joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011c3a6
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1401b85d0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14068b5e8]
call fcn.1401223be
nop
mov qword [rbp + 8], 0
jmp 0x1401b860f
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x1401b8665
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x1401b8604
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14011de1d
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14013e120
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x14068b118]
call fcn.1401223be
nop
xor eax, eax
test eax, eax
je 0x14013e15b
movsx eax, byte [rbp + 0xf8]
or eax, 0x20
mov dword [rbp + 0xc0], eax
jmp 0x14013e168
movsx eax, byte [rbp + 0xf8]
mov dword [rbp + 0xc0], eax
mov eax, dword [rbp + 0xc0]
mov ecx, dword [rbp + 0xf0]
xor ecx, eax
mov eax, ecx
imul eax, eax, 0x1000193
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret
Function at 0x14011efac
Capabilities:
Terminate process

Disassembly:
jmp 0x140353660
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14011f894
Capabilities:
Write file on windows

Disassembly:
jmp 0x14021cc60
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x14068c2c4]
call fcn.1401223be
nop
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x14011f916
Capabilities:
Get geographical location

Disassembly:
jmp 0x14034ef50
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14034ef8d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.14012236e
add rsp, 0x58
ret
Function at 0x14011fc22
Capabilities:
Read file on windows

Disassembly:
jmp 0x14021cbe0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x14068c2c4]
call fcn.1401223be
nop
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x14011fc4a
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x14021eaf0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x14068c2c4]
call fcn.1401223be
nop
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x1403888c0]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x14021ec36
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x14021eb8a
mov dword [rbp + 0x160], 1
jmp 0x14021eb94
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x14021ec31
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x14021ec0b
cmp qword [rbp + 0x198], 2
jb 0x14021ec0b
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14021ec0b
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14021ec0b
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x14021eb55
jmp 0x14021ecd0
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x14021ecd0
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x14021eca7
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14021eca7
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14021eca7
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x14021ec36
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x14011feca
Capabilities:
Parse pe header

Disassembly:
jmp 0x140354f70
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140354f90
xor al, al
jmp 0x140355011
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140354fa3
xor al, al
jmp 0x140355011
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140354fcd
xor al, al
jmp 0x140355011
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140354fe1
xor al, al
jmp 0x140355011
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140354ff3
xor al, al
jmp 0x140355011
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14035500f
xor al, al
jmp 0x140355011
mov al, 1
add rsp, 0x38
ret
Function at 0x140120c80
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x140330d80
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x14068cb32]
call fcn.1401223be
nop
mov ecx, dword [0x1406608d4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140330e74
movzx eax, byte [0x14066769c]
test eax, eax
jne 0x140330e72
mov byte [0x14066769c], 1
mov rax, qword [rbp + 0xf0]
movzx eax, byte [rax + 0x1c]
test eax, eax
jne 0x140330deb
mov dword [rbp + 0xc0], 1
jmp 0x140330df5
mov dword [rbp + 0xc0], 0
mov rax, qword [rbp + 0xf0]
movzx ecx, byte [rbp + 0xc0]
mov byte [rax + 0x1c], cl
mov rax, qword [rbp + 0xf0]
movzx eax, byte [rax + 0x1c]
test eax, eax
je 0x140330e44
mov r8d, 0x80000a8
mov edx, 0xffffffec
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SetWindowLongW]
nop
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
nop
jmp 0x140330e72
mov r8d, 0x80800a8
mov edx, 0xffffffec
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SetWindowLongW]
nop
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
nop
jmp 0x140330e7b
mov byte [0x14066769c], 0
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret
Function at 0x140121adb
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x14021e9d0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x14068c2c4]
call fcn.1401223be
nop
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x1403888c0]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x14021ea50
mov dword [rbp + 0x120], 1
jmp 0x14021ea5a
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x14021eaa3
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x14021ea1b
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x140122233
Capabilities:
Write file on windows

Disassembly:
jmp 0x140190d50
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x14065f200]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x14068b32b]
call fcn.1401223be
nop
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x140190db7
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140190dbe
mov al, 1
jmp 0x140190f2e
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.14011cee6
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.14011cee6
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.140120a87
movzx eax, al
test eax, eax
je 0x140190e21
xor al, al
jmp 0x140190f2e
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x140190e94
cmp dword [rbp + 0x160], 1
je 0x140190e9f
cmp dword [rbp + 0x160], 3
je 0x140190f1d
jmp 0x140190f2c
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140190eef
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140190eef
xor al, al
jmp 0x140190f2e
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140190f0a
mov dword [rbp + 0x154], 1
jmp 0x140190f14
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x140190f2e
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140190f2e
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1403752c0]
call fcn.140120f73
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.14011e6bf
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x140139a80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14065f200]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14068b16b]
call fcn.1401223be
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.14014b8e0
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14013e430
nop
lea rax, [0x140138730]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14014fa40
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x140139b5c
lea rcx, [rbp + 8]
call fcn.140150cf0
nop
jmp 0x140139b75
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14011c93c
nop
lea rcx, [rbp + 8]
call fcn.1401443b0
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14036f2a0]
call fcn.140120f73
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.14011e6bf
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x140139c00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14065f200]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14068b16b]
call fcn.1401223be
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.14014b920
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14013e500
nop
lea rax, [0x140138840]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14014fa90
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x140139cdc
lea rcx, [rbp + 8]
call fcn.140150d50
nop
jmp 0x140139cf5
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14011c93c
nop
lea rcx, [rbp + 8]
call fcn.140144440
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14036f320]
call fcn.140120f73
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.14011e6bf
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x140139d80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14065f200]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14068b16b]
call fcn.1401223be
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.14014b960
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14013e5d0
nop
lea rax, [0x140138950]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14014fae0
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x140139e5c
lea rcx, [rbp + 8]
call fcn.140150db0
nop
jmp 0x140139e75
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14011c93c
nop
lea rcx, [rbp + 8]
call fcn.1401444d0
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14036f3a0]
call fcn.140120f73
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.14011e6bf
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x140139f00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14065f200]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14068b16b]
call fcn.1401223be
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.14014b9a0
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14013e6a0
nop
lea rax, [0x140138a60]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14014fb30
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x140139fdc
lea rcx, [rbp + 8]
call fcn.140150e10
nop
jmp 0x140139ff5
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14011c93c
nop
lea rcx, [rbp + 8]
call fcn.140144560
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14036f420]
call fcn.140120f73
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.14011e6bf
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x1401d2030
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14065f200]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14068bf4a]
call fcn.1401223be
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.1401e6fc0
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.1401d46c0
nop
lea rax, [0x1401d1920]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.1401ec970
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x1401d210c
lea rcx, [rbp + 8]
call fcn.1401ed400
nop
jmp 0x1401d2125
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14011c93c
nop
lea rcx, [rbp + 8]
call fcn.1401d72a0
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x1403878d0]
call fcn.140120f73
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.14011e6bf
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x140299400
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rcx, [0x14068c55d]
call fcn.1401223be
nop
call fcn.1402977d0
mov qword [rbp + 8], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
mov dword [rbp + 0x44], eax
mov rax, qword [rbp + 8]
add rax, 0x2c
mov r9d, 4
mov r8, rax
mov edx, 0x20001004
mov ecx, dword [rbp + 0x44]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140299473
mov rax, qword [rbp + 8]
mov dword [rax + 0x2c], 0
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x140353d50
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140122819
movzx eax, al
test eax, eax
jne 0x140353d70
mov ecx, 7
call fcn.14012102c
nop
mov byte [rsp + 0x20], 0
call fcn.140121211
mov byte [rsp + 0x21], al
cmp dword [0x140667ac0], 1
jne 0x140353d94
mov ecx, 7
call fcn.14012102c
nop
jmp 0x140353dec
cmp dword [0x140667ac0], 0
jne 0x140353de7
mov dword [0x140667ac0], 1
lea rdx, [0x14036c8c8]
lea rcx, [0x14036c598]
call fcn.14011e58e
test eax, eax
je 0x140353dc8
mov eax, 0xff
jmp 0x140353ef1
lea rdx, [0x14036c488]
lea rcx, [section..rdata]
call fcn.1401211b7
mov dword [0x140667ac0], 2
jmp 0x140353dec
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140120ed3
call fcn.1401201e0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140353e49
mov rcx, qword [rsp + 0x30]
call fcn.14011db48
movzx eax, al
test eax, eax
je 0x140353e49
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14068f020]
nop
call fcn.14012073f
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140353e7d
mov rcx, qword [rsp + 0x38]
call fcn.14011db48
movzx eax, al
test eax, eax
je 0x140353e7d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140122021
nop
call fcn.140353fa0
mov dword [rsp + 0x28], eax
call fcn.14011feca
movzx eax, al
test eax, eax
jne 0x140353e9c
mov ecx, dword [rsp + 0x28]
call fcn.14011b7da
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140353eab
call fcn.140122175
nop
xor edx, edx
mov cl, 1
call fcn.14011d913
mov eax, dword [rsp + 0x28]
jmp 0x140353ef1
add rsp, 0x68
ret
Function at 0x140037bf0
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x140131c08]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, r8
mov rdi, rcx
mov qword [rbp - 0x41], rcx
xor esi, esi
mov dword [rbp - 0x45], esi
lea rcx, [rbp + 0x17]
call fcn.1400714a0
nop
lea rax, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0x10
cmovae rax, qword [rbp + 0x17]
mov qword [rbp - 0x11], rax
mov eax, dword [rbp + 0x27]
mov dword [rbp - 0x19], eax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140037c50
mov rax, qword [rbx]
mov qword [rbp - 0x21], rax
mov eax, dword [rbx + 0x10]
mov dword [rbp - 0x29], eax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp - 0x29]
xor edx, edx
lea rcx, [rbp - 0x19]
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x140037db9
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], rsi
mov qword [rbp + 0xf], rsi
mov qword [rbp + 7], rsi
mov qword [rbp + 0xf], 0xf
mov byte [rbp - 9], 0
mov ebx, dword [rbp - 0x39]
test rbx, rbx
jne 0x140037cbc
mov qword [rbp + 7], rbx
mov byte [rbp + rbx - 9], bl
jmp 0x140037cf0
lea rcx, [rbp - 9]
cmp rbx, 0xf
ja 0x140037cdb
mov qword [rbp + 7], rbx
mov r8, rbx
xor edx, edx
call fcn.1400ae200
mov byte [rbp + rbx - 9], 0
jmp 0x140037cf0
mov byte [rsp + 0x20], 0
mov r9, rbx
movzx r8d, byte [rbp - 0x49]
mov rdx, rbx
call fcn.1400474e0
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae rcx, qword [rbp - 9]
mov r8d, dword [rbp - 0x39]
mov rdx, qword [rbp - 0x31]
call fcn.1400adb50
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_LocalFree]
movups xmm0, xmmword [rbp - 9]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp + 7]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbp + 7], rsi
mov qword [rbp + 0xf], 0xf
mov byte [rbp - 9], 0
mov byte [rdi + 0x20], 1
mov dword [rbp - 0x45], 1
mov qword [rbp + 7], rsi
mov qword [rbp + 0xf], 0xf
mov byte [rbp - 9], 0
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0x10
jb 0x140037d86
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037d81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037df6
call fcn.1400ab870
movdqa xmm0, xmmword [0x14011a1a0]
movdqu xmmword [rbp + 0x27], xmm0
mov byte [rbp + 0x17], 0
mov rax, rdi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400ab850
mov rbx, qword [rsp + 0x108]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
mov byte [rdi + 0x20], 0
mov dword [rbp - 0x45], 1
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0x10
jb 0x140037d86
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037d81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037d81
call fcn.14008f288
int3