joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180156b60
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x180156ba2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x180156be9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x180156c42
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x180156c00
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x180156c83
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1801bc0db]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1801bc0dc]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x180156c50
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x180156d34
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x180156d6e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x180156d73
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180156dbc
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x180156dbc
dec r8
sub rdx, 1
jne 0x180156da2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x100001210
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1000da584]
cmp ecx, 0xffffffff
je 0x100021ea2
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
setne al
add rsp, 0x28
ret
xor al, al
jmp 0x10000122f

Function at 0x100001634
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x450
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor r12d, r12d
mov rsi, rcx
mov edi, r12d
cmp byte [rcx + 0x4e8], r12b
je 0x100011a21
mov eax, edi
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1000031d0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
lea rbx, [rcx + 0xa]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
lea rbp, [rsi + 0x212]
cmp eax, r12d
je 0x10002a848
mov edx, 0x104
mov rcx, rbp
sub rbx, rbp
lea rax, [rdx + 0x7ffffefa]
cmp rax, r12
je 0x100011a6c
movzx eax, word [rbx + rcx]
cmp ax, r12w
je 0x100011a6c
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x100011a49
cmp rdx, r12
je 0x10002a83a
cmp edi, r12d
mov word [rcx], r12w
jl 0x100001671
mov byte [rsi + 8], 1
jmp 0x100011a88
lea r9, [0x1000aedbc]
lea r8, [rsp + 0x20]
lea rcx, [0x1000aee3c]
mov edx, 0x26
call fcn.100006290
lea rcx, [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, 0x80004005
cmp eax, r12d
cmove ebx, ecx
cmp ebx, r12d
jl 0x100011af6
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathCommonPrefixW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp ebx, eax
sete al
mov byte [rsi + 9], al
cmp al, r12b
je 0x10002a8bc
mov byte [rsi + 0x4e8], 1
jmp 0x100001671
sub rcx, 2
mov edi, 0x8007007a
jmp 0x100011a75
lea r9, [0x1000aed74]
lea rcx, str.GADGETS_USER
mov r8, rbp
mov edx, 0x801c
call fcn.100006290
cmp eax, r12d
mov edi, eax
jl 0x100001671
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdx, rbp
mov rcx, rbp
mov r8, rax
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
cmp rax, r12
jne 0x10002a8b3
call sub.KERNEL32.dll_GetLastError
cmp eax, r12d
je 0x10002a8a9
movzx edi, ax
or edi, 0x80070000
cmp eax, r12d
cmovle edi, eax
jmp 0x100001671
mov edi, 0x80004005
jmp 0x100001671
mov byte [rsi + 8], r12b
jmp 0x100011a88
lea r9, [0x1000aedf4]
lea r8, [rsp + 0x20]
lea rcx, str.GADGETS_SHARED
mov edx, 0x26
call fcn.100006290
cmp eax, r12d
jl 0x100011af6
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathCommonPrefixW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp ebx, eax
sete al
mov byte [rsi + 9], al
jmp 0x100011af6
Function at 0x1000017e0
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rdi, rdx
mov bpl, r8b
mov rsi, rcx
and bpl, 1
test rdx, rdx
mov r12d, r8d
cmove rdi, rcx
mov dl, bpl
mov rcx, rdi
call fcn.100004f64
mov rbx, rax
test rax, rax
jne 0x100001853
mov r8b, bpl
mov rdx, rdi
mov rcx, rsi
call fcn.100005330
mov rbx, rax
test rax, rax
jne 0x100001853
mov rdi, qword [rdi + 0x80]
test rdi, rdi
jne 0x100001823
mov dl, bpl
mov rcx, rsi
call fcn.100004f64
mov rbx, rax
test rbx, rbx
je 0x100022846
mov ecx, dword [0x1000da584]
mov eax, r12d
shr eax, 2
and al, 1
mov byte [rsi + 0x1ad], al
cmp ecx, 0xffffffff
je 0x100001891
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x100001891
cmp qword [rax + 0x30], 0
je 0x100001891
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx]
call qword [rdx + 0x20]
mov r8d, r12d
mov rdx, rbx
mov rcx, rsi
call fcn.1000018d0
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x20]
mov al, 1
jmp 0x1000018ad
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
xor al, al
jmp 0x1000018ad
Function at 0x1000018d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
sub rsp, 0x60
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
call fcn.100001210
test al, al
je 0x100001a81
cmp byte [rsi + 0x1a9], 0
jne 0x100001a81
mov byte [rsi + 0x1a9], 1
test rbx, rbx
je 0x100001922
mov eax, dword [rbx + 0x44]
and eax, 0x26
cmp al, 0x26
jne 0x10002317c
mov edx, dword [0x1000da584]
or r12d, 0xffffffff
cmp edx, r12d
je 0x100023191
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [0x1000da584]
cmp rbx, qword [rax + 0x30]
je 0x100001a7a
and dword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0x38
mov dword [rsp + 0x24], 0x8004
cmp edx, r12d
je 0x100023198
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [0x1000da584]
mov rax, qword [rax + 0x30]
and dword [rsp + 0x50], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x54], edi
cmp edx, r12d
je 0x10002319f
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [0x1000da584]
cmp qword [rax + 0x30], 0
je 0x100001a1b
mov dword [rsp + 0x38], 1
cmp edx, r12d
je 0x1000231a6
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rax + 0x30]
lea rcx, [rsp + 0x20]
xor edx, edx
mov qword [rsp + 0x28], rax
call fcn.100001aa0
mov edx, dword [0x1000da584]
cmp edx, r12d
je 0x1000231ad
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [0x1000da584]
mov rdi, rax
cmp edx, r12d
je 0x1000231b1
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [0x1000da584]
mov rcx, qword [rdi + 0x30]
mov qword [rax + 0x38], rcx
cmp edx, r12d
je 0x1000231b8
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [0x1000da584]
and qword [rax + 0x30], 0
test rbx, rbx
je 0x100001a65
and dword [rsp + 0x38], 0
lea rcx, [rsp + 0x20]
xor edx, edx
mov qword [rsp + 0x28], rbx
call fcn.100001aa0
mov edx, 0x8005
mov rcx, rbx
call fcn.100003250
mov edx, dword [0x1000da584]
cmp edx, r12d
je 0x1000231bf
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rax + 0x30], rbx
mov byte [rsi + 0x1a9], 0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret
mov rbx, qword [rbx + 0x80]
test rbx, rbx
je 0x100001922
jmp 0x100001914
xor eax, eax
jmp 0x100001943
xor eax, eax
jmp 0x100001979
xor eax, eax
jmp 0x1000019a7
xor eax, eax
jmp 0x1000019c7
xor edi, edi
jmp 0x1000231b1
xor eax, eax
jmp 0x100001a13
xor eax, eax
jmp 0x100001a32
xor eax, eax
jmp 0x100001a76
Function at 0x100003110
Capabilities:
Check if file exists
Copy file
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x690
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x680], rax
xor ebp, ebp
mov rdi, rcx
mov ebx, ebp
cmp word [rcx], bp
jne 0x10000319c
lea r9, [0x1000adbd4]
lea r8, [r11 - 0x228]
lea rcx, [0x1000adc0c]
mov edx, 0x801c
call fcn.100006290
cmp eax, ebp
mov ebx, eax
jl 0x10000319c
lea r8, str.Settings.ini
lea rdx, [rsp + 0x470]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
cmp rax, rbp
je 0x100021094
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebp
je 0x100020f39
mov eax, ebx
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.1000031d0
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rcx, qword [0x1000da1f8]
lea rdx, [rsp + 0x260]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, ebp
jne 0x100020f79
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebp
je 0x100021094
movzx ebx, ax
or ebx, 0x80070000
cmp eax, ebp
cmovle ebx, eax
jmp 0x10000319c
lea rcx, [rsp + 0x260]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp eax, ebp
je 0x100021094
lea r8, str.Settings.ini
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
cmp rax, rbp
je 0x100021094
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor r8d, r8d
cmp eax, ebp
je 0x100020fdf
lea rcx, [rsp + 0x50]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, ebp
jne 0x100021076
jmp 0x100020f58
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x100020f58
mov eax, 0xfeff
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov r8d, 2
mov rcx, rsi
mov qword [rsp + 0x20], rbp
mov word [rsp + 0x40], ax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebp
je 0x100020f58
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x44]
mov r8d, 2
mov rcx, rsi
mov word [rsp + 0x44], bp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebp
je 0x100020f58
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.00.00.00.02
lea r8, str.SettingsVersion
xor edx, edx
mov rcx, rdi
call fcn.10000f8c0
nop
jmp 0x10000319c
mov ebx, 0x80004005
jmp 0x10000319c
Function at 0x1000031d0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1000da5c8]
jne 0x10001f6b4
rol rcx, 0x10
test cx, 0xffff
jne 0x10001f6b0
ret 0
ror rcx, 0x10
jmp 0x10009bfc0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1000db1e0]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x1000db2d8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10009c045
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1000db1e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x10009c067
mov rax, qword [rsp + 0x88]
mov qword [0x1000db2d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1000db278], rax
mov rax, qword [0x1000db2d8]
mov qword [0x1000db150], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1000db260], rax
mov dword [0x1000db140], 0xc0000409
mov dword [0x1000db144], 1
mov rax, qword [0x1000da5c8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1000da5d0]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1000afc28]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x100003898
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], r9d
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0x70
xorps xmm0, xmm0
movss xmm1, dword [0x1000ac158]
mov ebx, r9d
mov rbp, r8
mov rdi, rcx
movss dword [rax - 0x48], xmm1
movss dword [rax - 0x44], xmm0
movss dword [rax - 0x40], xmm0
movss dword [rax - 0x3c], xmm0
movss dword [rax - 0x38], xmm1
movss dword [rax - 0x34], xmm0
movss dword [rax - 0x30], xmm0
movss dword [rax - 0x2c], xmm0
movss dword [rax - 0x28], xmm1
mov eax, dword [rax - 0x24]
or eax, 3
test byte [rcx + 0x44], 4
mov dword [rsp + 0x64], eax
je 0x1000039ea
xor esi, esi
cmp byte [rcx + 0x5d], sil
jne 0x1000220bd
test al, 1
je 0x1000220d0
mov eax, dword [rdi + 0x24]
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x38], eax
mov eax, dword [rdi + 0x28]
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x34], esi
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, esi
je 0x1000039ea
cmp dword [rdi + 0x90], esi
jle 0x10000b6ad
mov eax, ebx
and eax, 1
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x90], eax
mov rax, qword [rdi + 0x88]
lea rdx, [rsp + 0x20]
mov rbx, qword [rcx + rax]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + 0x60]
mov r11d, dword [rsp + 0x98]
mov eax, dword [rsp + 0x9c]
sub r11d, dword [rsp + 0x20]
sub eax, dword [rsp + 0x24]
mov r9d, dword [rsp + 0xa8]
mov dword [rsp + 0x20], r11d
mov dword [rsp + 0x24], eax
mov rdx, qword [rsp + 0x20]
mov r8, rbp
mov rcx, rbx
call fcn.100003898
cmp dword [rsp + 0x90], 1
je 0x1000220ee
xor cl, cl
test rax, rax
je 0x10000b68a
test cl, cl
jne 0x10000b68a
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x1000039da
mov rcx, qword [rsp + 0x28]
inc esi
add rcx, 8
cmp esi, dword [rdi + 0x90]
mov qword [rsp + 0x28], rcx
jl 0x100003967
mov ebx, dword [rsp + 0xa8]
test rbp, rbp
je 0x10000b6be
mov rax, qword [rsp + 0x98]
mov qword [rbp], rax
test bl, 1
jne 0x100022109
mov rax, rdi
jmp 0x1000039da
lea rdx, [rsp + 0x40]
call fcn.10003e8b0
mov eax, dword [rsp + 0x64]
jmp 0x10000390f
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x40]
mov r8d, 1
call fcn.1000132b0
nop
jmp 0x100003917
test rax, rax
je 0x1000039c7
bt dword [rax + 0x44], 0xc
jb 0x1000039c7
mov cl, 1
jmp 0x1000039c9
bt dword [rdi + 0x44], 0xc
jb 0x10000b6c7
jmp 0x1000039ea
Function at 0x100003b0c
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x60
mov r12, r8
mov rbp, rdx
mov r13, rcx
call fcn.100001210
xor ebx, ebx
cmp al, bl
je 0x100003c7a
mov ecx, dword [0x1000da584]
or r14d, 0xffffffff
cmp ecx, r14d
je 0x100023102
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x1000da584]
mov rsi, qword [rax + 0x28]
cmp rbp, rbx
je 0x10002310a
mov rdi, qword [rbp]
jmp 0x100003b73
cmp r12, rbx
je 0x100023149
cmp rdi, rbx
je 0x100003b93
test byte [rdi + 0x44], 0x40
je 0x100023112
mov ecx, dword [0x1000da584]
jmp 0x100003b93
cmp rbp, rbx
je 0x100003b9c
mov qword [rbp], rdi
cmp ecx, r14d
je 0x100023154
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x1000da584]
cmp qword [rax + 0x40], r13
jne 0x100003bc0
cmp rsi, rdi
je 0x100003c7a
mov dword [rsp + 0x20], 0x38
mov dword [rsp + 0x24], 0x8004
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x50], 1
cmp rsi, rbx
je 0x100003c0c
mov rax, qword [rsi]
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x38], 1
call qword [rax + 0x18]
mov ecx, dword [0x1000da584]
cmp rdi, rbx
je 0x10001bd49
mov rax, qword [rdi]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x38], ebx
call qword [rax + 0x18]
mov ecx, dword [0x1000da584]
cmp ecx, r14d
je 0x10002315c
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x1000da584]
mov qword [rax + 0x28], rdi
cmp ecx, r14d
je 0x100023164
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x1000da584]
cmp qword [rax + 0x40], r13
je 0x100003c7a
cmp ecx, r14d
je 0x100003c74
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov qword [rbx + 0x40], r13
jmp 0x100003c7a
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
cmp ecx, r14d
je 0x10002316c
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x1000da584]
mov qword [rax + 0x40], rbx
cmp ecx, r14d
je 0x100023174
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rax + 0x28], rbx
jmp 0x100003c7a
mov rax, rbx
jmp 0x100003b60
mov rdi, rbx
jmp 0x100003b73
mov r8d, 1
mov rdx, r12
mov rcx, rdi
call fcn.100013200
mov rdi, qword [rdi + 0x80]
cmp rdi, rbx
je 0x100003b8b
jmp 0x100003b81
test byte [rdi + 0x44], 0x40
jne 0x100003b93
mov rdi, qword [rdi + 0x80]
cmp rdi, rbx
je 0x100003b93
jmp 0x100023138
mov rax, rbx
jmp 0x100003bb1
mov rax, rbx
jmp 0x100003c47
mov rax, rbx
jmp 0x100003c60
mov rax, rbx
jmp 0x10001bd5e
mov rax, rbx
jmp 0x10001bd71
Function at 0x100003d10
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x130
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov ebx, edx
mov r8d, edx
xor edx, edx
mov rdi, rcx
call sub.msvcrt.dll_memset
mov dword [rdi], ebx
call qword [sym.imp.USER32.dll_GetMessageTime]
and dword [rdi + 0x20], 0
lea rcx, [rsp + 0x20]
mov dword [rdi + 0x24], eax
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x100003de2
mov al, 0x80
test byte [rsp + 0x21], al
jne 0x1000239b9
test byte [rsp + 0x22], al
jne 0x1000239c2
test byte [rsp + 0x24], al
jne 0x1000239cc
test byte [rsp + 0xc0], al
jne 0x1000239d6
test byte [rsp + 0xc1], al
jne 0x1000239df
test byte [rsp + 0xc2], al
jne 0x1000239e8
test byte [rsp + 0xc3], al
jne 0x1000239f1
test byte [rsp + 0xc4], al
jne 0x1000239fa
test byte [rsp + 0xc5], al
jne 0x100023a03
test byte [rsp + 0x7b], al
jne 0x100023a0c
test byte [rsp + 0x7c], al
jne 0x100023a16
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1000031d0
mov rbx, qword [rsp + 0x150]
add rsp, 0x130
pop rdi
ret
or dword [rdi + 0x20], 0x40
jmp 0x100003d6c
bts dword [rdi + 0x20], 7
jmp 0x100003d76
bts dword [rdi + 0x20], 8
jmp 0x100003d80
or dword [rdi + 0x20], 4
jmp 0x100003d8d
or dword [rdi + 0x20], 8
jmp 0x100003d9a
or dword [rdi + 0x20], 1
jmp 0x100003da7
or dword [rdi + 0x20], 2
jmp 0x100003db4
or dword [rdi + 0x20], 0x10
jmp 0x100003dc1
or dword [rdi + 0x20], 0x20
jmp 0x100003dce
bts dword [rdi + 0x20], 9
jmp 0x100003dd8
bts dword [rdi + 0x20], 0xa
jmp 0x100003de2

Function at 0x100004080
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor ebx, ebx
mov rbp, rcx
cmp rcx, rbx
je 0x1000040e0
mov ecx, dword [0x1000da584]
or edi, 0xffffffff
cmp ecx, edi
je 0x1000040e0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, rbx
je 0x1000040e0
mov ecx, dword [0x1000da584]
cmp ecx, edi
je 0x100021dab
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rdi, [rax + 0xc8]
cmp qword [rdi + 8], rbx
ja 0x100021db3
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov rax, rbx
jmp 0x1000040cf
mov rsi, rbx
mov rax, qword [rdi]
mov r12, qword [rsi + rax]
mov rcx, r12
mov rax, qword [r12]
call qword [rax + 0x18]
cmp rax, rbp
jne 0x100021de6
mov edx, ebx
mov r8d, 1
mov rcx, rdi
call fcn.1000032d0
mov rcx, r12
call fcn.10003f478
jmp 0x100021dec
inc ebx
add rsi, 8
mov eax, ebx
cmp rax, qword [rdi + 8]
jae 0x1000040e0
jmp 0x100021db6