rbx
mov ecx, 0x1000
mov edx, eax
and edx, 1
call fcn.140011b48
mov ecx, 0x91
call rbx
mov ecx, 0x8000
mov edx, eax
and edx, 1
add rsp, 0x20
pop rbx
jmp fcn.140011b48
Function at 0x140068342
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x150
lea rdi, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetKeyboardState]
xor edx, edx
mov ecx, 0x20
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebx, eax
test eax, eax
je 0x1400683a7
mov r12, qword [sym.imp.USER32.dll_ToUnicode]
mov esi, 5
lea rbp, [rsp + 0x30]
xor eax, eax
mov dword [rsp + 0x20], 0x10
mov r9, rbp
mov r8, rdi
mov dword [rsp + 0x28], eax
mov edx, ebx
mov ecx, 0x20
call r12
test eax, eax
jg 0x1400683a7
dec esi
jne 0x140068381
add rsp, 0x150
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14006ac38
Capabilities:
Query or enumerate registry value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
xor edx, edx
xor eax, eax
xor r9d, r9d
mov rbx, qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, 0x70
mov dword [rsp + 0x54], edx
lea r8, [rsp + 0x34]
xor edx, edx
mov qword [rsp + 0x4c], rax
call rbx
test eax, eax
je 0x14006adf6
xor r9d, r9d
xor edx, edx
lea r8, [rsp + 0x4c]
mov ecx, 3
call rbx
test eax, eax
je 0x14006adf6
cmp dword [rsp + 0x54], 0
movsxd rbx, dword [rsp + 0x34]
je 0x14006add8
lea rax, [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x38], 3
mov r9d, 0x20019
mov dword [rsp + 0x3c], 0x28
lea rdx, str.Control_PanelMouse
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006adf6
lea r12, [rsp + 0x38]
lea r13, [rsp + 0x3c]
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
lea rsi, [rsp + 0xa8]
mov qword [rsp + 0x28], r13
mov r9, r12
mov rbp, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov qword [rsp + 0x20], rsi
lea rdx, str.SmoothMouseXCurve
call rbp
test eax, eax
jne 0x14006adcb
lea rdi, [rsp + 0x58]
mov rcx, rsi
mov rdx, rdi
call fcn.14006a650
mov rcx, qword [rsp + 0x40]
test eax, eax
je 0x14006adcb
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov r9, r12
lea rdx, str.SmoothMouseYCurve
mov qword [rsp + 0x20], rsi
call rbp
test eax, eax
jne 0x14006adcb
lea r9, [rsp + 0x6c]
mov rcx, rsi
mov rdx, r9
call fcn.14006a650
test eax, eax
je 0x14006adcb
movss xmm3, dword [0x1401a45e8]
xor eax, eax
cvtsi2ss xmm2, ebx
xorps xmm4, xmm4
divss xmm2, dword [0x1401a45e4]
movss xmm1, dword [rdi + rax]
xorps xmm0, xmm0
comiss xmm1, xmm4
jbe 0x14006ad9d
movss xmm0, dword [r9 + rax]
divss xmm0, xmm1
mulss xmm0, xmm2
divss xmm0, xmm3
lea rdx, [rsp + 0x80]
movss dword [rdx + rax*2], xmm1
movss dword [rsp + rax*2 + 0x84], xmm0
add rax, 4
cmp rax, 0x14
jne 0x14006ad82
mov ecx, 0xa
call fcn.1400126b2
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14006adf6
lea eax, [rbx - 1]
cmp eax, 0x13
ja 0x14006adf6
lea rax, [0x1401468c0]
mov ecx, 1
lea rdx, [rax + rbx*4]
call fcn.1400126b2
nop
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14006ae06
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rsi, [fcn.14006a85f]
call fcn.1400126a2
lea rdx, [0x14006a808]
lea rcx, [0x14006a7b6]
mov qword [rax], rsi
lea rsi, [0x14006aadb]
mov qword [rax + 8], rdx
lea rdx, [fcn.14006a7e9]
mov qword [rax + 0x10], rsi
lea rsi, [0x14006ab58]
mov qword [rax + 0x20], rdx
lea rdx, [0x14006a7b1]
mov qword [rax + 0x28], rsi
lea rsi, [0x14006aa91]
mov qword [rax + 0x30], rcx
lea rcx, [0x14006a68c]
mov qword [rax + 0x38], rdx
mov edx, 0x10
mov qword [rax + 0x48], rcx
mov ecx, 1
mov qword [rax + 0x40], rsi
call fcn.140041414
mov rbx, rax
test rax, rax
je 0x14006ae9d
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbx + 8], rax
jmp 0x14006aea4
xor ecx, ecx
call fcn.140078cc6
mov rcx, rbx
call fcn.140012cd2
mov dword [rsp + 0x20], 0x16362004
mov r9d, 0x20
xor ecx, ecx
mov r8d, 0x20
mov edx, 0x20
call fcn.1400490d3
mov rbx, rax
test rax, rax
je 0x14006aeef
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.14006a85f
mov rcx, rbx
mov rsi, rax
call fcn.140049022
mov rbx, rsi
mov qword [0x1401eab60], rbx
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.14006ac38

Function at 0x14006e83e
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov r10, rdx
mov rdx, qword [rcx + 0x48]
mov qword [rcx + 0x68], r8
mov rbx, rcx
mov r9, rbx
test rdx, rdx
setne al
xor ecx, ecx
shl eax, 0x10
mov dword [rsp + 0x3c], ecx
test r10, r10
lea rcx, [rsp + 0x3c]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
je 0x14006e886
lea r8, [0x14006e81f]
xor ecx, ecx
call r10
jmp 0x14006e895
lea r8, [0x14006e800]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
cmp qword [rbx + 8], 0
jne 0x14006e8b1
lea rcx, str.Not_enough_resources_to_create_thread
add rsp, 0x40
pop rbx
jmp fcn.140078bd0
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x14006ea50
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentThreadId
cmp qword [0x1401ea9c8], 0
mov esi, eax
jne 0x140041d3a
lea rdi, [0x1401ea9b4]
mov rcx, rdi
call fcn.140079ba0
cmp qword [0x1401ea9c8], 0
jne 0x140041d32
call fcn.14006e2c1
mov rbx, rax
mov qword [0x1401ea9c8], rax
test rax, rax
jne 0x140041d32
mov rcx, rdi
call fcn.140079bd2
jmp 0x140041d6e
mov rcx, rdi
call fcn.140079bd2
mov rcx, qword [0x1401ea9c8]
call fcn.14006e392
mov rbx, qword [0x1401ea9c0]
test rbx, rbx
je 0x140041d62
cmp dword [rbx], esi
jne 0x140041d5c
mov rbx, qword [rbx + 8]
jmp 0x140041d62
mov rbx, qword [rbx + 0x10]
jmp 0x140041d4d
mov rcx, qword [0x1401ea9c8]
call fcn.14006e3b0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
push rbx
sub rsp, 0x20
cmp dword [0x140146960], 0xffffffff
mov eax, dword [0x1401eacd4]
jne 0x14006eab8
test eax, eax
je 0x14006ea72
add rsp, 0x20
pop rbx
jmp 0x140041ce3
lea rbx, [0x1401eacd0]
mov rcx, rbx
call fcn.140079ba0
cmp dword [0x140146960], 0xffffffff
jne 0x14006eab0
cmp dword [0x1401eacd4], 0
jne 0x14006eab0
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14006eaa6
mov dword [0x140146960], eax
jmp 0x14006eab0
mov dword [0x1401eacd4], 1
mov rcx, rbx
call fcn.140079bd2
cmp dword [0x1401eacd4], 0
jne 0x14006ea68
mov ecx, dword [0x140146960]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x14006ead3
Capabilities:
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sub.KERNEL32.dll_GetCurrentThreadId
mov rcx, qword [0x1401ea9c8]
mov edi, eax
call fcn.14006e392
mov rbx, qword [0x1401ea9c0]
xor eax, eax
test rbx, rbx
je 0x140041ddc
cmp dword [rbx], edi
jne 0x140041dd3
test rsi, rsi
je 0x140041db3
mov qword [rbx + 8], rsi
jmp 0x140041e06
mov rdx, qword [rbx + 0x10]
test rax, rax
je 0x140041dc2
mov qword [rax + 0x10], rdx
jmp 0x140041dc9
mov qword [0x1401ea9c0], rdx
mov rcx, rbx
call fcn.14004149f
jmp 0x140041e06
mov rax, rbx
mov rbx, qword [rbx + 0x10]
jmp 0x140041d9f
mov ecx, 0x18
call fcn.1400413db
mov rbx, rax
test rax, rax
je 0x140041e06
mov dword [rax], edi
mov qword [rax + 8], rsi
mov rax, qword [0x1401ea9c0]
mov qword [0x1401ea9c0], rbx
mov qword [rbx + 0x10], rax
mov rcx, qword [0x1401ea9c8]
call fcn.14006e3b0
test rbx, rbx
jne 0x140041e25
xor ecx, ecx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140078cc6
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
sub rsp, 0x28
cmp dword [0x1401eacd4], 0
je 0x14006eae9
add rsp, 0x28
jmp 0x140041d79
mov rdx, rcx
mov ecx, dword [0x140146960]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x14006eb0c
lea rcx, str.TlsSetValue___failed
add rsp, 0x28
jmp fcn.140078bd0
xor eax, eax
add rsp, 0x28
ret
Function at 0x14006f300
Capabilities:
Get geographical location

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r9d, 0x10
mov r13, qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea rbp, [rsp + 0x30]
mov rbx, rcx
mov rsi, rdx
mov ecx, 0x400
mov r8, rbp
mov edx, 0x59
lea r12, [rsp + 0x40]
call r13
mov r8, r12
mov edx, 0x5a
mov ecx, 0x400
mov edi, eax
mov r9d, 0x10
call r13
test edi, edi
jne 0x14006f363
lea rcx, str.Couldnt_obtain_language_info
call fcn.140078bd0
jmp 0x14006f39e
lea rdx, [0x1401a5462]
test eax, eax
lea rax, [0x1401a5460]
mov r9, rbp
mov rcx, rdx
cmovne rdx, r12
lea r8, str._s_s_s
cmovne rcx, rax
mov qword [rsp + 0x28], rdx
mov rdx, rsi
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call fcn.140041a6b
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
push rbp
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
xor eax, eax
xor r8d, r8d
lea r14, [rbp - 4]
lea r13, [rbp - 8]
mov dword [rbp - 8], eax
mov rdi, rcx
mov dword [rbp - 4], eax
mov r12, rdx
mov r9, r14
mov rdx, r13
mov ecx, 8
call qword [0x1401ead08]
mov esi, dword [rbp - 4]
add rsi, rsi
cmp rsi, 0x7f
ja 0x14006f40f
lea rax, [rsi + 0xf]
shr rax, 4
shl rax, 4
call fcn.140123670
sub rsp, rax
lea rbx, [rsp + 0x20]
jmp 0x14006f428
mov rcx, rsi
call fcn.1400413db
mov rbx, rax
test rax, rax
jne 0x14006f428
xor ecx, ecx
call fcn.140078cc6
jmp 0x14006f4a0
mov r9, r14
mov r8, rbx
mov rdx, r13
mov ecx, 8
call qword [0x1401ead08]
test eax, eax
jne 0x14006f44d
mov rdx, r12
mov rcx, rdi
call 0x14006f300
jmp 0x14006f491
mov eax, dword [rbp - 4]
mov r10b, 0x5f
lea edx, [rax - 1]
cmp r12, rdx
mov rax, rdx
cmovb eax, r12d
xor edx, edx
xor ecx, ecx
cmp edx, eax
jae 0x14006f48d
mov r9w, word [rbx + rdx*2]
mov r8d, r9d
test r9b, r9b
je 0x14006f47f
cmp r9b, 0x2d
cmove r8d, r10d
jmp 0x14006f484
mov ecx, edx
mov r8b, 0x2c
mov byte [rdi + rdx], r8b
inc rdx
jmp 0x14006f464
mov byte [rdi + rcx], 0
cmp rsi, 0x7f
jbe 0x14006f4a0
mov rcx, rbx
call fcn.14004149f
nop
mov rsp, rbp
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
push rsi
push rbx
sub rsp, 0x28
cmp qword [0x1401ead00], 0
mov rbx, rcx
mov rsi, rdx
jne 0x14006f4f4
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x1401ead00], rax
mov rcx, rax
test rax, rax
je 0x14006f4f4
lea rdx, str.GetUserPreferredUILanguages
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401ead08], rax
cmp qword [0x1401ead08], 0
mov rdx, rsi
mov rcx, rbx
jne 0x14006f50f
add rsp, 0x28
pop rbx
pop rsi
jmp 0x14006f300
add rsp, 0x28
pop rbx
pop rsi
jmp 0x14006f3ab