joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400030d1
Capabilities:
Link many functions at runtime

Disassembly:
lea rax, [rbx + 0x70]
lea r8, [rbp + 0x1f50]
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
or al, 0
sub edx, ecx
jne 0x140003013
inc rax
test ecx, ecx
jne 0x140003000
test edx, edx
je 0x1400030ef
mov rbx, qword [rsi + r9*8 + 8]
inc r9
inc edi
test rbx, rbx
jne 0x140002ff0
call fcn.1400042db
mov rbx, rax
test rax, rax
je 0x14000318c
lea rcx, [rax + 0x70]
mov edx, 0x1000
lea r9, [rbp + 0x1f50]
lea r8, [0x14002ba60]
call fcn.140004343
cmp eax, 0x1000
jge 0x140003178
mov r9, qword [rsi]
lea rcx, [rbx + 0x2070]
add r9, 0x2070
lea r8, [0x14002ba60]
mov edx, 0x1000
call fcn.140004370
cmp eax, 0x1000
jge 0x140003178
mov r9, qword [rsi]
lea rcx, [rbx + 0x3070]
add r9, 0x3070
lea r8, [0x14002ba60]
mov edx, 0x1000
call fcn.14000439d
cmp eax, 0x1000
jge 0x140003178
mov rax, qword [rsi]
mov ecx, dword [rax + 0x5074]
mov dword [rbx + 0x5074], ecx
mov rcx, rbx
call 0x140003f6f
add byte [rax], al
test eax, eax
je 0x140003107
lea rdx, [rbp + 0x1f50]
lea rcx, str.Failed_to_open_archive__s__n
call fcn.140005016
jmp 0x14000566f
test rbx, rbx
jne 0x14000310e
lea rdx, [rbp + 0x1f50]
lea rcx, str.Failed_to_open_referenced_dependency_archive__s._n
jmp 0x1400054b3
movsxd rax, edi
mov qword [rsi + rax*8], rbx
mov rdi, qword [rbx + 8]
cmp rdi, qword [rbx + 0x10]
jae 0x140003148
nop dword [rax + rax]
lea rcx, [rdi + 0x12]
lea rdx, [rbp + 0xf50]
call fcn.14001769c
mov rdx, rdi
mov rcx, rbx
test eax, eax
je 0x140003167
call fcn.140003fcb
mov rdi, rax
cmp rax, qword [rbx + 0x10]
jb 0x140003120
lea r8, [rbp + 0x1f50]
lea rdx, [rbp + 0xf50]
lea rcx, str.Failed_to_extract__s_from_referenced_dependency_archive__s._n
call fcn.14000508e
sub al, 0x1f
add byte [rax], al
jmp 0x140005518
call fcn.140003c78
cmp eax, 0xffffffff
je 0x140003148
xor eax, eax
jmp 0x14000552e
lea rcx, str.Archive_path_exceeds_PATH_MAX_n
call fcn.1400050b0
mov rcx, rbx
call fcn.140004408
jl 0x14000319c
add byte [rax], al
lea rdx, [rbp + 0x1f50]
lea rcx, str.Failed_to_open_referenced_dependency_archive__s._n
jmp 0x14000554b
retf
adc eax, 0x2716b
xchg esi, eax
pop rbx
add al, byte [rax]
lea edx, str.PyImport_ExecCodeModule
pop rdx
add al, byte [rax]
Function at 0x140005474
Capabilities:
Link many functions at runtime

Disassembly:
jne 0x140005482
lea rdx, str.Failed_to_get_address_for_PyErr_NormalizeException_n
jmp 0x140009a97
lea rdx, str.PyErr_Occurred
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003ed18], rax
test rax, rax
jne 0x1400054aa
lea rdx, str.Failed_to_get_address_for_PyErr_Occurred_n
jmp 0x140009abf
lea rdx, str.PyErr_Print
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003ed20], rax
test rax, rax
jne 0x1400054d2
lea rdx, str.Failed_to_get_address_for_PyErr_Print_n
jmp 0x140009ae7
lea rdx, str.PyErr_Restore
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003ed28], rax
test rax, rax
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov edi, edx
mov r12, rcx
test rcx, rcx
je case.0x140009b93.31
invalid
cmp qword [rcx + 0x30], 0
je case.0x140009b93.31
cmp qword [rcx + 0x38], 0
je case.0x140009b93.31
jns 0x140009af9
add byte [rdi], cl
test byte [rdx + 0x17], ah
add byte [rax], al
mov rax, qword [rcx + 0x28]
test rax, rax
je case.0x140009b93.31
cmp qword [rax], rcx
jne case.0x140009b93.31
mov eax, dword [rax + 8]
sub eax, 0x3f34
cmp eax, 0x1f
ja case.0x140009b93.31
clc
invalid
add byte [rax - 0x7d], cl
cmp dword [rax], eax
Function at 0x140007a9e
Capabilities:
Set environment variable

Disassembly:
js 0x140007ae4
add dword [rax], eax
xor eax, eax
jmp 0x14000e9ed
xor r8d, r8d
lea rdx, [0x14002dbc4]
xor ecx, ecx
call fcn.14000fad1
test rsi, rsi
je 0x140007b2d
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov rdi, rax
call fcn.14000fae6
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.14001ee00
mov rcx, rdi
call fcn.14001bf98
mov rcx, rbx
call fcn.14001bfa0
mov rcx, rsi
jmp 0x140007b3e
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
call fcn.14001bfbb
mov eax, 1
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140012d14
invalid
invalid
pushfq
and al, 0x90

Function at 0x14000a785
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test esi, esi
je 0x14000a3d3
movzx eax, byte [rbp]
mov ecx, ebx
shl eax, cl
dec esi
add r14d, eax

Function at 0x14000a79a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc rbp
mov eax, r8d
add ebx, 8
mov ecx, r14d
and rcx, rax
mov eax, dword [r9 + rcx*4]
mov ecx, eax

Function at 0x14000a7af
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shr ecx, 8
movzx edx, cl
mov ecx, eax
shr ecx, 0x10
mov dword [rsp + 0x34], eax
cmp edx, ebx
ja fcn.14000a785
Function at 0x14001c1a3
Capabilities:
Read file on windows

Disassembly:
test byte [rdi + 0x41000003], cl
invalid
cld
invalid

Function at 0x14001cce0
Capabilities:
Write file on windows

Disassembly:
mov dword [rbp - 0x61], esp
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
adc eax, 0xe65b
mov dword [rbp - 0x49], eax
xor edi, edi
mov r10, qword [rbp - 0x59]
cmp byte [r10 + 0x28], dil
cmp byte [rdx + 0x28], bh
jne 0x14001cd00
mov rcx, r10
call 0x140030af8
mov r10, qword [rbp - 0x59]
mov rcx, qword [r10 + 0x18]
mov ecx, dword [rcx + 0xc]
or al, 0x89
movabs r11, 0x84389038948c033

Function at 0x14001d1f9
Capabilities:
Write file on windows

Disassembly:
add eax, 0x20e1a
xor rax, rsp
mov qword [rsp + 0x1440], rax
add byte [rax], al
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x140040980]
and r10d, 0x3f
add rbp, r8
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x14001d2ca

Function at 0x14001d287
Capabilities:
Write file on windows

Disassembly:
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jae 0x14001d283
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jne 0x14001d26f
add dword [rdi + 8], 2
mov ecx, 0xd
mov word [rbx], cx
add rbx, 2
mov word [rbx], ax
add rbx, 2
lea rax, [rsp + 0x143e]
cmp rbx, rax
jb 0x14001d24d
and qword [rsp + 0x20], 0
and byte [rax], al
lea rax, [rsp + 0x40]
sub rbx, rax
lea r9, [rsp + 0x30]
sar rbx, 1
lea rdx, [rsp + 0x40]
add ebx, ebx
mov rcx, r14
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001d2c2
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x14001d2ca
cmp rsi, rbp
jb 0x14001d248
jmp 0x14001d2ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.140028499
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14001d72a
Capabilities:
Write file on windows

Disassembly:
test ah, dl
add byte [rax], al
add byte [rdx - 0x75], cl
or al, 0xe2
Function at 0x140004907
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.1400123e0
mov r15, qword [0x14002048c]
cmp r15, 1
jne 0x1400049d6
push qword [0x14002057c]
pop rcx
call fcn.14000d5b4
mov r15, rax
and r15, r15
jle 0x14000496c
mov rcx, qword [0x14002057c]
call fcn.14000d5bc
mov rcx, qword [0x14002057c]
call fcn.14000d5d0
or rax, rax
je 0x14000496c
mov rbp, qword [0x140020584]
push qword [rbp + 0x10]
pop rcx
call fcn.14000da6c
jmp 0x140004949
push qword [0x14002056c]
pop rcx
call fcn.14000d5b4
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x1400049d6
push 5
push 0
push 1
push qword [0x14002056c]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009070
mov rcx, qword [0x14002056c]
call fcn.14000d5bc
mov rcx, qword [0x14002056c]
call fcn.14000d5d0
or rax, rax
je 0x1400049d6
mov rbp, qword [0x140020574]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x1400049b3
mov rax, 1
jmp 0x1400049e2
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006a58
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add al, 0xd4
invalid
xchg ecx, eax
invalid
and al, 0x61
xchg edx, eax
stc
in eax, 0xf3
push rcx
invalid
add eax, 0xdc8a7efc
mov esi, 0xbaa5b0e8
fdivr qword [rsi - 0x455a4f18]
and al, byte [rax - 0x24bcc0e5]
or eax, 0x8b59d67
insd dword [rdi], dx
sub ebp, esp
invalid
mov gs, word [rsi]
enter 0x78b9, 0xfffffffffffffffb
jmp 0x14003f646
invalid
invalid
jb 0x14003f64a
jrcxz 0x14003f70f
xor dword [rcx], ebx
adc byte [0xf65f36ce], dh
xor eax, 0xb65b4031
adc al, 0x17
invalid
movsb byte [rdi], byte [rsi]
sub eax, dword [rbp + 0x29]
xchg dl, dh
imul ecx
xchg byte [rcx - 0x6f286cc3], dl
invalid
xchg ebx, eax
xlatb
nop
xlatb
nop
xor eax, 0x32fd0b5d
invalid
add al, 0x86
pop rdi
sub eax, 0x872b4c5f
imul edi, dword [rsi], 0x19cf3b71
add al, byte [rdi]
outsb dx, byte [rsi]
imul dword [rcx]
or dword [rax - 0x57de3f41], ecx
add edx, dword [rcx + rbp*2]
fadd dword [rax]
invalid
Function at 0x140684058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406841df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140684089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14068406f
add dl, dl
jne 0x140684096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406840f6
xor eax, eax
add dl, dl
jne 0x1406840a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406841ad
add dl, dl
jne 0x1406840b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406840c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406840d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406840dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406840ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14068407e
mov eax, 1
add dl, dl
jne 0x140684106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140684113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406840fb
sub eax, ebx
mov ebx, 1
jne 0x14068414c
mov ecx, 1
add dl, dl
jne 0x14068412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14068413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140684123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14068407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140684168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140684175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14068415d
cmp eax, 0x7d00
jae 0x14068419b
cmp eax, 0x500
jb 0x140684196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14068407e
cmp eax, 0x7f
ja 0x14068419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14068407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406841d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14068407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14018f348
Capabilities:
Set console window title

Disassembly:
jmp 0x1401b14b0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x1405bdcc0]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x1405f200c]
call fcn.140197fe8
nop
mov rax, qword [rbp + 0x140]
mov rcx, rax
call fcn.1401944a6
nop
call qword [sym.imp.KERNEL32.dll_AllocConsole]
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_AttachConsole]
nop
mov rcx, qword [rbp + 0x148]
call fcn.1401978b3
movzx eax, al
test eax, eax
jne 0x1401b154e
mov rcx, qword [rbp + 0x148]
call fcn.140195536
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
nop
xor ecx, ecx
call fcn.140198b32
mov r9, rax
lea r8, [0x1404d2064]
lea rdx, [0x1404d2068]
lea rcx, [rbp + 8]
call fcn.1401953b0
nop
mov ecx, 1
call fcn.140198b32
mov r9, rax
lea r8, [0x1404d2070]
lea rdx, str.conout_
lea rcx, [rbp + 0x28]
call fcn.1401953b0
nop
mov ecx, 2
call fcn.140198b32
mov r9, rax
lea r8, [0x1404d2070]
lea rdx, str.conout_
lea rcx, [rbp + 0x28]
call fcn.1401953b0
nop
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 0x48], rax
mov dx, 0xf
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
lea rdx, str._n_t_t________________________n_t_t______________________n_t_t_____________________n_t_t___________________n_t_t___________________v0.1_n_t_t_______________Clicker_n_t_t
lea rcx, [0x1405c9320]
call fcn.14018ff32
lea rdx, [0x1404d2084]
mov rcx, rax
call fcn.14018ff32
nop
mov dx, 7
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
mov rax, qword [rbp + 0x140]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1404d0cf0]
call fcn.140196689
mov rax, rdi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.1401934b6
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x140190879
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140301b70
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1405f249a]
call fcn.140197fe8
nop
mov qword [rbp + 8], 0
jmp 0x140301baf
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x140301c05
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x140301ba4
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140190c2a
Capabilities:
Get common file path

Disassembly:
jmp 0x1401d2030
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x3c8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x86
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x3e8]
mov rax, qword [0x1405bdcc0]
xor rax, rbp
mov qword [rbp + 0x380], rax
lea rcx, [0x1405f2050]
call fcn.140197fe8
nop
lea r9, [rbp + 8]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14054ade0]
call fcn.140192b42
test eax, eax
jl 0x1401d20ce
mov rax, qword [rbp + 0x3b0]
lea rdx, [rbp + 8]
mov rcx, rax
call fcn.140197a57
nop
mov rax, qword [rbp + 0x3b0]
mov rdx, qword [rbp + 0x3b8]
mov rcx, rax
call fcn.1401958e7
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop
mov rax, qword [rbp + 0x3b0]
mov rcx, rax
call fcn.14018fb0e
movzx eax, al
test eax, eax
je 0x1401d2215
lea rax, [rbp + 0x1a4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rbp + 0x1a4]
mov byte [rbp + 0x2c4], al
movzx eax, byte [rbp + 0x2c4]
mov byte [rbp + 0x304], al
movzx eax, byte [rbp + 0x304]
mov byte [rbp + 0x344], al
mov rax, qword [rbp + 0x3b0]
add rax, 0x28
mov rdx, rax
lea rcx, [rbp + 0x1c8]
call fcn.1401932c2
mov rax, qword [rax]
mov qword [rbp + 0x2a8], rax
mov rax, qword [rbp + 0x2a8]
mov qword [rbp + 0x2e8], rax
mov rax, qword [rbp + 0x2e8]
mov qword [rbp + 0x328], rax
lea rax, [rbp + 0x1e8]
mov qword [rbp + 0x218], rax
mov rdi, qword [rbp + 0x218]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, qword [rbp + 0x218]
call fcn.14018f07d
mov qword [rbp + 0x358], rax
mov rax, qword [rbp + 0x358]
mov qword [rbp + 0x360], rax
mov rax, qword [rbp + 0x360]
mov qword [rbp + 0x368], rax
lea rax, [rbp + 0x238]
mov qword [rbp + 0x268], rax
mov rax, qword [rbp + 0x3b0]
mov rdx, rax
mov rcx, qword [rbp + 0x268]
call fcn.140197fa7
mov qword [rbp + 0x370], rax
mov rax, qword [rbp + 0x370]
mov qword [rbp + 0x378], rax
movzx eax, byte [rbp + 0x344]
mov byte [rsp + 0x20], al
mov r9, qword [rbp + 0x328]
mov r8, qword [rbp + 0x368]
mov rdx, qword [rbp + 0x378]
lea rcx, [rbp + 0x288]
call fcn.1401bf8b0
nop
mov rcx, qword [rbp + 0x3b8]
call fcn.140190a36
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x1404d3930]
call fcn.140196689
mov rcx, qword [rbp + 0x380]
xor rcx, rbp
call fcn.1401934b6
lea rsp, [rbp + 0x398]
pop rdi
pop rbp
ret
Function at 0x140190fbd
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x1401b6bd0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1405f201d]
call fcn.140197fe8
nop
mov rax, qword [rbp + 0x100]
cmp dword [rax + 8], 0
jne 0x1401b6c0c
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax]
jmp 0x1401b6d1b
mov rax, qword [rbp + 0x100]
mov eax, dword [rax + 4]
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 0
je 0x1401b6c3c
cmp dword [rbp + 0xd4], 1
je 0x1401b6c4b
cmp dword [rbp + 0xd4], 2
je 0x1401b6c8a
jmp 0x1401b6d11
mov rax, qword [rbp + 0x100]
mov byte [rax], 1
jmp 0x1401b6d11
mov rax, qword [rbp + 0x100]
mov ecx, dword [rax + 8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1401b6c6e
mov byte [rbp + 0xd4], 1
jmp 0x1401b6c75
mov byte [rbp + 0xd4], 0
mov rax, qword [rbp + 0x100]
movzx ecx, byte [rbp + 0xd4]
mov byte [rax], cl
jmp 0x1401b6d11
mov rax, qword [rbp + 0x100]
mov ecx, dword [rax + 8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov word [rbp + 4], ax
movsx eax, word [rbp + 4]
and eax, 0x8000
test eax, eax
je 0x1401b6cb6
mov rax, qword [rbp + 0x100]
mov byte [rax + 1], 1
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax + 1]
test eax, eax
je 0x1401b6d11
movsx eax, word [rbp + 4]
and eax, 0x8000
test eax, eax
jne 0x1401b6d11
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax]
test eax, eax
jne 0x1401b6cec
mov dword [rbp + 0xd4], 1
jmp 0x1401b6cf6
mov dword [rbp + 0xd4], 0
mov rax, qword [rbp + 0x100]
movzx ecx, byte [rbp + 0xd4]
mov byte [rax], cl
mov rax, qword [rbp + 0x100]
mov byte [rax + 1], 0
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x1401913aa
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x1401b2db0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1405f2018]
call fcn.140197fe8
nop
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x138
jne 0x1401b2dee
mov rcx, qword [rbp + 0x100]
call fcn.1401908ec
nop
jmp 0x1401b2e0a
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x270
jb 0x1401b2e0a
mov rcx, qword [rbp + 0x100]
call fcn.140193781
nop
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rcx + rax*8 + 8]
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x100]
mov dword [rcx], eax
mov rax, qword [rbp + 0xd8]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
shr rax, 0x1d
mov rcx, qword [rbp + 0x100]
and rax, qword [rcx + 0x1388]
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
shl rax, 0x11
movabs rcx, 0x71d67fffeda60000
and rax, rcx
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
shl rax, 0x25
movabs rcx, 0xfff7eee000000000
and rax, rcx
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
shr rax, 0x2b
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14019301a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140419ea0
mov rax, rcx
neg rcx
test rax, 7
je 0x140419ebd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140419f18
test al, 7
jne 0x140419eb0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140419ed1
mov rdx, qword [rax - 8]
test dl, dl
je 0x140419f42
test dh, dh
je 0x140419f3c
shr rdx, 0x10
test dl, dl
je 0x140419f36
test dh, dh
je 0x140419f30
shr rdx, 0x10
test dl, dl
je 0x140419f2a
test dh, dh
je 0x140419f24
shr edx, 0x10
test dl, dl
je 0x140419f1e
test dh, dh
jne 0x140419ed1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x140193079
Capabilities:
Query environment variable

Disassembly:
jmp 0x14049aa40
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14049a5c0
lea rcx, [rsp + 0x20]
call fcn.14049a610
movzx eax, al
test eax, eax
jne 0x14049aa85
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.14049a5f0
mov rax, qword [rsp + 0x40]
jmp 0x14049ab7f
lea rcx, [rsp + 0x20]
call fcn.14049a710
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.14049a6b0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.14019364b
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140192539
lea rcx, [rsp + 0x28]
call fcn.140193eca
movzx eax, al
test eax, eax
jne 0x14049ab1f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1401962b5
lea rcx, [rsp + 0x20]
call fcn.14049a5f0
mov rax, qword [rsp + 0x50]
jmp 0x14049ab7f
lea rcx, [rsp + 0x20]
call fcn.14049a710
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.140197e58
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140193506
lea rcx, [rsp + 0x28]
call fcn.140198e89
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1401962b5
lea rcx, [rsp + 0x20]
call fcn.14049a5f0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret