joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140058a1c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
xor r15d, r15d
lea r12, [0x140000000]
movzx eax, byte [r15 + r12 + 0x6fd70]
mov edi, eax
mov r8d, eax
shr edi, 5
mov r11d, eax
shr r8d, 6
mov ebp, edi
lea edx, [rax + rax]
shr r11d, 7
xor edx, eax
and ebp, 4
mov r10d, edi
mov r9d, r8d
and edi, 1
and r10d, 2
imul ecx, edi, 0x1b000000
and r8d, 1
lea ebx, [rdx + rdx]
and r9d, 2
lea edx, [rdx*4]
xor ebx, eax
xor edx, eax
shl ebx, 0x19
shl edx, 8
mov esi, eax
xor rbx, rcx
mov r14d, eax
imul ecx, r10d, 0x1b000000
xor rbx, rcx
imul ecx, r8d, 0x1b000000
xor rbx, rcx
imul ecx, r9d, 0x1b000000
xor rbx, rcx
imul ecx, ebp, 0x1b000000
xor rbx, rcx
imul ecx, r11d, 0x1b000000
xor rbx, rcx
imul ecx, edi, 0x11b00
xor rdx, rcx
imul ecx, r10d, 0x11b00
xor rdx, rcx
imul ecx, r8d, 0x11b00
xor rdx, rcx
imul ecx, r9d, 0x11b00
xor rdx, rcx
imul ecx, ebp, 0x11b00
xor rdx, rcx
imul ecx, edi, 0x11b0000
or rbx, rdx
lea edx, [rax*8]
xor edx, eax
lea eax, [rax*4]
shl edx, 0x10
xor eax, r14d
xor rdx, rcx
imul ecx, r10d, 0x11b0000
xor rdx, rcx
imul ecx, ebp, 0x11b0000
xor rdx, rcx
imul ecx, edi, 0x11b
or rbx, rdx
lea edx, [rax + rax]
xor rdx, rcx
imul ecx, r10d, 0x11b
xor rdx, rcx
imul ecx, ebp, 0x11b
xor rdx, rcx
imul ecx, r11d, 0x11b
xor rdx, rcx
xor rdx, rsi
or rdx, rbx
shl rdx, 0x20
or rdx, rbx
or rdx, rsi
mov qword [r12 + r15*8 + 0x92720], rdx
inc r15
cmp r15, 0x100
jl 0x140058a3f
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov byte [0x140092f21], 1
pop r15
pop r14
pop r12
ret

Function at 0x140058ba8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
lea rbx, [0x140000000]
movzx r9d, byte [r11 + rbx + 0x6fc70]
mov edx, r9d
shr edx, 7
imul r10d, edx, 0x1b000000
lea r8d, [r9 + r9]
imul ecx, edx, 0x11b
mov eax, r8d
shl eax, 0x18
xor r10, rax
mov eax, r9d
shl eax, 8
or eax, r9d
shl eax, 8
or r10, rax
mov eax, r8d
xor rcx, rax
xor rcx, r9
or rcx, r10
shl rcx, 0x20
or rcx, r10
mov qword [rbx + r11*8 + 0x91f10], rcx
inc r11
cmp r11, 0x100
jl 0x140058bb7
and qword [0x140092718], 0
and qword [0x140092710], 0
mov rbx, qword [rsp + 8]
mov byte [0x140092f20], 1
ret
Function at 0x14005a658
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x14008c180]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x140093080]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x140092f30], ecx
jg 0x14005a73a
mov eax, ebx
cmp rbx, rax
jne 0x14005a6fc
xor ecx, ecx
test rbx, rbx
setne cl
xor eax, eax
test ebx, ebx
setne al
cmp ecx, eax
jne 0x14005a6fc
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [0x140092f28]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x14005a77d
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400624e0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x20]
call fcn.14000e520
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14005a388
lea rdx, [0x140088d88]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [0x140092f30]
call fcn.1400625a8
cmp dword [0x140092f30], 0xffffffff
jne 0x14005a6a4
lea rcx, [0x140092f28]
call fcn.14005a29c
lea rcx, [0x1400660dc]
call fcn.140062884
nop
lea rcx, [0x140092f30]
call fcn.14006253c
jmp 0x14005a6a4
mov ecx, eax
call fcn.14005a7c0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [0x14006e7e8]
lea rcx, [rsp + 0x20]
call fcn.14000e520
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14005a388
lea rdx, [0x140088d88]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x14005bbc4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 8
jb 0x14005bc37
mov rbp, r8
shr rbp, 3
imul rax, rbp, 0xfffffffffffffff8
add rdi, rax
mov r8d, 8
lea rcx, [rsp + 0x58]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 8
lea rcx, [rsp + 0x50]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x50]
add rsi, 8
xor rax, qword [rsp + 0x58]
add rbx, 8
or r14, rax
sub rbp, 1
jne 0x14005bbf6
mov rcx, r14
shr rcx, 0x20
or ecx, r14d
mov edx, ecx
mov eax, ecx
shr edx, 8
or edx, ecx
shr eax, 0x10
and edx, 0xff00
or edx, eax
movzx eax, cl
shr edx, 8
or edx, eax
test rdi, rdi
je 0x14005bc79
sub rsi, rbx
movzx ecx, byte [rsi + rbx]
movzx eax, byte [rbx]
inc rbx
xor ecx, eax
or edx, ecx
sub rdi, 1
jne 0x14005bc65
mov rbx, qword [rsp + 0x40]
test edx, edx
mov rbp, qword [rsp + 0x48]
sete al
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14005bc94
Capabilities:
Encode data using xor

Disassembly:
test r9, r9
je 0x14005bd5a
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, r9
mov r15d, 4
mov rdi, r8
mov rsi, rdx
mov r14, rcx
cmp rbx, r15
jb 0x14005bd25
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r15
lea rcx, [rsp + 0x20]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r15
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x68]
lea rdx, [rsp + 0x24]
xor eax, dword [rsp + 0x20]
mov r8, r15
mov rcx, r14
mov dword [rsp + 0x24], eax
call sub.VCRUNTIME140.dll_memcpy
add r14, r15
add rsi, r15
add rdi, r15
sub rbp, 1
jne 0x14005bcda
test rbx, rbx
je 0x14005bd42
sub rsi, rdi
sub r14, rdi
mov al, byte [rsi + rdi]
xor al, byte [rdi]
mov byte [r14 + rdi], al
inc rdi
sub rbx, 1
jne 0x14005bd30
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14005bd5c
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14005be09
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, r8
mov r14d, 4
mov rsi, rdx
mov rdi, rcx
cmp rbx, r14
jb 0x14005bde1
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r14
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r14
lea rcx, [rsp + 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x60]
lea rdx, [rsp + 0x20]
xor eax, dword [rsp + 0x68]
mov r8, r14
mov rcx, rdi
mov dword [rsp + 0x20], eax
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
add rsi, r14
sub rbp, 1
jne 0x14005bd99
test rbx, rbx
je 0x14005bdf7
sub rsi, rdi
mov al, byte [rsi + rdi]
xor byte [rdi], al
inc rdi
sub rbx, 1
jne 0x14005bde9
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140061d4c
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rcx]
mov r9d, 4
shl edx, 2
mov r8, rcx
movdqu xmm0, xmmword [rcx + rdx*4]
movdqu xmmword [rcx], xmm0
movdqu xmmword [rcx + rdx*4], xmm1
add edx, 0xfffffffc
cmp edx, r9d
jbe 0x140061d9b
aesimc xmm0, xmmword [r8 + rdx*4]
mov ecx, r9d
add r9d, 4
aesimc xmm1, xmmword [r8 + rcx*4]
movdqu xmmword [r8 + rcx*4], xmm0
movdqu xmmword [r8 + rdx*4], xmm1
add edx, 0xfffffffc
cmp r9d, edx
jb 0x140061d72
mov eax, r9d
aesimc xmm0, xmmword [r8 + rax*4]
movdqu xmmword [r8 + rax*4], xmm0
ret

Function at 0x1400632ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400632f6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400632f6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400632f6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400632f6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400632f6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400632f8
xor al, al
add rsp, 0x28
ret

Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140006008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x140006008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140006008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret
Function at 0x2e3c32a10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
sub rsp, 0x20
cmp dword [0x2e3f356ec], 1
mov r12, rcx
je 0x2e3c32a3c
mov r8d, 0x40
lea rdx, [0x2e3e6e068]
lea rcx, [0x2e3e6e190]
call qword [sym.imp.msvcrt.dll__wassert]
mov ecx, dword [0x2e3f356f0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x2e3f340c0]
test ecx, ecx
je 0x2e3c32ab0
test r12, r12
je 0x2e3c32a98
mov edx, dword [r12 + 0x208]
test edx, edx
je 0x2e3c32ac8
test rax, rax
je 0x2e3c32a80
mov edx, dword [rax + 0x20c]
cmp dword [r12 + 0x20c], edx
je 0x2e3c32a80
xor ecx, ecx
call qword [rax + 0x250]
mov rax, qword [r12 + 0x250]
mov rcx, r12
add rsp, 0x20
pop r12
jmp rax
test rax, rax
je 0x2e3c32ae0
mov rax, qword [rax + 0x250]
xor ecx, ecx
add rsp, 0x20
pop r12
jmp rax
xor edx, edx
mov ecx, 0x10001
add rsp, 0x20
pop r12
jmp fcn.2e3c320f0
lea rdx, str.Cannot_make_current_with_a_window_that_has_no_OpenGL_or_OpenGL_ES_context
mov ecx, 0x1000a
add rsp, 0x20
pop r12
jmp fcn.2e3c320f0
add rsp, 0x20
pop r12
ret

Function at 0x2e3c32c00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
sub rsp, 0x20
mov eax, dword [0x2e3f340c0]
mov r12d, ecx
test eax, eax
je 0x2e3c32c60
cmp dword [0x2e3f356ec], 1
jne 0x2e3c32c40
mov ecx, dword [0x2e3f356f0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x2e3c32c78
mov rax, qword [rax + 0x260]
mov ecx, r12d
add rsp, 0x20
pop r12
jmp rax
mov r8d, 0x40
lea rdx, [0x2e3e6e068]
lea rcx, [0x2e3e6e190]
call qword [sym.imp.msvcrt.dll__wassert]
jmp 0x2e3c32c1c
xor edx, edx
mov ecx, 0x10001
add rsp, 0x20
pop r12
jmp fcn.2e3c320f0
lea rdx, [0x2e3e6e5b0]
mov ecx, 0x10002
add rsp, 0x20
pop r12
jmp fcn.2e3c320f0
Function at 0x2e3c32c90
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r12, rcx
test rcx, rcx
je 0x2e3c32e48
mov r13d, dword [0x2e3f340c0]
test r13d, r13d
je 0x2e3c32d90
cmp dword [0x2e3f356ec], 1
jne 0x2e3c32d70
mov ecx, dword [0x2e3f356f0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x2e3c32e88
cmp byte [r12], 0
je 0x2e3c32e20
cmp dword [rax + 0x210], 2
jle 0x2e3c32db0
lea rdx, [rsp + 0x2c]
mov ecx, 0x821d
xor ebx, ebx
call qword [rax + 0x240]
mov eax, dword [rsp + 0x2c]
test eax, eax
jg 0x2e3c32d35
jmp 0x2e3c32e00
mov rdx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x2e3c32e70
add ebx, 1
cmp ebx, dword [rsp + 0x2c]
jge 0x2e3c32e00
mov ecx, 0x1f03
mov edx, ebx
call qword [rsi + 0x238]
mov rcx, rax
test rax, rax
jne 0x2e3c32d18
lea rdx, str.Extension_string_retrieval_is_broken
mov ecx, 0x10008
xor r13d, r13d
call fcn.2e3c320f0
mov eax, r13d
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov r8d, 0x40
lea rdx, [0x2e3e6e068]
lea rcx, [0x2e3e6e190]
call qword [sym.imp.msvcrt.dll__wassert]
jmp 0x2e3c32cc4
xor edx, edx
mov ecx, 0x10001
call fcn.2e3c320f0
mov eax, r13d
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov ecx, 0x1f03
call qword [rax + 0x248]
mov rdi, rax
test rax, rax
je 0x2e3c32d4a
nop dword [rax + rax]
mov rdx, r12
mov rcx, rdi
call sub.msvcrt.dll_strstr
mov rbx, rax
test rax, rax
je 0x2e3c32e00
mov rcx, r12
call sub.msvcrt.dll_strlen
add rax, rbx
cmp rdi, rbx
je 0x2e3c32df4
cmp byte [rbx - 1], 0x20
mov rdi, rax
jne 0x2e3c32dc8
test byte [rax], 0xdf
je 0x2e3c32e70
mov rdi, rax
jmp 0x2e3c32dc8
mov rax, qword [rsi + 0x268]
mov rcx, r12
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp rax
lea rdx, str.Extension_name_cannot_be_an_empty_string
mov ecx, 0x10004
xor r13d, r13d
call fcn.2e3c320f0
mov eax, r13d
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov r8d, 0x2a4
lea rdx, [0x2e3e6e428]
lea rcx, str.extension___NULL
call qword [sym.imp.msvcrt.dll__wassert]
jmp 0x2e3c32ca7
mov r13d, 1
mov eax, r13d
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
lea rdx, str.Cannot_query_extension_without_a_current_OpenGL_or_OpenGL_ES_context
mov ecx, 0x10002
xor r13d, r13d
call fcn.2e3c320f0
jmp 0x2e3c32d9c
Function at 0x2e3c347f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
mov edx, dword [0x2e3f340c0]
mov r12, rcx
test edx, edx
je 0x2e3c34958
test rcx, rcx
je 0x2e3c34970
mov rbx, qword [0x2e3f344c0]
test rbx, rbx
je 0x2e3c348f0
mov rsi, qword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x2e3c3483c
mov rbx, qword [rbx]
test rbx, rbx
je 0x2e3c348f0
cmp qword [rbx + 0x58], r12
jne 0x2e3c34830
mov eax, dword [0x2e3f340c0]
test eax, eax
je 0x2e3c34940
mov qword [rbx + 0x58], 0
lea rcx, [rsp + 0x28]
call rsi
test eax, eax
je 0x2e3c34830
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_WindowFromPoint]
cmp rax, qword [rbx + 0x358]
jne 0x2e3c34830
lea r13, [rsp + 0x30]
mov rcx, rax
mov rdx, r13
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rbx + 0x358]
mov rdi, qword [sym.imp.USER32.dll_ClientToScreen]
mov rdx, r13
call rdi
mov rcx, qword [rbx + 0x358]
lea rdx, [rsp + 0x38]
call rdi
mov rdx, qword [rsp + 0x28]
mov rcx, r13
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x2e3c34830
cmp dword [rbx + 0x84], 0x34001
mov rax, qword [rbx + 0x58]
jne 0x2e3c34980
test rax, rax
je 0x2e3c3498d
mov rcx, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetCursor]
jmp 0x2e3c34830
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x2e3c34900
call qword [sym.imp.USER32.dll_DestroyIcon]
mov rax, qword [0x2e3f344b8]
lea rdx, [0x2e3f344b8]
cmp r12, rax
je 0x2e3c34923
nop dword [rax + rax]
mov rdx, rax
mov rax, qword [rax]
cmp r12, rax
jne 0x2e3c34918
mov rax, qword [r12]
mov rcx, r12
mov qword [rdx], rax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp sub.msvcrt.dll_free
xor edx, edx
mov ecx, 0x10001
call fcn.2e3c320f0
jmp 0x2e3c34830
xor edx, edx
mov ecx, 0x10001
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.2e3c320f0
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
jmp 0x2e3c34830
xor ecx, ecx
mov edx, 0x7f00
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
jmp 0x2e3c34830
Function at 0x2e3c36200
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
mov eax, dword [0x2e3f340c0]
test eax, eax
je 0x2e3c36328
mov rax, qword [0x2e3ed1a08]
lea rdx, [0x2e3f34128]
mov ecx, 0x69
movdqa xmm0, xmmword [0x2e3ed1a10]
mov qword [0x2e3f34478], 0
mov rdi, rdx
mov qword [0x2e3f34470], rax
xor eax, eax
rep stosq qword [rdi], rax
mov rax, qword [0x2e3ed1a10]
movups xmmword [0x2e3f34138], xmm0
movdqa xmm0, xmmword [0x2e3ed1a20]
mov qword [0x2e3f34118], 0
mov qword [0x2e3f34154], rax
mov rax, qword [0x2e3ed1a30]
mov qword [0x2e3f34480], 0
mov qword [0x2e3f34488], 0
mov qword [0x2e3f34490], 0
mov qword [0x2e3f34498], 0
mov qword [0x2e3f344a0], 0
mov dword [0x2e3f34478], 1
mov dword [0x2e3f34148], 1
mov qword [0x2e3f340f8], 0
mov qword [0x2e3f34100], 0
mov qword [0x2e3f34108], 0
mov qword [0x2e3f34110], 0
mov qword [0x2e3f34120], 0
mov qword [0x2e3f340f0], rax
mov dword [0x2e3f34118], 1
mov dword [0x2e3f344a8], 0xffffffff
mov dword [0x2e3f34164], 1
movaps xmmword [0x2e3f340e0], xmm0
pop rdi
ret
xor edx, edx
mov ecx, 0x10001
pop rdi
jmp fcn.2e3c320f0
Function at 0x2e3c36340
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x2e3f340c0]
test eax, eax
je 0x2e3c36420
cmp ecx, 0x21010
jg 0x2e3c363a0
cmp ecx, 0x21000
jg 0x2e3c36380
lea eax, [rcx - 0x20001]
cmp eax, 0xc
ja case.0x2e3c363d1.139268
lea r8, [0x2e3e6f574]
movsxd rax, dword [r8 + rax*4]
add rax, r8
jmp rax
sub ecx, 0x21002
cmp ecx, 0xe
ja case.default.0x2e3c3639d
lea r8, [0x2e3e6f5a8]
movsxd rax, dword [r8 + rcx*4]
add rax, r8
jmp rax
cmp ecx, 0x2200c
jg 0x2e3c363d8
cmp ecx, 0x22000
jle case.0x2e3c363d1.139268
lea eax, [rcx - 0x22001]
cmp eax, 0xb
ja case.0x2e3c363d1.139268
lea r8, [0x2e3e6f5e4]
movsxd rax, dword [r8 + rax*4]
add rax, r8
jmp rax
cmp ecx, 0x23003
je 0x2e3c366a0
cmp ecx, 0x25001
jne 0x2e3c36400
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f34468], eax
ret
cmp ecx, 0x23001
jne case.0x2e3c363d1.139268
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f34164], eax
ret
xor edx, edx
mov ecx, 0x10001
jmp fcn.2e3c320f0
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f34160], eax
ret
mov dword [0x2e3f34474], edx
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f34488], eax
ret
mov dword [0x2e3f34494], edx
ret
mov dword [0x2e3f3448c], edx
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f34484], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f34480], eax
ret
mov dword [0x2e3f34490], edx
ret
mov dword [0x2e3f3447c], edx
ret
mov dword [0x2e3f34478], edx
ret
mov dword [0x2e3f34470], edx
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f3415c], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f34158], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f3411c], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f34154], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f34150], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f3414c], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f34148], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f34140], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f3413c], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f34138], eax
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f34144], eax
ret
mov r8d, ecx
lea rdx, str.Invalid_window_hint_0x_08X
mov ecx, 0x10003
jmp fcn.2e3c320f0
mov dword [0x2e3f340f0], edx
ret
mov dword [0x2e3f340ec], edx
ret
mov dword [0x2e3f340e8], edx
ret
mov dword [0x2e3f340e4], edx
ret
mov dword [0x2e3f340f4], edx
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f34114], eax
ret
mov dword [0x2e3f34110], edx
ret
mov dword [0x2e3f344a8], edx
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f3410c], eax
ret
mov dword [0x2e3f34108], edx
ret
mov dword [0x2e3f340fc], edx
ret
mov dword [0x2e3f340f8], edx
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f34118], eax
ret
mov dword [0x2e3f34104], edx
ret
mov dword [0x2e3f34100], edx
ret
mov dword [0x2e3f340e0], edx
ret
xor eax, eax
test edx, edx
setne al
mov dword [0x2e3f344a0], eax
ret
Function at 0x2e3c37fb0
Capabilities:
Log keystrokes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1b8
movaps xmmword [rsp + 0x180], xmm6
movaps xmmword [rsp + 0x190], xmm7
movaps xmmword [rsp + 0x1a0], xmm8
lea rdi, [0x2e3f35e6a]
xor eax, eax
xor ebx, ebx
and rdi, 0xfffffffffffffff8
lea rcx, [0x2e3f35e62]
lea rsi, [0x2e3f35f02]
sub rcx, rdi
add ecx, 0x6d1
shr ecx, 3
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x148], 0
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x160], 0
mov qword [rsp + 0x168], 0
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x178], 0
mov qword [0x2e3f35e62], 0
movdqa xmm8, xmmword [str._abcdefghinojm]
movdqa xmm7, xmmword [0x2e3ed1a70]
movdqa xmm6, xmmword [0x2e3ed1a80]
mov qword [0x2e3f3652b], 0
rep stosq qword [rdi], rax
lea rdi, [rsi - 0x31a]
jmp 0x2e3c3820e
test eax, eax
jle 0x2e3c381f9
mov qword [rsp + 0x20], rsi
mov r9d, 1
mov r8, rbp
xor edx, edx
mov qword [rsp + 0x38], 0
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 5
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add rbx, 1
add rsi, 5
cmp rbx, 0x13d
je 0x2e3c3829c
movzx eax, word [rdi + rbx*2]
cmp ax, 0xffff
je 0x2e3c381f9
movsx r13d, ax
lea eax, [rbx - 0x120]
cmp eax, 0xe
jbe 0x2e3c382c9
mov edx, 1
mov ecx, r13d
lea rbp, [rsp + 0x40]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r12d, eax
mov r14, qword [sym.imp.USER32.dll_ToUnicode]
mov r9, rbp
mov edx, r13d
mov ecx, r12d
lea r15, [rsp + 0x80]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
mov r8, r15
call r14
cmp eax, 0xffffffff
jne 0x2e3c381c0
mov r9, rbp
mov r8, r15
mov edx, r13d
mov ecx, r12d
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
call r14
jmp 0x2e3c381c0
movaps xmm6, xmmword [rsp + 0x180]
movaps xmm7, xmmword [rsp + 0x190]
movaps xmm8, xmmword [rsp + 0x1a0]
add rsp, 0x1b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [0x2e3ed1a90]
movaps xmmword [rsp + 0x40], xmm8
lea rbp, [rsp + 0x40]
mov dword [rsp + 0x78], 0x6b
mov qword [rsp + 0x70], rax
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x60], xmm6
mov r12d, dword [rsp + rbx*4 - 0x440]
jmp 0x2e3c38241