joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5144b0
Capabilities:
Set file attributes

Disassembly:
push rbp
push rbx
sub rsp, 0x88
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov word [rbp + 0x50], dx
mov word [rbp + 0x52], r8w
mov word [rbp + 0x4e], r9w
mov qword [rbp + 0x58], 0
nop
call fcn.00517d40
mov rbx, rax
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x40]
call fcn.0040c200
mov rcx, rbx
mov rdx, qword [rbp + 0x58]
call fcn.00513330
test al, al
je 0x51450a
mov eax, 1
mov dword [rbp + 0x54], eax
jmp 0x5145c5
mov rcx, qword [rbp + 0x40]
mov edx, 0xc0000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x8000080
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileA
mov rbx, rax
cmp rbx, 0xffffffffffffffff
jne 0x51455b
call sub.kernel32.dll_GetLastError_2
mov rcx, qword [rbp + 0xc0]
mov dword [rcx], eax
xor rax, rax
mov dword [rbp + 0x54], eax
jmp 0x5145c4
movzx rcx, word [rbp + 0x50]
movzx rdx, word [rbp + 0x52]
lea r8, [rbp + 0x78]
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x51459e
mov rax, qword [rbp + 0x78]
mov qword [rbp + 0x68], rax
lea rcx, [rbp + 0x68]
lea rdx, [rbp + 0x70]
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x51459e
mov rcx, rbx
lea rdx, [rbp + 0x70]
xor r8, r8
lea r9, [rbp + 0x70]
call sub.kernel32.dll_SetFileTime
mov rcx, rbx
call sub.kernel32.dll_CloseHandle_1
mov rcx, qword [rbp + 0x40]
movzx rdx, word [rbp + 0x4e]
and dx, 0x27
movzx edx, dx
call sub.kernel32.dll_SetFileAttributesA
mov eax, 1
mov dword [rbp + 0x54], eax
nop
lea rcx, [rbp + 0x58]
call fcn.0040ab70
mov eax, dword [rbp + 0x54]
lea rsp, [rbp + 0x88]
pop rbx
pop rbp
ret
Function at 0x515610
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
sub rsp, 0xa8
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rdx
mov dword [rbp + 0x40], r8d
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
nop
mov byte [rbp + 0x9f], 0
mov rax, qword [rbp + 0x38]
lea rax, [rax + 0x18]
add dword [rax], 1
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x78]
mov rax, qword [rbp + 0x38]
mov r8d, dword [rax + 0x18]
call fcn.005153d0
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x78]
xor r8, r8
call fcn.0040bcc0
mov rax, qword [rbp + 0x38]
lea rcx, [rax + 0x22]
mov rdx, qword [rbp + 0x90]
call fcn.00428460
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x70]
mov rax, qword [rbp + 0x38]
mov r8d, dword [rax + 0x14]
call fcn.00515180
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x70]
xor r8, r8
call fcn.0040bcc0
mov rax, qword [rbp + 0x38]
lea rcx, [rax + 0x122]
mov rdx, qword [rbp + 0x90]
call fcn.00428460
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x68]
mov rax, qword [rbp + 0x38]
mov r8d, dword [rax + 0x18]
call fcn.005152c0
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x68]
xor r8, r8
call fcn.0040bcc0
mov rax, qword [rbp + 0x38]
lea rcx, [rax + 0x222]
mov rdx, qword [rbp + 0x90]
call fcn.00428460
mov rax, qword [rbp + 0x30]
cmp qword [rax + 0x68], 0
je 0x515764
mov rax, qword [rbp + 0x30]
lea rbx, [rax + 0x68]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x38]
mov r9d, dword [rbp + 0x40]
lea rax, [rbp + 0x9f]
mov qword [rsp + 0x20], rax
call qword [rbx]
cmp byte [rbp + 0x9f], 0
jne 0x51580c
lea rcx, [rbp + 0x88]
mov rax, qword [rbp + 0x38]
lea rdx, [rax + 0x222]
mov r8d, pe_nt_image_headers64
call fcn.0040c260
mov rcx, qword [rbp + 0x88]
call fcn.00427610
lea rcx, [rbp + 0x50]
mov rax, qword [rbp + 0x38]
lea rdx, [rax + 0x222]
mov r8d, pe_nt_image_headers64
call fcn.0040c260
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x58], rax
lea rcx, [rbp + 0x48]
mov rax, qword [rbp + 0x38]
lea rdx, [rax + 0x122]
mov r8d, pe_nt_image_headers64
call fcn.0040c260
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x60], rax
lea rcx, [rbp + 0x88]
lea rdx, [rbp + 0x58]
mov r8d, 1
call fcn.00513b50
mov rcx, qword [rbp + 0x88]
call fcn.0040c190
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
mov rax, qword [rbp + 0x30]
mov dword [rax + 0x3fc], 0
mov dword [rax + 0x400], 0
cmp byte [rbp + 0x9f], 0
sete al
mov byte [rbp + 0x47], al
nop
lea rcx, [rbp + 0x48]
mov edx, 2
call fcn.0040ac50
lea rcx, [rbp + 0x68]
mov edx, 3
call fcn.0040ac50
lea rcx, [rbp + 0x88]
call fcn.0040ab70
lea rcx, [rbp + 0x90]
call fcn.0040abc0
movzx rax, byte [rbp + 0x47]
lea rsp, [rbp + 0xa8]
pop rbx
pop rbp
ret
Function at 0x51ab10
Capabilities:
Get geographical location

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x58], 0
nop
lea rcx, [rbp + 0x58]
lea rdx, [0x0051aca0]
call fcn.0040b220
mov ecx, 0x400
mov edx, 0x59
lea r8, [rbp + 0x44]
mov r9d, 0xa
call sub.kernel32.dll_GetLocaleInfoW_1
cmp eax, 3
sete al
test al, al
je 0x51ab90
mov ecx, 0x400
mov edx, 0x5a
lea r8, [rbp + 0x4e]
mov r9d, 0xa
call sub.kernel32.dll_GetLocaleInfoW_1
cmp eax, 3
je 0x51ab95
xor rax, rax
jmp 0x51ab97
mov al, 1
test al, al
je 0x51abb5
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x44]
call fcn.0040c230
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x4e]
call fcn.0040c230
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x58]
call fcn.004257c0
mov rcx, qword [rbp + 0x38]
lea rdx, [0x0051acb4]
call fcn.0040c7f0
test eax, eax
jne 0x51ac0f
lea rcx, [rbp + 0x30]
mov rax, qword [rbp + 0x28]
mov rdx, qword [rax]
call fcn.004257c0
mov rcx, qword [rbp + 0x30]
lea rdx, [0x0051acc8]
call fcn.0040c7f0
test eax, eax
jne 0x51ac0f
mov rcx, qword [rbp + 0x20]
mov rdx, qword [0x0055dc48]
xor r8, r8
call fcn.0040bcc0
jmp 0x51ac1f
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x58]
xor r8, r8
call fcn.0040bcc0
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040ac50
lea rcx, [rbp + 0x58]
call fcn.0040ab70
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x60]
pop rbp
ret
Function at 0x529b60
Capabilities:
Get token privileges

Disassembly:
push rbp
push rbx
sub rsp, 0xa8
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xc0], rcx
nop
mov rax, qword [rbp + 0xc0]
mov rax, qword [rax + 0x20]
mov rcx, rax
mov rbx, qword [rax]
call qword [rbx + 0x10]
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 8
lea r8, [rbp + 0x88]
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x529dca
nop
mov rcx, qword [rbp + 0x88]
mov edx, 1
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x7c]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_GetTokenInformation
mov ecx, dword [rbp + 0x7c]
call fcn.00405fc0
mov rcx, qword [rbp + 0xc0]
mov qword [rcx + 0x18], rax
mov rcx, qword [rbp + 0x88]
mov edx, 1
mov rax, qword [rbp + 0xc0]
mov r8, qword [rax + 0x18]
mov r9d, dword [rbp + 0x7c]
lea rax, [rbp + 0x7c]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x529c3c
nop
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax + 0x18]
call fcn.00406020
nop
mov rax, qword [rbp + 0xc0]
mov qword [rax + 0x18], 0
jmp 0x529c48
mov rcx, qword [rbp + 0xc0]
call fcn.00529a80
mov rcx, qword [rbp + 0x88]
mov edx, 3
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x7c]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_GetTokenInformation
mov ecx, dword [rbp + 0x7c]
call fcn.00405fc0
mov qword [rbp + 0x90], rax
nop
mov rcx, qword [rbp + 0x88]
mov edx, 3
mov r8, qword [rbp + 0x90]
mov r9d, dword [rbp + 0x7c]
lea rax, [rbp + 0x7c]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x529db0
mov rax, qword [rbp + 0x90]
cmp dword [rax], 0
jbe 0x529db0
xor rax, rax
mov rcx, qword [rbp + 0x90]
mov ecx, dword [rcx]
sub ecx, 1
mov dword [rbp + 0x3c], ecx
mov dword [rbp + 0x78], eax
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x78], eax
ja 0x529daf
mov eax, dword [rbp + 0x3c]
add eax, 1
mov dword [rbp + 0x3c], eax
Function at 0x52dfc0
Capabilities:
Create process on windows

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0xd0
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
xor r13, r13
lea rcx, [rbp + 0x68]
mov edx, 0x68
xor r8, r8
call fcn.004075b0
mov dword [rbp + 0x68], 0x68
lea rcx, [rbp + 0x50]
mov edx, 0x18
xor r8, r8
call fcn.004075b0
xor rcx, rcx
mov rdx, rbx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x220
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x52e0a1
test dil, dil
je 0x52e068
mov rcx, qword [rbp + 0x50]
mov edx, 0x2710
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
sete r13b
jmp 0x52e06b
mov r13b, 1
mov rcx, qword [rbp + 0xb8]
call sub.kernel32.dll_CloseHandle_1
mov rcx, qword [rbp + 0xc0]
call sub.kernel32.dll_CloseHandle_1
mov rcx, qword [rbp + 0xc8]
call sub.kernel32.dll_CloseHandle_1
mov rcx, qword [rbp + 0x58]
call sub.kernel32.dll_CloseHandle_1
mov rcx, qword [rbp + 0x50]
call sub.kernel32.dll_CloseHandle_1
mov eax, r13d
lea rsp, [rbp + 0xd0]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x1405bc0b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1405bc237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405bc0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405bc0c7
add dl, dl
jne 0x1405bc0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405bc14e
xor eax, eax
add dl, dl
jne 0x1405bc0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405bc205
add dl, dl
jne 0x1405bc10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405bc11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405bc128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405bc135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405bc142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405bc0d6
mov eax, 1
add dl, dl
jne 0x1405bc15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405bc16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405bc153
sub eax, ebx
mov ebx, 1
jne 0x1405bc1a4
mov ecx, 1
add dl, dl
jne 0x1405bc186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405bc193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405bc17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405bc0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405bc1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405bc1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405bc1b5
cmp eax, 0x7d00
jae 0x1405bc1f3
cmp eax, 0x500
jb 0x1405bc1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405bc0d6
cmp eax, 0x7f
ja 0x1405bc1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405bc0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405bc22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405bc0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140184339
Capabilities:
Set console window title

Disassembly:
jmp 0x1401a56d0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x148]
mov rax, qword [0x140599cc0]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x1405cc00c]
call fcn.14018cbbf
nop
mov rax, qword [rbp + 0x120]
mov rcx, rax
call fcn.14018923f
nop
call qword [sym.imp.KERNEL32.dll_AllocConsole]
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_AttachConsole]
nop
mov rcx, qword [rbp + 0x128]
call fcn.14018c4bc
movzx eax, al
test eax, eax
jne 0x1401a576e
mov rcx, qword [rbp + 0x128]
call fcn.14018a24d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
nop
xor ecx, ecx
call fcn.14018d6a0
mov r9, rax
lea r8, [0x1404b1054]
lea rdx, [0x1404b1058]
lea rcx, [rbp + 8]
call fcn.14018a0d6
nop
mov ecx, 1
call fcn.14018d6a0
mov r9, rax
lea r8, [0x1404b1060]
lea rdx, str.conout_
lea rcx, [rbp + 0x28]
call fcn.14018a0d6
nop
mov ecx, 2
call fcn.14018d6a0
mov r9, rax
lea r8, [0x1404b1060]
lea rdx, str.conout_
lea rcx, [rbp + 0x28]
call fcn.14018a0d6
nop
mov rax, qword [rbp + 0x120]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1404afcb0]
call fcn.14018b31e
mov rax, rdi
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.1401882d6
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1401857f2
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1402f51a0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1405cc5d6]
call fcn.14018cbbf
nop
mov qword [rbp + 8], 0
jmp 0x1402f51df
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x1402f5235
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x1402f51d4
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140185b71
Capabilities:
Get common file path

Disassembly:
jmp 0x1401c6180
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x3c8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x86
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x3e8]
mov rax, qword [0x140599cc0]
xor rax, rbp
mov qword [rbp + 0x380], rax
lea rcx, [0x1405cc04d]
call fcn.14018cbbf
nop
lea r9, [rbp + 8]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140528210]
call fcn.140187999
test eax, eax
jl 0x1401c621e
mov rax, qword [rbp + 0x3b0]
lea rdx, [rbp + 8]
mov rcx, rax
call fcn.14018c651
nop
mov rax, qword [rbp + 0x3b0]
mov rdx, qword [rbp + 0x3b8]
mov rcx, rax
call fcn.14018a5e0
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop
mov rax, qword [rbp + 0x3b0]
mov rcx, rax
call fcn.140184ad7
movzx eax, al
test eax, eax
je 0x1401c6365
lea rax, [rbp + 0x1a4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rbp + 0x1a4]
mov byte [rbp + 0x2c4], al
movzx eax, byte [rbp + 0x2c4]
mov byte [rbp + 0x304], al
movzx eax, byte [rbp + 0x304]
mov byte [rbp + 0x344], al
mov rax, qword [rbp + 0x3b0]
add rax, 0x28
mov rdx, rax
lea rcx, [rbp + 0x1c8]
call fcn.1401880fb
mov rax, qword [rax]
mov qword [rbp + 0x2a8], rax
mov rax, qword [rbp + 0x2a8]
mov qword [rbp + 0x2e8], rax
mov rax, qword [rbp + 0x2e8]
mov qword [rbp + 0x328], rax
lea rax, [rbp + 0x1e8]
mov qword [rbp + 0x218], rax
mov rdi, qword [rbp + 0x218]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, qword [rbp + 0x218]
call fcn.14018407d
mov qword [rbp + 0x358], rax
mov rax, qword [rbp + 0x358]
mov qword [rbp + 0x360], rax
mov rax, qword [rbp + 0x360]
mov qword [rbp + 0x368], rax
lea rax, [rbp + 0x238]
mov qword [rbp + 0x268], rax
mov rax, qword [rbp + 0x3b0]
mov rdx, rax
mov rcx, qword [rbp + 0x268]
call fcn.14018cb7e
mov qword [rbp + 0x370], rax
mov rax, qword [rbp + 0x370]
mov qword [rbp + 0x378], rax
movzx eax, byte [rbp + 0x344]
mov byte [rsp + 0x20], al
mov r9, qword [rbp + 0x328]
mov r8, qword [rbp + 0x368]
mov rdx, qword [rbp + 0x378]
lea rcx, [rbp + 0x288]
call fcn.1401b3a00
nop
mov rcx, qword [rbp + 0x3b8]
call fcn.14018599b
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x1404b2810]
call fcn.14018b31e
mov rcx, qword [rbp + 0x380]
xor rcx, rbp
call fcn.1401882d6
lea rsp, [rbp + 0x398]
pop rdi
pop rbp
ret
Function at 0x140185efa
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x1401aad80
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1405cc01c]
call fcn.14018cbbf
nop
mov rax, qword [rbp + 0x100]
cmp dword [rax + 8], 0
jne 0x1401aadbc
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax]
jmp 0x1401aaecb
mov rax, qword [rbp + 0x100]
mov eax, dword [rax + 4]
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 0
je 0x1401aadec
cmp dword [rbp + 0xd4], 1
je 0x1401aadfb
cmp dword [rbp + 0xd4], 2
je 0x1401aae3a
jmp 0x1401aaec1
mov rax, qword [rbp + 0x100]
mov byte [rax], 1
jmp 0x1401aaec1
mov rax, qword [rbp + 0x100]
mov ecx, dword [rax + 8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1401aae1e
mov byte [rbp + 0xd4], 1
jmp 0x1401aae25
mov byte [rbp + 0xd4], 0
mov rax, qword [rbp + 0x100]
movzx ecx, byte [rbp + 0xd4]
mov byte [rax], cl
jmp 0x1401aaec1
mov rax, qword [rbp + 0x100]
mov ecx, dword [rax + 8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov word [rbp + 4], ax
movsx eax, word [rbp + 4]
and eax, 0x8000
test eax, eax
je 0x1401aae66
mov rax, qword [rbp + 0x100]
mov byte [rax + 1], 1
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax + 1]
test eax, eax
je 0x1401aaec1
movsx eax, word [rbp + 4]
and eax, 0x8000
test eax, eax
jne 0x1401aaec1
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax]
test eax, eax
jne 0x1401aae9c
mov dword [rbp + 0xd4], 1
jmp 0x1401aaea6
mov dword [rbp + 0xd4], 0
mov rax, qword [rbp + 0x100]
movzx ecx, byte [rbp + 0xd4]
mov byte [rax], cl
mov rax, qword [rbp + 0x100]
mov byte [rax + 1], 0
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x1401862ba
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x1401a6f60
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1405cc017]
call fcn.14018cbbf
nop
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x138
jne 0x1401a6f9e
mov rcx, qword [rbp + 0x100]
call fcn.140185860
nop
jmp 0x1401a6fba
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x270
jb 0x1401a6fba
mov rcx, qword [rbp + 0x100]
call fcn.140188588
nop
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rcx + rax*8 + 8]
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x100]
mov dword [rcx], eax
mov rax, qword [rbp + 0xd8]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
shr rax, 0x1d
mov rcx, qword [rbp + 0x100]
and rax, qword [rcx + 0x1388]
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
shl rax, 0x11
movabs rcx, 0x71d67fffeda60000
and rax, rcx
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
shl rax, 0x25
movabs rcx, 0xfff7eee000000000
and rax, rcx
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
shr rax, 0x2b
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140187e5d
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1403f8ad0
mov rax, rcx
neg rcx
test rax, 7
je 0x1403f8aed
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1403f8b48
test al, 7
jne 0x1403f8ae0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1403f8b01
mov rdx, qword [rax - 8]
test dl, dl
je 0x1403f8b72
test dh, dh
je 0x1403f8b6c
shr rdx, 0x10
test dl, dl
je 0x1403f8b66
test dh, dh
je 0x1403f8b60
shr rdx, 0x10
test dl, dl
je 0x1403f8b5a
test dh, dh
je 0x1403f8b54
shr edx, 0x10
test dl, dl
je 0x1403f8b4e
test dh, dh
jne 0x1403f8b01
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x140187ebc
Capabilities:
Query environment variable

Disassembly:
jmp 0x140479630
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1404791b0
lea rcx, [rsp + 0x20]
call fcn.140479200
movzx eax, al
test eax, eax
jne 0x140479675
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1404791e0
mov rax, qword [rsp + 0x40]
jmp 0x14047976f
lea rcx, [rsp + 0x20]
call fcn.140479300
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1404792a0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.140188457
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1401873ae
lea rcx, [rsp + 0x28]
call fcn.140188cbd
movzx eax, al
test eax, eax
jne 0x14047970f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14018af5e
lea rcx, [rsp + 0x20]
call fcn.1404791e0
mov rax, qword [rsp + 0x50]
jmp 0x14047976f
lea rcx, [rsp + 0x20]
call fcn.140479300
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.14018ca39
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.14018831c
lea rcx, [rsp + 0x28]
call fcn.14018d9e8
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.14018af5e
lea rcx, [rsp + 0x20]
call fcn.1404791e0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x140188588
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x1401a8a00
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x1405cc017]
call fcn.14018cbbf
nop
mov qword [rbp + 8], 0x137
mov qword [rbp + 0x28], 0x9c
mov qword [rbp + 0x48], 0
jmp 0x1401a8a45
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0x9c
jae 0x1401a8aee
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x48]
mov rax, qword [rax + rcx*8 + 0x9c8]
and rax, 0xffffffff80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rcx + rdx*8 + 0x9d0]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
and rax, 1
test rax, rax
je 0x1401a8aad
movabs rax, 0xb5026f5aa96619e9
mov qword [rbp + 0x1b8], rax
jmp 0x1401a8ab8
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0x68]
shr rax, 1
xor rax, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
xor rax, qword [rcx + rdx*8 + 0xea8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1401a8a3a
mov qword [rbp + 0x88], 0x9c
jmp 0x1401a8b0c
mov rax, qword [rbp + 0x88]
inc rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0x137
jae 0x1401a8bcd
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x88]
mov rax, qword [rax + rcx*8 + 0x9c8]
and rax, 0xffffffff80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rcx + rdx*8 + 0x9d0]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
and rax, 1
test rax, rax
je 0x1401a8b83
movabs rax, 0xb5026f5aa96619e9
mov qword [rbp + 0x1b8], rax
jmp 0x1401a8b8e
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0xa8]
shr rax, 1
xor rax, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
xor rax, qword [rcx + rdx*8 - 0x4d8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1401a8afb
mov qword [rbp + 0xc8], 0x137
mov eax, 8
imul rax, rax, 0x26f
mov rcx, qword [rbp + 0x1e0]
mov rax, qword [rcx + rax + 8]
and rax, 0xffffffff80000000
mov ecx, 8
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x1e0]
mov rcx, qword [rdx + rcx + 8]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
and rax, 1
test rax, rax
je 0x1401a8c3f
movabs rax, 0xb5026f5aa96619e9
mov qword [rbp + 0x1b8], rax
jmp 0x1401a8c4a
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0xe8]
shr rax, 1
xor rax, qword [rbp + 0x1b8]
mov ecx, 8
imul rcx, rcx, 0x9b
mov rdx, qword [rbp + 0x1e0]
xor rax, qword [rdx + rcx + 8]
mov ecx, 8
imul rcx, rcx, 0x137
mov rdx, qword [rbp + 0x1e0]
mov qword [rdx + rcx + 8], rax
mov rax, qword [rbp + 0x1e0]
mov dword [rax], 0
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret