joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a9870
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0xa8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x18033a1b0]
cmp eax, dword [0x1802af2b0]
jb 0x1800a9b11
mov qword [rsp + 0xb0], rbx
movabs rax, 0xd80958fc74e988a6
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xa0], rdi
xor edi, edi
mov dword [0x1802bdc48], edi
mov dword [0x1802bdc58], edi
mov qword [0x18033c890], rax
call fcn.1800cdff0
mov qword [rsp + 0xb8], rdi
mov ebx, dword [rax]
movabs rax, 0x963d27a58df860ac
mov qword [0x18033c890], rax
mov eax, dword [0x1802af2ac]
mov dword [rsp + 0xb8], eax
mov rax, qword [rsp + 0xb8]
mov qword [0x1802bdd20], rax
mov dword [0x1802bdc58], edi
mov dword [0x1802bdc48], 1
call fcn.1800cdff0
mov eax, dword [0x1802af2ac]
movabs rsi, 0x98a4eb5d89a0c952
mov qword [rsp + 0xb8], rdi
mov dword [rsp + 0xb8], eax
mov rax, qword [rsp + 0xb8]
mov qword [0x1802bdd20], rax
mov dword [0x1802bdc58], edi
mov qword [0x18033c890], rsi
mov dword [0x1802bdc48], 1
call fcn.1800cdff0
cmp dword [rax], edi
jne 0x1800a99c2
call qword [sym.imp.WINMM.dll_timeGetTime]
mov rcx, qword [0x180333b10]
mov dword [0x180333b08], eax
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov eax, dword [0x1802af2ac]
mov qword [rsp + 0xb8], rdi
mov dword [rsp + 0xb8], eax
mov rax, qword [rsp + 0xb8]
mov qword [0x1802bdd20], rax
mov dword [0x1802bdc58], edi
mov qword [0x18033c890], rsi
mov dword [0x1802bdc48], 1
call fcn.1800cdff0
cmp dword [rax], edi
je 0x1800a9965
movabs rax, 0x3fef770d40960d5a
mov qword [rsp + 0xb8], rdi
mov qword [0x18033c890], rax
mov dword [rsp + 0xb8], ebx
mov rax, qword [rsp + 0xb8]
mov qword [0x1802bdd20], rax
mov dword [0x1802bdc58], edi
mov qword [0x1802bdd28], rdi
mov dword [0x1802bdc48], 2
call fcn.1800cdff0
mov rsi, qword [rsp + 0xc0]
mov ebx, edi
cmp dword [0x1802af2d8], ebx
movups xmm0, xmmword [rax]
movsd xmm1, qword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm0
movsd qword [rsp + 0x60], xmm1
jle 0x1800a9aab
movaps xmmword [rsp + 0x90], xmm6
movss xmm6, dword [rsp + 0x60]
movaps xmmword [rsp + 0x80], xmm7
movss xmm7, dword [rsp + 0x58]
movaps xmmword [rsp + 0x70], xmm8
movss xmm8, dword [rsp + 0x50]
nop dword [rax + rax]
mov eax, dword [0x1802af2ac]
movaps xmm3, xmm7
mov dword [rsp + 0x38], eax
movaps xmm2, xmm8
mov eax, dword [0x1802af2a8]
mov edx, 0xde78f17e
mov dword [rsp + 0x30], eax
movss dword [rsp + 0x20], xmm6
call fcn.1800af7b0
inc ebx
cmp ebx, dword [0x1802af2d8]
jl 0x1800a9a60
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
movabs rax, 0xe532f5d78798daab
mov qword [rsp + 0xb8], rdi
mov qword [0x18033c890], rax
mov eax, dword [0x1802af2ac]
mov dword [rsp + 0xb8], eax
mov rax, qword [rsp + 0xb8]
mov qword [0x1802bdd20], rax
mov dword [0x1802bdc58], edi
mov dword [0x1802bdc48], 1
call fcn.1800cdff0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xb0]
mov dword [0x18033a1b0], eax
add rsp, 0xa8
ret
Function at 0x1800ab0c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1802943b0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x1800ab285
movsxd rdx, dword [0x18031c280]
shl rdx, 5
add rdx, qword [0x18033a388]
lea rcx, [rsp + 0x70]
call fcn.180036220
nop
cmp qword [rsp + 0x80], 0
je 0x1800ab27b
xor ebx, ebx
mov dword [0x1802bdc58], ebx
movabs rax, 0xb80d8756b4668ab6
mov qword [0x18033c890], rax
lea rdi, str.core
mov qword [0x1802bdd20], rdi
mov dword [0x1802bdc48], 1
call fcn.1800cdff0
mov dword [0x1802bdc58], ebx
movabs rax, 0x6c38af3693a69a91
mov qword [0x18033c890], rax
mov qword [0x1802bdd20], rdi
mov dword [0x1802bdc48], 1
call fcn.1800cdff0
call qword [sym.imp.WINMM.dll_timeGetTime]
sub eax, dword [0x180332110]
mov dword [0x1802bdc48], ebx
mov dword [0x1802bdc58], ebx
cmp eax, 0xc8
jbe 0x1800ab237
movabs rax, 0xd80958fc74e988a6
mov qword [0x18033c890], rax
call fcn.1800cdff0
lea rcx, [rsp + 0x70]
cmp qword [rsp + 0x88], 0x10
cmovae rcx, qword [rsp + 0x70]
movss xmm0, dword [0x18026c0b0]
movss dword [rsp + 0x48], xmm0
mov dword [rsp + 0x40], 0x796e
movss xmm1, dword [0x18026cf70]
movss dword [rsp + 0x38], xmm1
movss xmm0, dword [0x18026ef8c]
movss dword [rsp + 0x30], xmm0
movss dword [rsp + 0x28], xmm1
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x18026bd50]
movss xmm2, dword [0x18026bb78]
mov edx, dword [rax]
call fcn.1800b2240
call qword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x180332110], eax
jmp 0x1800ab24d
movabs rax, 0x88c6814073dd4a73
mov qword [0x18033c890], rax
call fcn.1800cdff0
mov dword [0x1802bdc58], ebx
movabs rax, 0x5f61ebbe1a00f96d
mov qword [0x18033c890], rax
mov qword [0x1802bdd20], rdi
mov dword [0x1802bdc48], 1
call fcn.1800cdff0
nop
lea rcx, [rsp + 0x70]
call fcn.18003bcb0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1801e62c0
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
Function at 0x1800b52e0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
sub rsp, 0x38
cmp byte [0x180332b1f], 0
je 0x1800b5397
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x40]
movaps xmmword [rsp + 0x20], xmm6
call qword [sym.imp.USER32.dll_GetCursorPos]
xor ebx, ebx
test eax, eax
je 0x1800b5314
cmp byte [0x180332b1f], bl
jne 0x1800b5319
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
movd xmm6, eax
cvtdq2ps xmm6, xmm6
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1800b5341
cmp byte [0x180332b1f], bl
je 0x1800b5341
mov rbx, qword [rsp + 0x40]
movss xmm1, dword [0x1802b717c]
movss xmm2, dword [0x18026bcc8]
movaps xmm0, xmm1
subss xmm0, xmm2
comiss xmm6, xmm0
jbe 0x1800b538b
addss xmm1, xmm2
comiss xmm1, xmm6
jbe 0x1800b538b
shr rbx, 0x20
movd xmm0, ebx
cvtdq2ps xmm0, xmm0
comiss xmm0, dword [0x18026bcdc]
jbe 0x1800b538b
mov rbx, qword [rsp + 0x30]
mov al, 1
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
ret
mov rbx, qword [rsp + 0x30]
xor al, al
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x1800bb960
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1800bb991
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18033c808]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18033c818]
lea rdx, [rdi + rdi]
call fcn.18003e100
mov rcx, qword [0x18033c808]
lea r9, [rdi - 1]
mov qword [0x18033c830], r9
mov qword [0x18033c838], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1800bbb36
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x14]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x15]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x16]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x17]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18033c818]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1800bba7c
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1800bbaf7
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x1800bbab9
mov r10, qword [rax]
cmp r10, rcx
je 0x1800bbab3
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1800bbaf7
mov r8, rax
cmp r10, rax
je 0x1800bbad3
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x1800bbb0b
cmp r10, rax
jne 0x1800bbac1
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x1800bbb31
mov r9, qword [0x18033c830]
jmp 0x1800bba01
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1800bbaf7
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800bca50
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
mov eax, 0x1e60
call fcn.1801eeca0
sub rsp, rax
mov rax, qword [0x1802943b0]
xor rax, rsp
mov qword [rsp + 0x1e50], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
mov eax, dword [rsp + 0x50]
lea rdx, str.__02d:_02d:_02d____s_n
mov r9d, dword [rsp + 0x54]
lea rcx, [rsp + 0x78]
mov r8d, dword [rsp + 0x58]
mov dword [rsp + 0x20], eax
call fcn.1800bce30
lea rbx, [rsp + 0x1e78]
call fcn.18003b6f0
mov rcx, qword [rsp + 0x1e70]
lea rdx, [rsp + 0x10a0]
mov qword [rsp + 0x30], rbx
mov r9d, 0xdac
mov qword [rsp + 0x28], 0
mov r8d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsnprintf_s]
lea r8, [rsp + 0x10a0]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0xa0]
call fcn.180035900
cmp byte [0x1802b8978], 0
je 0x1800bcb7e
lea r8, [0x180208be0]
lea rdx, [0x180334b90]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x1800bcb6a
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0xa0]
lea rdx, [0x18020df24]
call fcn.1800bcef0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0xa0]
call fcn.18003e510
lea r8, [rsp + 0x10a0]
lea rdx, [0x18020fc28]
lea rcx, [rsp + 0xa0]
call fcn.180035900
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x1e50]
xor rcx, rsp
call fcn.1801e62c0
add rsp, 0x1e60
pop rbx
ret
Function at 0x1800bcd20
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x1e58
call fcn.1801eeca0
sub rsp, rax
mov rax, qword [0x1802943b0]
xor rax, rsp
mov qword [rsp + 0x1e40], rax
call fcn.1800bcf50
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_time_l1_1_0.dll__localtime64_s
mov eax, dword [rsp + 0x40]
lea rdx, str.__02d:_02d:_02d__FATAL:___s_n
mov r9d, dword [rsp + 0x44]
lea rcx, [rsp + 0x68]
mov r8d, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
call fcn.1800bce30
mov r8, qword [rsp + 0x1e60]
lea r9, [rsp + 0x1e68]
lea rcx, [rsp + 0x90]
call fcn.1800bce90
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xe40]
call fcn.180035900
lea r8, [0x180208be0]
lea rdx, [0x180334b90]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x1800bce07
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0xe40]
lea rdx, [0x18020df24]
call fcn.1800bcef0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r9d, 0x10
lea r8, str.FATAL_ERROR
lea rdx, [rsp + 0xe40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1800bd1d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1802943b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rcx
mov qword [rsp + 0x20], 0
movdqa xmm0, xmmword [0x180270880]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call fcn.18003be70
nop
movabs r9, 0xcbf29ce484222325
lea rax, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rax, qword [rsp + 0x20]
lea rdx, [rsp + 0x20]
cmovae rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
add r8, rdx
cmp rax, r8
je 0x1800bd263
movabs rdx, 0x100000001b3
nop
imul r9, rdx
movsx rcx, byte [rax]
xor r9, rcx
inc rax
cmp rax, r8
jne 0x1800bd250
mov qword [rsi + 0x40], r9
mov byte [rsi + 0x68], 0
lea r8, [rsi + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.1800bcf60
mov rax, qword [rsi + 0x30]
mov qword [rsi + 0x48], rax
mov rbx, qword [0x18033b848]
lea r8, [rbx + 8]
mov rax, qword [r8]
mov rdi, rbx
cmp byte [rax + 0x19], 0
jne 0x1800bd2c8
mov rdx, qword [rsi + 0x40]
nop
mov rcx, qword [rax + 0x20]
cmp rcx, rdx
jae 0x1800bd2af
mov rax, qword [rax + 0x10]
jmp 0x1800bd2c2
cmp byte [rdi + 0x19], 0
je 0x1800bd2bc
cmp rdx, rcx
cmovb rdi, rax
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1800bd2a0
cmp byte [rdi + 0x19], 0
cmove r8, rdi
mov rax, qword [r8]
cmp byte [rax + 0x19], 0
jne 0x1800bd2f8
mov rcx, qword [rsi + 0x40]
nop dword [rax]
cmp rcx, qword [rax + 0x20]
jae 0x1800bd2ee
mov rdi, rax
mov rax, qword [rax]
jmp 0x1800bd2f2
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
je 0x1800bd2e0
cmp rbx, rdi
je 0x1800bd379
nop dword [rax]
mov rdx, qword [rbx + 0x28]
mov rcx, rsi
call fcn.1800bd550
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x1800bd338
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1800bd333
cmp rbx, qword [rax + 0x10]
jne 0x1800bd333
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1800bd320
mov rbx, rax
jmp 0x1800bd35f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x1800bd35f
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x1800bd350
cmp rbx, rdi
jne 0x1800bd300
mov rax, qword [rsi + 0x58]
sub rax, qword [rsi + 0x50]
sar rax, 3
test rax, rax
je 0x1800bd379
mov byte [rsi + 0x68], 1
lea rcx, [rsp + 0x20]
call fcn.18003bcb0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e62c0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800be180
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x1802943b0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor edi, edi
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], 0xf
mov byte [rbp - 0x41], dil
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x1800be1d0
mov rdx, rax
lea rcx, [rbp - 0x41]
call fcn.18003be70
nop
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rbp - 0x31]
sub rax, rcx
cmp rax, 0xd
jb 0x1800be342
lea r9, [rbp - 0x41]
cmp qword [rbp - 0x29], 0x10
cmovae r9, qword [rbp - 0x41]
mov qword [rsp + 0x30], 0xd
lea rax, str..exFilLocat_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 1]
call fcn.180035b60
nop
mov qword [rbp - 0x61], rdi
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], 0xf
mov byte [rbp - 0x61], 0
mov r8d, 0xb
lea rdx, str.headerr.ytd
lea rcx, [rbp - 0x61]
call fcn.18003be70
nop
mov rcx, qword [rbp + 0xf]
sub rbx, rcx
mov rdx, qword [rbp - 0x51]
cmp rbx, rdx
jb 0x1800be33c
lea r9, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae r9, qword [rbp - 1]
lea rax, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae rax, qword [rbp - 0x61]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x21]
call fcn.180035b60
nop
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rcx, qword [rbp - 0x21]
lea rdx, [rbp + 0x1f]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x1800be2f4
lea r9, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae r9, qword [rbp - 0x61]
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rdx, qword [rbp - 0x21]
mov byte [rsp + 0x20], al
mov r8b, 1
lea rcx, [rbp - 0x69]
call qword [0x18033b860]
nop
lea rcx, [rbp - 0x21]
call fcn.18003bcb0
nop
lea rcx, [rbp - 0x61]
call fcn.18003bcb0
nop
lea rcx, [rbp - 1]
call fcn.18003bcb0
nop
lea rcx, [rbp - 0x41]
call fcn.18003bcb0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1801e62c0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.18003bd20
nop
call fcn.18003bd20
int3
Function at 0x1800be4a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x1802943b0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor edi, edi
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], 0xf
mov byte [rbp - 0x41], dil
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x1800be4f0
mov rdx, rax
lea rcx, [rbp - 0x41]
call fcn.18003be70
nop
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rbp - 0x31]
sub rax, rcx
cmp rax, 0xd
jb 0x1800be662
lea r9, [rbp - 0x41]
cmp qword [rbp - 0x29], 0x10
cmovae r9, qword [rbp - 0x41]
mov qword [rsp + 0x30], 0xd
lea rax, str..exFilLocat_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 1]
call fcn.180035b60
nop
mov qword [rbp - 0x61], rdi
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], 0xf
mov byte [rbp - 0x61], 0
mov r8d, 0xe
lea rdx, str.exFilLocat.ytd
lea rcx, [rbp - 0x61]
call fcn.18003be70
nop
mov rcx, qword [rbp + 0xf]
sub rbx, rcx
mov rdx, qword [rbp - 0x51]
cmp rbx, rdx
jb 0x1800be65c
lea r9, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae r9, qword [rbp - 1]
lea rax, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae rax, qword [rbp - 0x61]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x21]
call fcn.180035b60
nop
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rcx, qword [rbp - 0x21]
lea rdx, [rbp + 0x1f]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x1800be614
lea r9, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae r9, qword [rbp - 0x61]
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rdx, qword [rbp - 0x21]
mov byte [rsp + 0x20], al
mov r8b, 1
lea rcx, [rbp - 0x69]
call qword [0x18033b860]
nop
lea rcx, [rbp - 0x21]
call fcn.18003bcb0
nop
lea rcx, [rbp - 0x61]
call fcn.18003bcb0
nop
lea rcx, [rbp - 1]
call fcn.18003bcb0
nop
lea rcx, [rbp - 0x41]
call fcn.18003bcb0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1801e62c0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.18003bd20
nop
call fcn.18003bd20
int3
Function at 0x1800be670
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x1802943b0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor edi, edi
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], 0xf
mov byte [rbp - 0x41], dil
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x1800be6c0
mov rdx, rax
lea rcx, [rbp - 0x41]
call fcn.18003be70
nop
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rbp - 0x31]
sub rax, rcx
cmp rax, 0xd
jb 0x1800be832
lea r9, [rbp - 0x41]
cmp qword [rbp - 0x29], 0x10
cmovae r9, qword [rbp - 0x41]
mov qword [rsp + 0x30], 0xd
lea rax, str..exFilLocat_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 1]
call fcn.180035b60
nop
mov qword [rbp - 0x61], rdi
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], 0xf
mov byte [rbp - 0x61], 0
mov r8d, 0xe
lea rdx, str.Explos1ve1.ytd
lea rcx, [rbp - 0x61]
call fcn.18003be70
nop
mov rcx, qword [rbp + 0xf]
sub rbx, rcx
mov rdx, qword [rbp - 0x51]
cmp rbx, rdx
jb 0x1800be82c
lea r9, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae r9, qword [rbp - 1]
lea rax, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae rax, qword [rbp - 0x61]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x21]
call fcn.180035b60
nop
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rcx, qword [rbp - 0x21]
lea rdx, [rbp + 0x1f]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x1800be7e4
lea r9, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae r9, qword [rbp - 0x61]
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rdx, qword [rbp - 0x21]
mov byte [rsp + 0x20], al
mov r8b, 1
lea rcx, [rbp - 0x69]
call qword [0x18033b860]
nop
lea rcx, [rbp - 0x21]
call fcn.18003bcb0
nop
lea rcx, [rbp - 0x61]
call fcn.18003bcb0
nop
lea rcx, [rbp - 1]
call fcn.18003bcb0
nop
lea rcx, [rbp - 0x41]
call fcn.18003bcb0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1801e62c0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.18003bd20
nop
call fcn.18003bd20
int3
Function at 0x1800be840
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x1802943b0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor edi, edi
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], 0xf
mov byte [rbp - 0x41], dil
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x1800be890
mov rdx, rax
lea rcx, [rbp - 0x41]
call fcn.18003be70
nop
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rbp - 0x31]
sub rax, rcx
cmp rax, 0xd
jb 0x1800bea02
lea r9, [rbp - 0x41]
cmp qword [rbp - 0x29], 0x10
cmovae r9, qword [rbp - 0x41]
mov qword [rsp + 0x30], 0xd
lea rax, str..exFilLocat_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 1]
call fcn.180035b60
nop
mov qword [rbp - 0x61], rdi
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], 0xf
mov byte [rbp - 0x61], 0
mov r8d, 0xa
lea rdx, str.maping.ytd
lea rcx, [rbp - 0x61]
call fcn.18003be70
nop
mov rcx, qword [rbp + 0xf]
sub rbx, rcx
mov rdx, qword [rbp - 0x51]
cmp rbx, rdx
jb 0x1800be9fc
lea r9, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae r9, qword [rbp - 1]
lea rax, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae rax, qword [rbp - 0x61]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x21]
call fcn.180035b60
nop
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rcx, qword [rbp - 0x21]
lea rdx, [rbp + 0x1f]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x1800be9b4
lea r9, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae r9, qword [rbp - 0x61]
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rdx, qword [rbp - 0x21]
mov byte [rsp + 0x20], al
mov r8b, 1
lea rcx, [rbp - 0x69]
call qword [0x18033b860]
nop
lea rcx, [rbp - 0x21]
call fcn.18003bcb0
nop
lea rcx, [rbp - 0x61]
call fcn.18003bcb0
nop
lea rcx, [rbp - 1]
call fcn.18003bcb0
nop
lea rcx, [rbp - 0x41]
call fcn.18003bcb0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1801e62c0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.18003bd20
nop
call fcn.18003bd20
int3