joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d9ee0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [0x1403b9c20]
mov rax, qword [rsi]
test rax, rax
je 0x1400da0d0
cmp qword [rax + 0x28], 0
jne 0x1400da0b8
lea rcx, [0x14041b378]
cmp dword [rcx], 1
mov qword [rax + 0x28], rcx
je 0x1400da0c5
call fcn.1400d94f0
mov rax, qword [rsi]
test rax, rax
je 0x1400d9f60
cmp qword [rax + 0x30], 0
jne 0x1400d9f80
lea rdx, [0x1400fb128]
mov qword [rax + 0x30], rdx
mov rax, rdx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x1400d9f94
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.1400de200
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x1400d9f30
test rax, rax
jne 0x1400d9f80
call fcn.1400de200
nop dword [rax]
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
jne 0x1400d9f4e
call fcn.1400d9030
cmp qword [0x14041f050], 0
mov rbx, rax
je 0x1400d9f4e
test rax, rax
je 0x1400d9f4e
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.1400e00a0
cmp eax, 1
je 0x1400da13d
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rbp
mov dword [rsp + 0x30], 2
mov r8, rdi
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1400e2176
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [rsi]
test rax, rax
je 0x1400da118
cmp qword [rax + 0x30], 0
je 0x1400da100
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400e2176
mov r12, rbx
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x1400d9f1c
mov rax, qword [rsi]
jmp 0x1400d9f29
call fcn.1400de200
cmp qword [rax + 0x28], 0
mov rax, qword [rsi]
je 0x1400d9f08
test rax, rax
jne 0x1400da0b8
call fcn.1400de200
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x1400d9f1c
jmp 0x1400d9f21
lea rdx, [0x1400fb128]
mov qword [rax + 0x30], rdx
mov rax, rdx
jmp 0x1400da08e
call fcn.1400de200
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x1400da100
test rax, rax
jne 0x1400da08a
call fcn.1400de200
jmp 0x1400da08a
call fcn.1400d93c0
nop word cs:[rax + rax]
nop dword [rax]
mov rax, qword [0x1403b9c20]
mov rdx, qword [rax]
lea rax, [0x14041b388]
mov qword [rdx + 0x10], rax
ret
Function at 0x1400de080
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400de0a0
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x1400de0e8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400de094
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400de0d5
Function at 0x1400de200
Capabilities:
Check mutex on windows

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x14041b460]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x2c]
lea r9, [rsp + 0x30]
movzx eax, byte [rcx]
add rcx, 1
add rdx, 2
mov r8d, eax
and eax, 0xf
shr r8b, 4
add eax, 0x61
add r8d, 0x41
mov byte [rdx - 1], al
mov byte [rdx - 2], r8b
cmp rcx, r9
jne 0x1400de223
lea rax, [0x14041b468]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x1a]
jmp 0x1400de26b
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x1400de268
lea rax, [0x14041b4a0]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x19]
jmp 0x1400de29b
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x1400de298
xor ecx, ecx
mov byte [0x14041b4b9], 0x2d
movabs rax, 0x6161616161616161
movabs rdx, 0x6161616161616161
mov qword [0x14041b4c2], rdx
lea r8, [0x14041b460]
lea rbx, [0x14041b4ba]
mov qword [0x14041b4d2], rdx
mov qword [0x14041b4e2], rdx
mov qword [0x14041b4f2], rdx
xor edx, edx
mov qword [0x14041b4ba], rax
mov qword [0x14041b4ca], rax
mov qword [0x14041b4da], rax
mov qword [0x14041b4ea], rax
mov byte [0x14041b4fa], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400de476
lea rcx, [0x14041b4a0]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x1400de3c1
lea rsi, [0x14041b3a0]
lea r8, [0x14041b4fa]
mov rax, rbx
lea ecx, [rbx + 0x40]
nop dword [rax]
mov edx, ecx
sub edx, eax
bt rsi, rdx
jae 0x1400de36d
mov byte [rax], 0x41
add rax, 1
cmp r8, rax
jne 0x1400de360
lea rcx, [0x14041b4a0]
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x1400de463
lea rcx, [0x1400de110]
mov qword [0x14041b3a0], rsi
call sub.msvcrt.dll__onexit
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x14041b3a0]
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov r8d, 0x5b
lea rdx, [0x14041b4a0]
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea r8, [0x14041b4fa]
xor edx, edx
lea r10d, [rbx + 0x40]
mov r11d, eax
mov r9d, 1
mov rax, rbx
test r11d, r11d
je 0x1400de496
nop dword [rax]
cmp byte [rax], 0x41
jne 0x1400de413
mov ecx, r10d
mov rbx, r9
sub ecx, eax
shl rbx, cl
or rdx, rbx
add rax, 1
cmp r8, rax
jne 0x1400de400
mov rax, rdx
mov qword [0x14041b3a0], rax
lea rsi, [0x14041b3a0]
jmp 0x1400de439
cmp rdx, rsi
je 0x1400de39f
mov rdx, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x1400de430
cmp rdx, rsi
je 0x1400de39f
mov qword [rdx + 8], rsi
lea rcx, [0x1400de110]
call sub.msvcrt.dll__onexit
jmp 0x1400de39f
lea rcx, str.failed_to_add_string_to_atom_table_n
call fcn.1400de080
xor eax, eax
jmp 0x1400de3b8
lea rcx, str.failed_to_to_lock_creation_mutex_n
call fcn.1400de080
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, str.failed_to_get_string_from_atom_n
call fcn.1400de080
xor eax, eax
jmp 0x1400de41f
Function at 0x2fc4da0d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4daad2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fd108]
test eax, eax
je 0x2fc4dab6a
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fd110]
mov qword [rbp - 8], rax
jmp 0x2fc4dab4e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4dab42
cmp qword [rbp - 0x10], 0
je 0x2fc4dab42
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4dab08
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4dab6b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4dac70
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4dac98
mov eax, 0
jmp 0x2fc4dace6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4dacc1
mov eax, 0
jmp 0x2fc4dace6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4dace1
mov eax, 0
jmp 0x2fc4dace6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4dacec
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4dad6a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4dad61
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4dad61
mov rax, qword [rbp - 8]
jmp 0x2fc4dad7f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4dad34
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x180002b50
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180002b78
xor eax, eax
lea r8, [0x180002a60]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x180005f20
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0xa8
cmp byte [0x180177661], 0
je 0x18000616f
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000616f
mov qword [rsp + 0xb0], rbx
movabs rbx, 0xd80958fc74e988a6
mov qword [rsp + 0xa0], rdi
xor edi, edi
mov dword [0x180138b98], edi
mov dword [0x180138ba8], edi
mov qword [0x180178a98], rbx
call fcn.180028960
mov qword [rsp + 0xb8], rdi
mov ecx, dword [rax]
movabs rax, 0x997abd671d25ca0b
mov dword [rsp + 0xb8], ecx
mov qword [0x180178a98], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xb8], rdi
mov qword [0x180138c70], rax
mov dword [rsp + 0xb8], 1
mov rax, qword [rsp + 0xb8]
mov qword [0x180138c78], rax
mov dword [0x180138ba8], edi
mov dword [0x180138b98], 2
call fcn.180028960
cmp dword [rax], edi
je 0x18000615f
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm7
mov dword [0x180138b98], edi
mov dword [0x180138ba8], edi
mov qword [0x180178a98], rbx
call fcn.180028960
mov qword [rsp + 0xb8], rdi
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0xb8], ecx
mov qword [0x180178a98], rax
mov rax, qword [rsp + 0xb8]
mov qword [0x180138c70], rax
mov dword [0x180138ba8], edi
mov qword [0x180138c78], rdi
mov dword [0x180138b98], 2
call fcn.180028960
mov qword [rsp + 0xb8], rdi
mov ebx, dword [rax]
movabs rax, 0x866a4a5fae349510
mov qword [0x180178a98], rax
mov dword [rsp + 0xb8], ebx
mov rax, qword [rsp + 0xb8]
mov qword [0x180138c70], rax
mov dword [0x180138ba8], edi
mov dword [0x180138b98], 1
call fcn.180028960
mov qword [rsp + 0xb8], rdi
xorps xmm6, xmm6
mov dword [rsp + 0xb8], ebx
movss xmm7, dword [rax]
movabs rax, 0x8bb4ef4214e0e6d5
mov qword [0x180178a98], rax
addss xmm7, xmm6
mov rax, qword [rsp + 0xb8]
mov qword [0x180138c70], rax
mov dword [0x180138ba8], edi
mov dword [0x180138b98], 1
call fcn.180028960
movss xmm0, dword [0x1801042c8]
mov edx, ebx
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x68], 1
movss xmm3, dword [rax]
mov dword [rsp + 0x58], 1
addss xmm3, xmm6
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x48], 1
movss dword [rsp + 0x40], xmm6
movss dword [rsp + 0x38], xmm6
movss dword [rsp + 0x30], xmm6
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x20], xmm7
call fcn.18001b770
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov rbx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xa0]
add rsp, 0xa8
ret
Function at 0x180006860
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
cmp byte [0x180177658], 0
je 0x1800069c7
mov ecx, 0xa0
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
movabs rcx, 0xd80958fc74e988a6
mov qword [0x180178a98], rcx
mov dword [0x180138b98], ebx
mov dword [0x180138ba8], ebx
test ax, ax
je 0x180006935
call fcn.180028960
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0x38], ecx
mov qword [0x180178a98], rax
mov rax, qword [rsp + 0x38]
mov qword [0x180138c70], rax
mov dword [0x180138ba8], ebx
mov qword [0x180138c78], rbx
mov dword [0x180138b98], 2
call fcn.180028960
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x222ff6a823d122e2
mov dword [rsp + 0x38], ecx
mov qword [0x180178a98], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x38], 1
mov qword [0x180138c70], rax
mov rax, qword [rsp + 0x38]
mov qword [0x180138c78], rax
jmp 0x1800069ad
call fcn.180028960
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0x38], ecx
mov qword [0x180178a98], rax
mov rax, qword [rsp + 0x38]
mov qword [0x180138c70], rax
mov dword [0x180138ba8], ebx
mov qword [0x180138c78], rbx
mov dword [0x180138b98], 2
call fcn.180028960
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x222ff6a823d122e2
mov dword [rsp + 0x38], ecx
mov qword [0x180178a98], rax
mov rax, qword [rsp + 0x38]
mov qword [0x180138c70], rax
mov qword [0x180138c78], rbx
mov dword [0x180138ba8], ebx
mov dword [0x180138b98], 2
call fcn.180028960
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x18000dcc0
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
sub rsp, 0x28
cmp byte [0x180177613], 0
je 0x18000dcf6
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000dcf6
mov ecx, 0x73
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000dcf6
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x28
ret
Function at 0x18000f3f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
sub rsp, 0x78
cmp byte [0x180177605], 0
je 0x18000f603
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
movabs rsi, 0xd80958fc74e988a6
mov qword [rax - 8], rdi
xor edi, edi
mov dword [0x180138b98], edi
mov dword [0x180138ba8], edi
movaps xmmword [rax - 0x18], xmm6
mov qword [0x180178a98], rsi
call fcn.180028960
mov qword [rsp + 0x88], rdi
mov ecx, dword [rax]
movabs rax, 0x3fef770d40960d5a
mov dword [rsp + 0x88], ecx
mov qword [0x180178a98], rax
mov rax, qword [rsp + 0x88]
mov qword [0x180138c70], rax
mov dword [0x180138ba8], edi
mov qword [0x180138c78], rdi
mov dword [0x180138b98], 2
call fcn.180028960
movsd xmm0, qword [rax + 0x10]
movups xmm6, xmmword [rax]
movabs rax, 0xd24d37cc275948cc
mov dword [0x180138ba8], edi
movsd qword [rsp + 0x50], xmm0
mov qword [0x180178a98], rax
lea rax, str.prop_boogieboard_05
mov qword [0x180138c70], rax
mov dword [0x180138b98], 1
call fcn.180028960
mov ebx, dword [rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x180178c78]
cmp eax, 0x64
jb 0x18000f5e9
movss xmm3, dword [rsp + 0x50]
movaps xmm2, xmm6
subss xmm3, dword [0x1801041c0]
shufps xmm2, xmm6, 0xaa
movaps xmm1, xmm6
subss xmm2, dword [0x1801041c0]
mov dword [rsp + 0x30], 1
mov ecx, ebx
mov dword [rsp + 0x28], 1
call fcn.18001bac0
mov ebx, eax
mov dword [0x180138b98], edi
mov dword [0x180138ba8], edi
mov qword [0x180178a98], rsi
call fcn.180028960
mov qword [rsp + 0x88], rdi
mov ecx, dword [rax]
movabs rax, 0xe83d4f9ba2a38914
mov dword [rsp + 0x88], ecx
mov rcx, qword [rsp + 0x88]
mov qword [0x180138c70], rcx
mov dword [0x180138ba8], edi
mov qword [0x180178a98], rax
mov dword [0x180138b98], 1
call fcn.180028960
mov qword [rsp + 0x88], rdi
mov dword [rsp + 0x88], ebx
movss xmm0, dword [rax]
movabs rax, 0x8e2530aa8ada980e
mov qword [0x180178a98], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x88], rdi
movss dword [rsp + 0x88], xmm0
mov qword [0x180138c70], rax
mov rax, qword [rsp + 0x88]
mov qword [0x180138c78], rax
mov dword [0x180138ba8], edi
mov dword [0x180138b98], 2
call fcn.180028960
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x180178c78], eax
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x180011a40
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
cmp byte [0x1801775fa], 0
je 0x180011c3c
mov qword [rsp + 0x30], rbx
xor ebx, ebx
mov qword [rsp + 0x20], rdi
movabs rdi, 0xd80958fc74e988a6
mov qword [0x180178a98], rdi
mov dword [0x180138b98], ebx
mov dword [0x180138ba8], ebx
call fcn.180028960
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0xae99fb955581844a
mov qword [0x180178a98], rax
mov dword [rsp + 0x38], ecx
mov rax, qword [rsp + 0x38]
mov qword [0x180138c70], rax
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x38], 0xa
mov rax, qword [rsp + 0x38]
mov qword [0x180138c78], rax
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x38], 0xa
mov rax, qword [rsp + 0x38]
mov qword [0x180138c80], rax
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rbx
mov qword [0x180138c90], rax
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rbx
mov qword [0x180138c98], rax
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0x38]
mov qword [0x180138ca0], rax
mov dword [0x180138ba8], ebx
mov qword [0x180138c88], rbx
mov dword [0x180138b98], 7
call fcn.180028960
lea ecx, [rbx + 0x57]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180011b7b
mov dword [0x180138b98], ebx
mov dword [0x180138ba8], ebx
mov qword [0x180178a98], rdi
call fcn.180028960
movss xmm2, dword [0x180104260]
xorps xmm3, xmm3
xorps xmm1, xmm1
mov ecx, dword [rax]
call fcn.1800185a0
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180011bb8
mov dword [0x180138b98], ebx
mov dword [0x180138ba8], ebx
mov qword [0x180178a98], rdi
call fcn.180028960
movss xmm2, dword [0x180104430]
xorps xmm3, xmm3
xorps xmm1, xmm1
mov ecx, dword [rax]
call fcn.1800185a0
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180011bf5
mov dword [0x180138b98], ebx
mov dword [0x180138ba8], ebx
mov qword [0x180178a98], rdi
call fcn.180028960
movss xmm1, dword [0x180104260]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov ecx, dword [rax]
call fcn.1800185a0
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180011c32
mov dword [0x180138b98], ebx
mov dword [0x180138ba8], ebx
mov qword [0x180178a98], rdi
call fcn.180028960
movss xmm1, dword [0x180104430]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov ecx, dword [rax]
call fcn.1800185a0
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x180018a30
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0xc50
mov rax, qword [0x18011f3c0]
xor rax, rsp
mov qword [rsp + 0xc40], rax
mov rdi, rcx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x440]
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
lea edx, [rbp + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x180018b6e
mov qword [rsp + 0xc68], rbx
lea rdx, [rsp + 0x440]
mov r8d, 0x3ff
mov qword [rsp + 0xc70], rsi
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs]
cmp qword [0x180178b48], 0xf
lea rcx, [0x180178b30]
cmova rcx, qword [0x180178b30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
xorps xmm0, xmm0
lea rsi, [0x180176da0]
mov rbx, rax
lea r8, [0x180079258]
xor eax, eax
lea edx, [rbp + 0x45]
mov rcx, rsi
mov dword [0x180176de0], eax
mov byte [0x180176de4], al
movups xmmword [0x180176da0], xmm0
movups xmmword [0x180176db0], xmm0
movups xmmword [0x180176dc0], xmm0
movups xmmword [0x180176dd0], xmm0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea r8, [rsp + 0x40]
mov rcx, rsi
lea edx, [rbp + 0x45]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov r8, rbx
lea edx, [rbp + 0x45]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov rbx, qword [rsp + 0xc68]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbp
mov r8, 0xffffffffffffffff
mov qword [rdi + 0x18], rbp
nop dword [rax]
inc r8
cmp byte [rsi + r8], bpl
jne 0x180018b50
mov rdx, rsi
mov rcx, rdi
call fcn.18001b3f0
mov rsi, qword [rsp + 0xc70]
jmp 0x180018b83
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 0xf
mov byte [rdi], bpl
mov rax, rdi
mov rcx, qword [rsp + 0xc40]
xor rcx, rsp
call fcn.18006e870
mov rbp, qword [rsp + 0xc78]
add rsp, 0xc50
pop rdi
ret
Function at 0x18001e460
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
lea rdx, [0x180083c2c]
lea rcx, [rsp + 0xa0]
call fcn.18001b500
mov rbx, rax
lea rcx, [rsp + 0x80]
call fcn.180018a30
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.18001efd0
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18001eff0
nop
lea rcx, [rsp + 0x60]
call fcn.18001b3c0
nop
lea rcx, [rsp + 0x80]
call fcn.18001b3c0
nop
lea rcx, [rsp + 0xa0]
call fcn.18001b3c0
lea rcx, [rsp + 0x40]
call fcn.18001a480
mov qword [rsp + 0xd0], rax
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.18001f070
nop
lea rcx, [rsp + 0x20]
call fcn.1800213f0
movzx ebx, al
lea rcx, [rsp + 0x20]
call fcn.1800211b0
test bl, bl
je 0x18001e52f
lea rcx, [rsp + 0x40]
call fcn.18001a480
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.1800216b0
lea rcx, str.Cleaning_up_hooks
call fcn.1800221f0
call fcn.18001e670
mov rsi, rax
call fcn.18001e680
mov rbx, rax
cmp rax, rsi
je 0x18001e594
mov rdi, qword [rbx]
mov rcx, rdi
call fcn.18006b1e0
test eax, eax
jne 0x18001e572
lea rcx, str.Successfully_disabled_hooks
call fcn.1800221f0
jmp 0x18001e58b
mov ecx, eax
call fcn.18006b3c0
mov r8, rax
mov rdx, rdi
lea rcx, str.Failed_to_disable_hookS__p___s_
call fcn.1800221f0
add rbx, 8
cmp rbx, rsi
jne 0x18001e555
mov dword [rsp + 0xd0], 0x32
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xd8]
call fcn.180002cf0
mov rcx, rax
call fcn.180002d00
call fcn.18001e670
mov rsi, rax
call fcn.18001e680
mov rbx, rax
cmp rax, rsi
je 0x18001e61c
mov rdi, qword [rbx]
mov rcx, rdi
call fcn.18006b0d0
test eax, eax
jne 0x18001e5fa
lea rcx, str.Successfully_Cleaning_up_hooks
call fcn.1800221f0
lea rcx, str.ThunderX_Successfully_____unloaded.
call fcn.1800221f0
jmp 0x18001e613
mov ecx, eax
call fcn.18006b3c0
mov r8, rax
mov rdx, rdi
lea rcx, str.Failed_to_unhook__p___s_
call fcn.1800221f0
add rbx, 8
cmp rbx, rsi
jne 0x18001e5d1
mov dword [rsp + 0xd0], 0x190
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xd8]
call fcn.180002cf0
mov rcx, rax
call fcn.180002d00
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor edx, edx
mov rcx, qword [0x180177730]
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]