joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400215c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rcx
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1401289aa.0]
lea rcx, [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x10]
xor esi, esi
test rcx, rcx
je 0x14002161c
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x10], rsi
lea rcx, [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp qword [rdi + 0x1c0], rsi
je 0x140021688
mov dword [rsp + 0x40], 1
call fcn.140019560
test al, al
je 0x140021653
lea rdx, [rsp + 0x40]
mov rcx, qword [rdi + 0x1c0]
call fcn.140044346
jmp 0x14002166a
call fcn.140019560
lea rcx, [rsp + 0x40]
mov rax, qword [rdi + 0x1c0]
call qword [case.0x1401289aa.0]
call fcn.140019560
lea rcx, [rsp + 0x40]
mov rax, qword [rdi + 0x1c0]
call qword [case.0x1401289aa.0]
mov qword [rdi + 0x1c0], rsi
cmp byte [rdi + 0x328], sil
je 0x14002179d
add rdi, 0x2a8
mov rax, qword [rdi + 0x50]
cmp qword [rdi + 0x48], rax
je 0x14002179d
cmp qword [rdi + 0x10], rsi
je 0x14002179d
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140017c80
nop
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140021756
mov dword [rsp + 0x40], esi
mov rdx, qword [rdi + 0x48]
mov r8, qword [rdi + 0x50]
sub r8, rdx
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002174d
mov rax, qword [rdi + 0x50]
sub rax, qword [rdi + 0x48]
cmp dword [rsp + 0x40], eax
jne 0x14002174d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rdi + 0x60]
mov rcx, rdi
call fcn.14001c930
jmp 0x140021756
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.14001c320
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14002179d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021798
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400217bc
call fcn.1401594f8
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140158fa0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14015fc24
int3
Function at 0x14002fff0
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rcx + 0x358], 0
mov rdi, rcx
je 0x140030083
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, qword [rdi + 0x358]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x28], 0
mov r8, rbx
mov dword [rsp + 0x20], 0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rbx, qword [rsp + 0x68]
test eax, eax
je 0x1400300d2
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140158fa0
add rsp, 0x50
pop rdi
ret
mov r8d, dword [rcx + 0x1f0]
test r8d, r8d
je 0x1400300d2
mov rax, qword gs:[0x30]
mov edx, 0x400
mov rcx, qword [rax + 0x60]
mov eax, 0x1000
cmp dword [rcx + 0x118], 5
cmove eax, edx
xor edx, edx
or eax, 0x100001
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140158fa0
add rsp, 0x50
pop rdi
ret
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140158fa0
add rsp, 0x50
pop rdi
ret
Function at 0x140033340
Capabilities:
Set environment variable

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rax, [0x140348780]
lea rdx, [0x140348ae8]
test cl, cl
cmovne rdx, rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 7
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x140033383
lea rcx, [rsp + 0x20]
call fcn.1400047e0
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rdx, qword [rsp + 0x20]
lea rcx, str.SteamNoOverlayUIDrawing
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400333f4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400333ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033406
call fcn.1401594f8
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140158fa0
add rsp, 0x58
ret
call fcn.14015fc24
int3
Function at 0x14003de80
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
call fcn.140019560
test al, al
je 0x14003debd
mov byte [rbx + 0x5a8], 1
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140158fa0
add rsp, 0x50
pop rbx
ret
cmp qword [rbx + 0x5b0], 0
mov qword [rsp + 0x68], rdi
je 0x14003e06a
call fcn.14015754c
mov rdi, rax
call fcn.140157530
cmp rdi, 0x989680
jne 0x14003deec
imul rax, rax, 0x64
jmp 0x14003df0a
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
sub rax, qword [rbx + 0x5b0]
movabs rcx, 0xdf8475801
cmp rax, rcx
jl 0x14003df29
lea r9, str.Exit_defer_time_crossed__the_bootstrapper_will_leave_the_visible_state_despite_the_game_window_not_being_visible.
jmp 0x14003df9c
mov rcx, qword [rbx + 0x5c0]
test rcx, rcx
je 0x14003e031
cmp dword [rbx + 0x5c8], 0
je 0x14003e031
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [rsp + 0x30]
test eax, eax
je 0x14003e013
cmp ecx, 0x103
jne 0x14003e013
mov eax, dword [rbx + 0x5c8]
lea rdx, [rsp + 0x38]
lea rcx, [0x140033d10]
mov dword [rsp + 0x38], eax
mov byte [rsp + 0x3c], 0
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [rsp + 0x3c], 0
je 0x14003e06a
lea r9, str.The_game_window_has_become_visible__the_bootstrapper_will_leave_the_visible_state.
mov rcx, qword [0x14037a480]
lea r8, [0x140346534]
mov edx, 3
call fcn.140016400
call fcn.14015754c
mov rdi, rax
call fcn.140157530
cmp rdi, 0x989680
jne 0x14003dfe3
imul rax, rax, 0x64
mov byte [rbx + 0x5a8], 1
mov qword [rbx + 0x5b8], rax
xor al, al
jmp 0x14003e06c
cqo
mov byte [rbx + 0x5a8], 1
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
mov qword [rbx + 0x5b8], rax
xor al, al
jmp 0x14003e06c
mov rax, qword [rbx + 0x5c0]
lea r9, str.Fatal_error__game_process_handle:__p__exit_code:__u.
mov dword [rsp + 0x28], ecx
mov edx, 1
mov qword [rsp + 0x20], rax
jmp 0x14003e04c
mov eax, dword [rbx + 0x5c8]
lea r9, str.Game_process_handle_or_ID_have_become_invalidated__leaving_the_visible_state:__p___i.
mov dword [rsp + 0x28], eax
mov edx, 3
mov qword [rsp + 0x20], rcx
mov rcx, qword [0x14037a480]
lea r8, [0x140346534]
call fcn.140016400
xor al, al
mov byte [rbx + 0x5a8], 1
jmp 0x14003e06c
mov al, 1
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140158fa0
add rsp, 0x50
pop rbx
ret
Function at 0x1400419d0
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x2a0
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbx, rcx
mov qword [rsp + 0x78], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], dil
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x14]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], di
lea rax, [rsp + 0x80]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140041a60
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x38]
call fcn.1400047e0
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.140017ae0
mov rdx, rax
mov rcx, rbx
call fcn.1400045b0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140041ad5
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041ad0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041b8d
call fcn.1401594f8
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x58], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140041b26
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041b21
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041b87
call fcn.1401594f8
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140041b63
mov rcx, rbx
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140041b3f
mov rcx, qword [rbx]
cmp byte [rax + rcx - 1], 0x5c
je 0x140041b63
mov rcx, rbx
cmp rdx, 0x10
jb 0x140041b52
mov rcx, qword [rbx]
cmp byte [rax + rcx - 1], 0x2f
je 0x140041b63
mov dl, 0x5c
mov rcx, rbx
call fcn.1400044f0
mov rax, rbx
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140158fa0
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x2a0
pop rdi
ret
call fcn.14015fc24
nop
call fcn.14015fc24
int3
Function at 0x140055ef0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rbx, rcx
xor edx, edx
xor ecx, ecx
call fcn.140078690
mov ecx, reloc.WS2_32.dll_socket
mov esi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ebp, ebp
test eax, eax
mov edi, ebp
setne dil
lea ecx, [rbp + 1]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x140055f55
mov dword [rsp + 0x28], ebp
mov r9, rbx
mov r8d, edi
mov byte [rsp + 0x20], 1
mov edx, esi
xor ecx, ecx
call fcn.1400561e0
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x140055f7f
mov dword [rsp + 0x28], ebp
mov r9, rbx
mov r8d, edi
mov byte [rsp + 0x20], 3
mov edx, esi
xor ecx, ecx
call fcn.1400561e0
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x140055fa9
mov dword [rsp + 0x28], ebp
mov r9, rbx
mov r8d, edi
mov byte [rsp + 0x20], 2
mov edx, esi
xor ecx, ecx
call fcn.1400561e0
mov ecx, 5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x140055fd3
mov dword [rsp + 0x28], ebp
mov r9, rbx
mov r8d, edi
mov byte [rsp + 0x20], 4
mov edx, esi
xor ecx, ecx
call fcn.1400561e0
mov ecx, 6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x140055ffd
mov dword [rsp + 0x28], ebp
mov r9, rbx
mov r8d, edi
mov byte [rsp + 0x20], 5
mov edx, esi
xor ecx, ecx
call fcn.1400561e0
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov qword [rbx + 0x50], rbp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x30
pop r14
ret
Function at 0x140056640
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
mov edi, eax
cmp dword [reloc.WS2_32.dll_accept], ebx
je 0x1400566f8
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400566f8
nop
mov rax, qword [0x140376410]
test rax, rax
je 0x1400566b2
mov rcx, qword [rsp + 0x48]
mov r9, qword [rsp + 0x40]
mov r8d, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [0x140376418]
call qword [case.0x1401289aa.0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, edi
sub eax, dword [rsp + 0x50]
test eax, eax
jg 0x1400566d9
inc ebx
cmp ebx, 3
jg 0x1400566f8
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140056680
xor ecx, ecx
call fcn.140070be0
mov rbx, rax
cmp byte [rax + 0xe1], 1
jne 0x140056729
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x140056729
mov edx, 0xe1
xor ecx, ecx
call fcn.140070e80
cmp byte [rbx + 0xe5], 1
jne 0x140056750
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x140056750
mov edx, 0xe5
xor ecx, ecx
call fcn.140070e80
cmp byte [rbx + 0xe3], 1
jne 0x140056777
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x140056777
mov edx, 0xe3
xor ecx, ecx
call fcn.140070e80
cmp byte [rbx + 0xe7], 1
jne 0x14005679e
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x14005679e
mov edx, 0xe7
xor ecx, ecx
call fcn.140070e80
call fcn.140056800
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140060000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rbp + 0x47], rax
movzx eax, byte [rcx]
mov r9d, 0x7fff
movdqa xmm0, xmmword [0x140223050]
mov r10, rcx
movsx r11d, dx
mov dword [rsp], 0x80007
mov dword [rsp + 4], 0xa0009
mov dword [rsp + 8], 0xc000b
mov dword [rbp - 0x7d], 0xe000d
mov dword [rbp - 0x79], 0x110010
mov dword [rbp - 0x75], 0x150013
mov dword [rbp - 0x71], 0x190017
mov dword [rbp - 0x6d], 0x1f001c
mov dword [rbp - 0x69], 0x250022
mov dword [rbp - 0x65], 0x2d0029
mov dword [rbp - 0x61], 0x370032
mov dword [rbp - 0x5d], 0x42003c
mov dword [rbp - 0x59], 0x500049
mov dword [rbp - 0x55], 0x610058
mov dword [rbp - 0x51], 0x76006b
mov dword [rbp - 0x4d], 0x8f0082
mov dword [rbp - 0x49], 0xad009d
mov dword [rbp - 0x45], 0xd100be
mov dword [rbp - 0x41], 0xfd00e6
mov dword [rbp - 0x3d], 0x1330117
mov dword [rbp - 0x39], 0x1730151
mov dword [rbp - 0x35], 0x1c10198
mov dword [rbp - 0x31], 0x22001ee
mov dword [rbp - 0x2d], 0x2920256
mov dword [rbp - 0x29], 0x31c02d4
mov dword [rbp - 0x25], 0x3c3036c
mov dword [rbp - 0x21], 0x48e0424
mov dword [rbp - 0x1d], 0x5830502
mov dword [rbp - 0x19], 0x6ab0610
mov dword [rbp - 0x15], 0x8120756
mov dword [rbp - 0x11], 0x9c308e0
mov dword [rbp - 0xd], 0xbd00abd
mov dword [rbp - 9], 0xe4c0cff
mov dword [rbp - 5], 0x114c0fba
mov dword [rbp - 1], 0x14ee1307
mov dword [rbp + 3], 0x19541706
mov dword [rbp + 7], 0x1ea51bdc
mov dword [rbp + 0xb], 0x251521b6
mov dword [rbp + 0xf], 0x2cdf28ca
mov dword [rbp + 0x13], 0x364b315b
mov dword [rbp + 0x17], 0x41b23bb9
mov dword [rbp + 0x1b], 0x4f7e4844
mov dword [rbp + 0x1f], 0x602f5771
mov dword [rbp + 0x23], 0x746269ce
mov word [rbp + 0x27], r9w
movdqu xmmword [rbp + 0x37], xmm0
cmp al, 0x58
jle 0x14006017c
mov cl, 0x58
jmp 0x140060185
xor edx, edx
mov ecx, eax
test al, al
cmovs ecx, edx
movsx rax, cl
movzx edx, word [rsp + rax*2]
movzx eax, r8b
add cl, byte [rbp + rax + 0x37]
mov byte [r10], cl
mov ecx, edx
shr ecx, 3
test r8b, 4
je 0x1400601a5
add ecx, edx
test r8b, 2
je 0x1400601b1
mov eax, edx
shr eax, 1
add ecx, eax
test r8b, 1
je 0x1400601bc
shr edx, 2
add ecx, edx
mov edx, ecx
neg edx
and r8b, 8
cmove edx, ecx
add edx, r11d
cmp edx, r9d
jle 0x1400601d5
movzx eax, r9w
jmp 0x1400601e2
mov eax, 0xffff8000
cmp edx, eax
cmovl edx, eax
movzx eax, dx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140158fa0
add rsp, 0xe0
pop rbp
ret
Function at 0x14006b450
Capabilities:
Hash data using djb2

Disassembly:
mov r9d, 0x1505
lea r8, [rcx + 0x28]
mov r10d, 8
cvttss2si rax, dword [r8 - 4]
lea r8, [r8 + 0x40]
imul ecx, eax, 0x21
cvttss2si rax, dword [r8 - 0x40]
add ecx, eax
cvttss2si rax, dword [r8 - 0x3c]
imul edx, ecx, 0x21
add edx, eax
cvttss2si rax, dword [r8 - 0x38]
imul ecx, edx, 0x21
add ecx, eax
cvttss2si rax, dword [r8 - 0x34]
imul edx, ecx, 0x21
add edx, eax
cvttss2si rax, dword [r8 - 0x30]
imul ecx, edx, 0x21
add ecx, eax
cvttss2si rax, dword [r8 - 0x54]
imul edx, ecx, 0x21
imul ecx, eax, 0x21
cvttss2si rax, dword [r8 - 0x50]
add ecx, eax
imul eax, ecx, 0x40a9121
add edx, eax
cvttss2si rax, dword [r8 - 0x64]
imul ecx, eax, 0x5cb8923f
cvttss2si rax, dword [r8 - 0x48]
sub edx, ecx
imul ecx, eax, 0x13be2b1f
cvttss2si rax, dword [r8 - 0x60]
sub edx, ecx
imul ecx, eax, 0x3b4039a1
cvttss2si rax, dword [r8 - 0x58]
add edx, ecx
imul ecx, eax, 0x30f35d61
cvttss2si rax, dword [r8 - 0x5c]
add edx, ecx
imul ecx, eax, 0x4f5f0981
cvttss2si rax, dword [r8 - 0x68]
add edx, ecx
imul ecx, eax, 0xc3525e1
cvttss2si rax, dword [r8 - 0x4c]
add edx, ecx
imul ecx, eax, 0x747c7101
cvttss2si rax, dword [r8 - 0x2c]
add edx, ecx
imul ecx, r9d, 0x6d261dff
add edx, eax
mov r9d, edx
sub r9d, ecx
sub r10, 1
jne 0x14006b460
mov eax, r9d
ret

Function at 0x14006e410
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x170
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rax, str.DS4Windows.exe
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor edx, edx
lea rax, str.InputMapper.exe
mov qword [rsp + 0x28], rax
lea ecx, [rbx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14006e504
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], pe_nt_image_headers64
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14006e4fb
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x188], rdi
mov qword [rsp + 0x190], r14
lea r14d, [rbx + 1]
nop dword [rax]
xor edi, edi
lea rsi, [rsp + 0x20]
nop word [rax + rax]
mov rdx, qword [rsi]
lea rcx, [rsp + 0x5c]
call fcn.140053380
test eax, eax
lea rsi, [rsi + 8]
cmove ebx, r14d
inc edi
cmp edi, 2
jb 0x14006e4b0
lea rdx, [rsp + 0x30]
mov rcx, rbp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x14006e4e3
test ebx, ebx
je 0x14006e4a0
mov r14, qword [rsp + 0x190]
mov rdi, qword [rsp + 0x188]
mov rsi, qword [rsp + 0x180]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140158fa0
mov rbx, qword [rsp + 0x198]
add rsp, 0x170
pop rbp
ret
Function at 0x140084220
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400842a4
call fcn.140053500
test rax, rax
je 0x1400842a4
mov r8d, dword [0x140377d00]
mov rcx, rbx
mov rdx, qword [0x140377cf8]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
je 0x1400842a4
cmp rdi, qword [0x140377d00]
jbe 0x140084292
mov rcx, qword [0x140377cf8]
mov edx, edi
call fcn.1400841c0
test rax, rax
je 0x1400842a4
mov r8d, edi
mov qword [0x140377cf8], rax
mov rdx, rax
mov qword [0x140377d00], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rax, qword [0x140377cf8]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14008a040
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
mov dword [rsp + 0x50], 0
mov r10, rdx
mov r9, rbx
mov rdx, qword [rcx + 0xa8]
mov rax, rdx
neg rax
mov qword [rbx + 0xc8], r8
lea rax, [rsp + 0x50]
sbb ecx, ecx
mov qword [rsp + 0x28], rax
and ecx, 0x10000
mov dword [rsp + 0x20], ecx
xor ecx, ecx
test r10, r10
je 0x14008a09a
lea r8, [0x14008a030]
mov rax, r10
call qword [case.0x1401289aa.0]
jmp 0x14008a0a7
lea r8, [0x14008a030]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
jne 0x14008a0c1
lea rcx, str.Not_enough_resources_to_create_thread
add rsp, 0x40
pop rbx
jmp fcn.140052570
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x140092ec0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor r11d, r11d
mov rbx, r8
mov rdi, rdx
mov r10d, ecx
test r8, r8
je 0x140092f0d
nop dword [rax + rax]
movzx ecx, byte [r11 + rdi]
movzx eax, r10b
xor ecx, eax
call fcn.140092f20
shr r10d, 8
inc r11
xor eax, r10d
mov r10d, eax
cmp r11, rbx
jb 0x140092ee0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov eax, ecx
add rsp, 0x20
pop rdi
ret

Function at 0x140097330
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentThreadId
xor edi, edi
mov ebx, eax
cmp qword [0x140376338], rdi
jne 0x140054278
lea rcx, [0x140376334]
call fcn.14005d4b0
cmp qword [0x140376338], rdi
jne 0x14005426c
call fcn.140079a50
nop
mov qword [0x140376338], rax
test rax, rax
jne 0x14005426c
lea rcx, [0x140376334]
call fcn.14005d510
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x140376334]
call fcn.14005d510
nop
mov rcx, qword [0x140376338]
call fcn.140079b50
mov rax, qword [0x140376340]
test rax, rax
je 0x1400542a4
cmp dword [rax], ebx
je 0x1400542a0
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140054291
jmp 0x1400542a4
mov rdi, qword [rax + 8]
mov rcx, qword [0x140376338]
call fcn.140079b70
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
sub rsp, 0x28
cmp dword [0x140371ca0], 0xffffffff
jne 0x14009738e
cmp dword [0x140377e48], 0
jne 0x140097397
lea rcx, [0x140377e4c]
call fcn.14005d4b0
cmp dword [0x140371ca0], 0xffffffff
jne 0x140097382
cmp dword [0x140377e48], 0
jne 0x140097382
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140097378
nop
mov dword [0x140371ca0], eax
jmp 0x140097382
mov dword [0x140377e48], 1
lea rcx, [0x140377e4c]
call fcn.14005d510
cmp dword [0x140377e48], 0
je 0x1400973a0
add rsp, 0x28
jmp 0x140054210
nop
mov ecx, dword [0x140371ca0]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1400973c0
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call sub.KERNEL32.dll_GetCurrentThreadId
mov rcx, qword [0x140376338]
mov edi, eax
call fcn.140079b50
mov rbx, qword [0x140376340]
xor edx, edx
test rbx, rbx
je 0x140054303
cmp dword [rbx], edi
je 0x14005434b
mov rdx, rbx
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400542f3
mov ecx, 0x18
call fcn.140084170
mov rbx, rax
test rax, rax
je 0x140054354
mov rcx, qword [0x140376338]
mov dword [rax], edi
mov qword [rax + 8], rsi
mov rax, qword [0x140376340]
mov qword [rbx + 0x10], rax
mov qword [0x140376340], rbx
call fcn.140079b70
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test rsi, rsi
je 0x14005437b
mov qword [rbx + 8], rsi
mov rcx, qword [0x140376338]
call fcn.140079b70
test rbx, rbx
jne 0x140054339
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140052490
mov rax, qword [rbx + 0x10]
test rdx, rdx
je 0x140054392
mov rcx, rbx
mov qword [rdx + 0x10], rax
call fcn.140084140
jmp 0x140054354
mov rcx, rbx
mov qword [0x140376340], rax
call fcn.140084140
jmp 0x140054354
sub rsp, 0x28
cmp dword [0x140377e48], 0
je 0x1400973d6
add rsp, 0x28
jmp 0x1400542c0
mov rdx, rcx
mov ecx, dword [0x140371ca0]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400973f9
lea rcx, str.TlsSetValue___failed
add rsp, 0x28
jmp fcn.140052570
xor eax, eax
add rsp, 0x28
ret