joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800bba80
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1800bbab1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18033d8d8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18033d8e8]
lea rdx, [rdi + rdi]
call fcn.18003e260
mov rcx, qword [0x18033d8d8]
lea r9, [rdi - 1]
mov qword [0x18033d900], r9
mov qword [0x18033d908], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1800bbc56
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x14]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x15]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x16]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x17]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18033d8e8]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1800bbb9c
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1800bbc17
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x1800bbbd9
mov r10, qword [rax]
cmp r10, rcx
je 0x1800bbbd3
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1800bbc17
mov r8, rax
cmp r10, rax
je 0x1800bbbf3
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x1800bbc2b
cmp r10, rax
jne 0x1800bbbe1
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x1800bbc51
mov r9, qword [0x18033d900]
jmp 0x1800bbb21
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1800bbc17
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800bccf0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
mov eax, 0x1e60
call fcn.1801ef4d0
sub rsp, rax
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rsp + 0x1e50], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
mov eax, dword [rsp + 0x50]
lea rdx, str.__02d:_02d:_02d____s_n
mov r9d, dword [rsp + 0x54]
lea rcx, [rsp + 0x78]
mov r8d, dword [rsp + 0x58]
mov dword [rsp + 0x20], eax
call fcn.1800bd0d0
lea rbx, [rsp + 0x1e78]
call fcn.18003b850
mov rcx, qword [rsp + 0x1e70]
lea rdx, [rsp + 0x10a0]
mov qword [rsp + 0x30], rbx
mov r9d, 0xdac
mov qword [rsp + 0x28], 0
mov r8d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsnprintf_s]
lea r8, [rsp + 0x10a0]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0xa0]
call fcn.180035a60
cmp byte [0x1802b9988], 0
je 0x1800bce1e
lea r8, [0x180208b80]
lea rdx, [0x180335c50]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x1800bce0a
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0xa0]
lea rdx, [0x18020df14]
call fcn.1800bd190
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0xa0]
call fcn.18003e670
lea r8, [rsp + 0x10a0]
lea rdx, [0x18020fc68]
lea rcx, [rsp + 0xa0]
call fcn.180035a60
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x1e50]
xor rcx, rsp
call fcn.1801e6af0
add rsp, 0x1e60
pop rbx
ret
Function at 0x1800bcfc0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x1e58
call fcn.1801ef4d0
sub rsp, rax
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rsp + 0x1e40], rax
call fcn.1800bd1f0
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_time_l1_1_0.dll__localtime64_s
mov eax, dword [rsp + 0x40]
lea rdx, str.__02d:_02d:_02d__FATAL:___s_n
mov r9d, dword [rsp + 0x44]
lea rcx, [rsp + 0x68]
mov r8d, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
call fcn.1800bd0d0
mov r8, qword [rsp + 0x1e60]
lea r9, [rsp + 0x1e68]
lea rcx, [rsp + 0x90]
call fcn.1800bd130
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xe40]
call fcn.180035a60
lea r8, [0x180208b80]
lea rdx, [0x180335c50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x1800bd0a7
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0xe40]
lea rdx, [0x18020df14]
call fcn.1800bd190
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r9d, 0x10
lea r8, str.FATAL_ERROR
lea rdx, [rsp + 0xe40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1800bd460
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rcx
mov qword [rsp + 0x20], 0
movdqa xmm0, xmmword [0x180270bf0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call fcn.18003bfd0
nop
movabs r9, 0xcbf29ce484222325
lea rax, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rax, qword [rsp + 0x20]
lea rdx, [rsp + 0x20]
cmovae rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
add r8, rdx
cmp rax, r8
je 0x1800bd4f3
movabs rdx, 0x100000001b3
nop
imul r9, rdx
movsx rcx, byte [rax]
xor r9, rcx
inc rax
cmp rax, r8
jne 0x1800bd4e0
mov qword [rsi + 0x40], r9
mov byte [rsi + 0x68], 0
lea r8, [rsi + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.1800bd200
mov rax, qword [rsi + 0x30]
mov qword [rsi + 0x48], rax
mov rbx, qword [0x18033c900]
lea r8, [rbx + 8]
mov rax, qword [r8]
mov rdi, rbx
cmp byte [rax + 0x19], 0
jne 0x1800bd558
mov rdx, qword [rsi + 0x40]
nop
mov rcx, qword [rax + 0x20]
cmp rcx, rdx
jae 0x1800bd53f
mov rax, qword [rax + 0x10]
jmp 0x1800bd552
cmp byte [rdi + 0x19], 0
je 0x1800bd54c
cmp rdx, rcx
cmovb rdi, rax
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1800bd530
cmp byte [rdi + 0x19], 0
cmove r8, rdi
mov rax, qword [r8]
cmp byte [rax + 0x19], 0
jne 0x1800bd588
mov rcx, qword [rsi + 0x40]
nop dword [rax]
cmp rcx, qword [rax + 0x20]
jae 0x1800bd57e
mov rdi, rax
mov rax, qword [rax]
jmp 0x1800bd582
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
je 0x1800bd570
cmp rbx, rdi
je 0x1800bd609
nop dword [rax]
mov rdx, qword [rbx + 0x28]
mov rcx, rsi
call fcn.1800bd7e0
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x1800bd5c8
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1800bd5c3
cmp rbx, qword [rax + 0x10]
jne 0x1800bd5c3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1800bd5b0
mov rbx, rax
jmp 0x1800bd5ef
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x1800bd5ef
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x1800bd5e0
cmp rbx, rdi
jne 0x1800bd590
mov rax, qword [rsi + 0x58]
sub rax, qword [rsi + 0x50]
sar rax, 3
test rax, rax
je 0x1800bd609
mov byte [rsi + 0x68], 1
lea rcx, [rsp + 0x20]
call fcn.18003be10
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e6af0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800be410
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor edi, edi
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], 0xf
mov byte [rbp - 0x41], dil
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x1800be460
mov rdx, rax
lea rcx, [rbp - 0x41]
call fcn.18003bfd0
nop
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rbp - 0x31]
sub rax, rcx
cmp rax, 0xd
jb 0x1800be5d2
lea r9, [rbp - 0x41]
cmp qword [rbp - 0x29], 0x10
cmovae r9, qword [rbp - 0x41]
mov qword [rsp + 0x30], 0xd
lea rax, str..exFilLocat_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 1]
call fcn.180035cc0
nop
mov qword [rbp - 0x61], rdi
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], 0xf
mov byte [rbp - 0x61], 0
mov r8d, 0xb
lea rdx, str.headerr.ytd
lea rcx, [rbp - 0x61]
call fcn.18003bfd0
nop
mov rcx, qword [rbp + 0xf]
sub rbx, rcx
mov rdx, qword [rbp - 0x51]
cmp rbx, rdx
jb 0x1800be5cc
lea r9, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae r9, qword [rbp - 1]
lea rax, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae rax, qword [rbp - 0x61]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x21]
call fcn.180035cc0
nop
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rcx, qword [rbp - 0x21]
lea rdx, [rbp + 0x1f]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x1800be584
lea r9, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae r9, qword [rbp - 0x61]
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rdx, qword [rbp - 0x21]
mov byte [rsp + 0x20], al
mov r8b, 1
lea rcx, [rbp - 0x69]
call qword [0x18033c918]
nop
lea rcx, [rbp - 0x21]
call fcn.18003be10
nop
lea rcx, [rbp - 0x61]
call fcn.18003be10
nop
lea rcx, [rbp - 1]
call fcn.18003be10
nop
lea rcx, [rbp - 0x41]
call fcn.18003be10
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1801e6af0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.18003be80
nop
call fcn.18003be80
int3
Function at 0x1800be730
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor edi, edi
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], 0xf
mov byte [rbp - 0x41], dil
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x1800be780
mov rdx, rax
lea rcx, [rbp - 0x41]
call fcn.18003bfd0
nop
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rbp - 0x31]
sub rax, rcx
cmp rax, 0xd
jb 0x1800be8f2
lea r9, [rbp - 0x41]
cmp qword [rbp - 0x29], 0x10
cmovae r9, qword [rbp - 0x41]
mov qword [rsp + 0x30], 0xd
lea rax, str..exFilLocat_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 1]
call fcn.180035cc0
nop
mov qword [rbp - 0x61], rdi
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], 0xf
mov byte [rbp - 0x61], 0
mov r8d, 0xe
lea rdx, str.exFilLocat.ytd
lea rcx, [rbp - 0x61]
call fcn.18003bfd0
nop
mov rcx, qword [rbp + 0xf]
sub rbx, rcx
mov rdx, qword [rbp - 0x51]
cmp rbx, rdx
jb 0x1800be8ec
lea r9, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae r9, qword [rbp - 1]
lea rax, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae rax, qword [rbp - 0x61]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x21]
call fcn.180035cc0
nop
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rcx, qword [rbp - 0x21]
lea rdx, [rbp + 0x1f]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x1800be8a4
lea r9, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae r9, qword [rbp - 0x61]
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rdx, qword [rbp - 0x21]
mov byte [rsp + 0x20], al
mov r8b, 1
lea rcx, [rbp - 0x69]
call qword [0x18033c918]
nop
lea rcx, [rbp - 0x21]
call fcn.18003be10
nop
lea rcx, [rbp - 0x61]
call fcn.18003be10
nop
lea rcx, [rbp - 1]
call fcn.18003be10
nop
lea rcx, [rbp - 0x41]
call fcn.18003be10
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1801e6af0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.18003be80
nop
call fcn.18003be80
int3
Function at 0x1800be900
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor edi, edi
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], 0xf
mov byte [rbp - 0x41], dil
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x1800be950
mov rdx, rax
lea rcx, [rbp - 0x41]
call fcn.18003bfd0
nop
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rbp - 0x31]
sub rax, rcx
cmp rax, 0xd
jb 0x1800beac2
lea r9, [rbp - 0x41]
cmp qword [rbp - 0x29], 0x10
cmovae r9, qword [rbp - 0x41]
mov qword [rsp + 0x30], 0xd
lea rax, str..exFilLocat_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 1]
call fcn.180035cc0
nop
mov qword [rbp - 0x61], rdi
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], 0xf
mov byte [rbp - 0x61], 0
mov r8d, 0xe
lea rdx, str.Explos1ve1.ytd
lea rcx, [rbp - 0x61]
call fcn.18003bfd0
nop
mov rcx, qword [rbp + 0xf]
sub rbx, rcx
mov rdx, qword [rbp - 0x51]
cmp rbx, rdx
jb 0x1800beabc
lea r9, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae r9, qword [rbp - 1]
lea rax, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae rax, qword [rbp - 0x61]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x21]
call fcn.180035cc0
nop
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rcx, qword [rbp - 0x21]
lea rdx, [rbp + 0x1f]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x1800bea74
lea r9, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae r9, qword [rbp - 0x61]
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rdx, qword [rbp - 0x21]
mov byte [rsp + 0x20], al
mov r8b, 1
lea rcx, [rbp - 0x69]
call qword [0x18033c918]
nop
lea rcx, [rbp - 0x21]
call fcn.18003be10
nop
lea rcx, [rbp - 0x61]
call fcn.18003be10
nop
lea rcx, [rbp - 1]
call fcn.18003be10
nop
lea rcx, [rbp - 0x41]
call fcn.18003be10
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1801e6af0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.18003be80
nop
call fcn.18003be80
int3
Function at 0x1800bead0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor edi, edi
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], 0xf
mov byte [rbp - 0x41], dil
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x1800beb20
mov rdx, rax
lea rcx, [rbp - 0x41]
call fcn.18003bfd0
nop
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rbp - 0x31]
sub rax, rcx
cmp rax, 0xd
jb 0x1800bec92
lea r9, [rbp - 0x41]
cmp qword [rbp - 0x29], 0x10
cmovae r9, qword [rbp - 0x41]
mov qword [rsp + 0x30], 0xd
lea rax, str..exFilLocat_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 1]
call fcn.180035cc0
nop
mov qword [rbp - 0x61], rdi
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], 0xf
mov byte [rbp - 0x61], 0
mov r8d, 0xa
lea rdx, str.maping.ytd
lea rcx, [rbp - 0x61]
call fcn.18003bfd0
nop
mov rcx, qword [rbp + 0xf]
sub rbx, rcx
mov rdx, qword [rbp - 0x51]
cmp rbx, rdx
jb 0x1800bec8c
lea r9, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae r9, qword [rbp - 1]
lea rax, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae rax, qword [rbp - 0x61]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x21]
call fcn.180035cc0
nop
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rcx, qword [rbp - 0x21]
lea rdx, [rbp + 0x1f]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x1800bec44
lea r9, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae r9, qword [rbp - 0x61]
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rdx, qword [rbp - 0x21]
mov byte [rsp + 0x20], al
mov r8b, 1
lea rcx, [rbp - 0x69]
call qword [0x18033c918]
nop
lea rcx, [rbp - 0x21]
call fcn.18003be10
nop
lea rcx, [rbp - 0x61]
call fcn.18003be10
nop
lea rcx, [rbp - 1]
call fcn.18003be10
nop
lea rcx, [rbp - 0x41]
call fcn.18003be10
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1801e6af0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.18003be80
nop
call fcn.18003be80
int3
Function at 0x1800beca0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor edi, edi
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], 0xf
mov byte [rbp - 0x41], dil
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x1800becf0
mov rdx, rax
lea rcx, [rbp - 0x41]
call fcn.18003bfd0
nop
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rbp - 0x31]
sub rax, rcx
cmp rax, 0xd
jb 0x1800bee62
lea r9, [rbp - 0x41]
cmp qword [rbp - 0x29], 0x10
cmovae r9, qword [rbp - 0x41]
mov qword [rsp + 0x30], 0xd
lea rax, str..exFilLocat_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 1]
call fcn.180035cc0
nop
mov qword [rbp - 0x61], rdi
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], 0xf
mov byte [rbp - 0x61], 0
mov r8d, 0xc
lea rdx, str.Vehicles.ytd
lea rcx, [rbp - 0x61]
call fcn.18003bfd0
nop
mov rcx, qword [rbp + 0xf]
sub rbx, rcx
mov rdx, qword [rbp - 0x51]
cmp rbx, rdx
jb 0x1800bee5c
lea r9, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae r9, qword [rbp - 1]
lea rax, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae rax, qword [rbp - 0x61]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x21]
call fcn.180035cc0
nop
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rcx, qword [rbp - 0x21]
lea rdx, [rbp + 0x1f]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x1800bee14
lea r9, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae r9, qword [rbp - 0x61]
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rdx, qword [rbp - 0x21]
mov byte [rsp + 0x20], al
mov r8b, 1
lea rcx, [rbp - 0x69]
call qword [0x18033c918]
nop
lea rcx, [rbp - 0x21]
call fcn.18003be10
nop
lea rcx, [rbp - 0x61]
call fcn.18003be10
nop
lea rcx, [rbp - 1]
call fcn.18003be10
nop
lea rcx, [rbp - 0x41]
call fcn.18003be10
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1801e6af0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.18003be80
nop
call fcn.18003be80
int3
Function at 0x1800c2350
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x60
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov ecx, 0x79
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x1800c23a4
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.https:__youtu.be_XLXJfG5VjF0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov r8, qword [0x1802b8220]
mov rax, r8
shr rax, 0x20
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [0x18033d854]
cvttss2si eax, xmm0
mov rdx, qword [0x1802b8218]
mov rcx, rdx
shr rcx, 0x20
movss xmm0, dword [0x1802b818c]
movaps xmm1, xmm0
subss xmm1, dword [0x18026c074]
subss xmm0, dword [0x18026be9c]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
movss xmm3, dword [0x18026beec]
movss xmm2, dword [0x18026c0f8]
call fcn.1800ce060
movss xmm2, dword [0x1802b818c]
movaps xmm3, xmm2
subss xmm3, dword [0x18026c088]
addss xmm2, dword [0x18026bef4]
movss xmm0, dword [0x18026c184]
movss dword [rsp + 0x28], xmm0
movss xmm1, dword [0x18026bef0]
movss dword [rsp + 0x20], xmm1
call fcn.1800c1e30
mov rdx, rdi
mov rcx, rsi
call fcn.1800c20a0
mov eax, dword [0x180335e88]
cmp dword [0x180335d54], eax
jne 0x1800c24b8
cmp byte [0x180334bb3], 0
je 0x1800c24b8
mov rcx, qword [rbx + 0x38]
test rcx, rcx
jne 0x1800c2482
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1800c24a6
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], 0
mov al, 1
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1800c24d5
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], 0
xor al, al
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1800ce3a0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], rbx
cmp qword [rcx + 0x18], 0x10
jb 0x1800ce3df
mov rcx, qword [rcx]
mov rdx, rbx
cmp qword [r9 + 0x18], 0x10
jb 0x1800ce3ec
mov rdx, qword [r9]
mov rax, rdi
cmp qword [r8 + 0x18], 0x10
jb 0x1800ce3f9
mov rax, qword [r8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x64
lea r9, [rsp + 0x40]
lea r8, str.NULL
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], 0xf
mov byte [rsi], al
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800ce440
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.18003bfd0
nop
mov rcx, rdi
call fcn.18003be10
nop
mov rcx, rbx
call fcn.18003be10
mov rax, rsi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1801e6af0
add rsp, 0xc0
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800ce660
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, 0xffffffff
xor ebx, ebx
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x1800ce68f
test ebx, ebx
je 0x1800ce68f
cmp ebx, 0x65
cmovne edi, ebx
inc ebx
cmp ebx, 0xff
jl 0x1800ce676
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800cf490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1800cf4aa
test al, 0x10
je 0x1800cf4aa
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret