joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003abf0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], r8
mov rcx, qword [0x14123bbd0]
test rcx, rcx
jne 0x14003ac3d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x14003acfc
mov rcx, rax
mov qword [0x14123bbd0], rax
mov r8d, 0x10
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x14003acfc
mov rsi, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14003b120]
xor edi, edi
xor ecx, ecx
mov rdx, r14
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14003acee
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov qword [rbp - 0x10], rsi
call qword [rax]
mov rsi, qword [rbp - 0x10]
mov rax, qword [rsi + 8]
cmp qword [rax + 8], 0
je 0x14003acc7
mov r8, qword [rsi]
cmp qword [rax + 0x10], 0x11
jb 0x14003acb8
mov r8, qword [r8 - 8]
mov rcx, qword [0x14123bbd0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x14123bbd0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov ecx, 0x10
mov edx, 8
call fcn.140051930
ud2
Function at 0x14003b600
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1098
call fcn.140043480
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1000], xmm6
mov qword [rbp + 0xff8], 0xfffffffffffffffe
mov rsi, rdx
mov rbx, rcx
mov qword [rbp + 0xfb0], rcx
mov qword [rbp + 0xfb8], rdx
lea rdi, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rdi
xor edx, edx
call fcn.140043d00
mov dword [rbp + 0xfe8], 0
xorps xmm6, xmm6
movaps xmmword [rbp + 0xfc0], xmm6
mov qword [rbp + 0xfd0], 0
lea rax, [rbp + 0xfe8]
mov qword [rbp + 0xfd8], rax
lea r13, [0x140030f80]
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0xfc0]
mov qword [rbp + 0xfe0], rbx
mov rcx, rbx
mov rdx, rdi
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x14003b805
mov r14, qword [sym.imp.KERNEL32.dll_SleepEx]
mov r15d, 0xffffffff
lea rbx, [rbp + 0xfc0]
mov ecx, 0xffffffff
mov edx, 1
call r14
cmp dword [rbp + 0xfe8], 1
jne 0x14003b6d0
cmp dword [rbp + 0xfec], 0
jne 0x14003b80b
mov eax, dword [rbp + 0xff0]
test rax, rax
je 0x14003b80b
cmp eax, 0x1000
ja 0x14003b856
xor edi, edi
nop
cmp rdi, rax
ja 0x14003b83b
lea rdx, [rdi + rbp]
add rdx, 0xffffffffffffffb0
mov r12, rax
mov r8, rax
sub r8, rdi
cmp r8, r15
cmovae r8, r15
mov dword [rbp + 0xfe8], 0
movaps xmmword [rbp + 0xfc0], xmm6
mov qword [rbp + 0xfd0], 0
lea rax, [rbp + 0xfe8]
mov qword [rbp + 0xfd8], rax
mov qword [rsp + 0x20], r13
mov rcx, rsi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
je 0x14003b805
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call r14
cmp dword [rbp + 0xfe8], 1
jne 0x14003b780
cmp dword [rbp + 0xfec], 0
jne 0x14003b80b
mov eax, dword [rbp + 0xff0]
add rdi, rax
mov rax, r12
cmp rdi, r12
jne 0x14003b710
mov dword [rbp + 0xfe8], 0
movaps xmmword [rbp + 0xfc0], xmm6
mov qword [rbp + 0xfd0], 0
lea rax, [rbp + 0xfe8]
mov qword [rbp + 0xfd8], rax
mov qword [rsp + 0x20], r13
mov rcx, qword [rbp + 0xfe0]
lea rdx, [rbp - 0x50]
mov r8d, 0x1000
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x14003b6d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xfe0]
call rdi
mov rcx, rsi
call rdi
movaps xmm6, xmmword [rbp + 0x1000]
add rsp, 0x1098
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, [0x14122ad48]
mov rcx, rdi
mov qword [rbp + 0xfe0], rax
mov rdx, rax
call fcn.140051ce0
jmp 0x14003b871
lea r8, [0x14122ad48]
mov edx, 0x1000
mov qword [rbp + 0xfe0], rax
mov rcx, rax
call fcn.140051ad0
ud2
Function at 0x14003b910
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x14003b94f
mov rax, qword [rbp - 0x20]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x140029570]
mov qword [rbp - 0x28], rax
lea rax, [0x14122aec0]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
mov qword [rbp - 0x60], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rdx, [0x14122aef8]
lea rcx, [rbp - 0x60]
call fcn.140051a00
ud2

Function at 0x14003df70
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
cmp qword [rdx], 0
jne 0x14003e07d
mov rsi, rcx
mov rbx, qword [rdi + 0x28]
mov rax, qword [rbx]
test rax, rax
jne 0x14003dfa7
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x14003e042
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x14003e060
sub rax, rdx
add rdx, qword [rbx + 8]
mov rbx, qword [rdi + 0x20]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x30], 0
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003dffe
mov eax, dword [rsp + 0x30]
mov ecx, 2
test rax, rax
jne 0x14003e01b
jmp 0x14003e010
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x14003e016
cmp eax, 0x6d
jne 0x14003e032
mov byte [rsi + 1], 0
jmp 0x14003e026
mov ecx, 1
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
xor eax, eax
mov byte [rsi], al
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x14003e028
mov r8d, 0x10
mov rcx, rbx
call fcn.140051870
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x14003dfb4
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.140051870
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
jmp 0x14003dfb4
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140052b80
ud2

Function at 0x1400439c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140043a0e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140043a0e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140043a0e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140043a0e
cmp dword [rcx + 0x84], 0xe
jbe 0x140043a0e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140043a10
xor al, al
add rsp, 0x28
ret

Function at 0x140047cac
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140047a9c
Function at 0x14004ad10
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14004ad40
xor eax, eax
jmp 0x14004ae03
mov rbp, rbx
cmp word [rax], si
je 0x14004ad65
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14004ad4c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14004ad48
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14004ac60
movsxd r14, eax
test eax, eax
jne 0x14004ada3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14004ad39
mov rcx, r14
call fcn.14004bbc4
mov rdi, rax
test rax, rax
jne 0x14004adbc
xor ecx, ecx
call fcn.1400492f0
jmp 0x14004ad98
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14004ac60
test eax, eax
jne 0x14004aded
mov rcx, rdi
call fcn.1400492f0
jmp 0x14004adf7
xor ecx, ecx
call fcn.1400492f0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14004e2cc
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140049d64
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14004e356
cmp byte [rbp - 0x21], r15b
je 0x14004e351
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14004e38c
call fcn.14004c3e4
test eax, eax
jne 0x14004e378
cmp byte [rbp - 0x21], r15b
je 0x14004e370
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14004e38c
cmp byte [rbp - 0x21], r15b
je 0x14004e389
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140049340
test eax, eax
jne 0x14004e42c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140049d64
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14004e3cb
cmp byte [rbp - 0x21], r15b
je 0x14004e400
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14004e400
call fcn.14004c3e4
test eax, eax
jne 0x14004e3ec
cmp byte [rbp - 0x21], r15b
je 0x14004e3e5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14004e400
cmp byte [rbp - 0x21], r15b
je 0x14004e3fd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140049340
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14004e42c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14004e42f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14004e43d
mov rcx, rdi
call fcn.1400492f0
cmp byte [rbp + 0x3f], r15b
je 0x14004e44c
mov rcx, qword [rbp + 0x27]
call fcn.1400492f0
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140001560
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1400015c1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140001580
mov ecx, dword [r9]
jmp 0x1400016ab
cmp ecx, 0x4e0
jb 0x1400016ab
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1400015e0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140001630
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140001fc8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002012
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002012
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002012
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002012
cmp dword [rcx + 0x84], 0xe
jbe 0x140002012
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002014
xor al, al
add rsp, 0x28
ret
Function at 0x180010de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov ebx, edx
mov rsi, rcx
test dl, dl
je 0x180010e15
movzx eax, bl
lea ecx, [rax + 0x2f6]
add eax, 0x19c
and eax, ecx
shr eax, 8
inc al
cmp al, 1
jbe 0x180010e0d
xor edi, edi
jmp 0x180010e38
test al, al
je 0x180010ec3
lea rdx, str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember
mov edi, 1
mov r8d, 1
mov rcx, rsi
call fcn.180022d10
test rax, rax
jne 0x180010ee6
cmp bl, 0x64
jb 0x180010e68
movzx eax, bl
lea ecx, [rax + rax*4]
lea eax, [rax + rcx*8]
shr eax, 0xc
imul ecx, eax, 0x64
sub bl, cl
movzx ecx, bl
lea rdx, [0x1800441f2]
movzx ecx, word [rdx + rcx*2]
mov word [rsp + 0x29], cx
xor r8d, r8d
mov ebx, eax
jmp 0x180010e73
mov r8d, 2
cmp bl, 0xa
jae 0x180010e7d
or bl, 0x30
mov byte [rsp + r8 + 0x28], bl
jmp 0x180010e96
movzx eax, bl
lea rcx, [0x1800441f2]
movzx eax, word [rcx + rax*2]
mov word [rsp + 0x29], ax
mov r8d, 1
lea rdx, [rsp + r8]
add rdx, 0x28
xor r8, 3
mov rcx, rsi
mov rsi, r8
call fcn.180022d10
test rax, rax
je 0x180010eb9
mov edi, 1
jmp 0x180010ee6
mov rax, rsi
add rax, rdi
xor edi, edi
jmp 0x180010ee6
lea rbx, str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember
mov edi, 1
nop
mov r8d, 1
mov rcx, rsi
mov rdx, rbx
call fcn.180022d10
test rax, rax
je 0x180010ed0
mov rdx, rax
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x180011540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov ebx, edx
mov rsi, rcx
test dl, dl
je 0x180011575
movzx eax, bl
lea ecx, [rax + 0x2f6]
add eax, 0x19c
and eax, ecx
shr eax, 8
inc al
cmp al, 1
jbe 0x18001156d
xor edi, edi
jmp 0x180011598
test al, al
je 0x180011623
lea rdx, str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember
mov edi, 1
mov r8d, 1
mov rcx, rsi
call fcn.1800231c0
test rax, rax
jne 0x180011646
cmp bl, 0x64
jb 0x1800115c8
movzx eax, bl
lea ecx, [rax + rax*4]
lea eax, [rax + rcx*8]
shr eax, 0xc
imul ecx, eax, 0x64
sub bl, cl
movzx ecx, bl
lea rdx, [0x1800441f2]
movzx ecx, word [rdx + rcx*2]
mov word [rsp + 0x29], cx
xor r8d, r8d
mov ebx, eax
jmp 0x1800115d3
mov r8d, 2
cmp bl, 0xa
jae 0x1800115dd
or bl, 0x30
mov byte [rsp + r8 + 0x28], bl
jmp 0x1800115f6
movzx eax, bl
lea rcx, [0x1800441f2]
movzx eax, word [rcx + rax*2]
mov word [rsp + 0x29], ax
mov r8d, 1
lea rdx, [rsp + r8]
add rdx, 0x28
xor r8, 3
mov rcx, rsi
mov rsi, r8
call fcn.1800231c0
test rax, rax
je 0x180011619
mov edi, 1
jmp 0x180011646
mov rax, rsi
add rax, rdi
xor edi, edi
jmp 0x180011646
lea rbx, str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember
mov edi, 1
nop
mov r8d, 1
mov rcx, rsi
mov rdx, rbx
call fcn.1800231c0
test rax, rax
je 0x180011630
mov rdx, rax
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x180013b20
Capabilities:
Enumerate gui resources

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
call fcn.1800258f0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], edx
cmp esi, 0x3b9aca00
mov r13, 0xffffffffffffffff
cmovne r13, rdi
mov ebp, 0x3b9ac9ff
cmovne ebp, esi
mov esi, dword [rbx + 8]
lea r14, [rsp + 0x38]
mov rdi, qword [sym.imp.user32.dll_EnumWindows]
xor eax, eax
mov qword [rsp + 0x20], rax
lea r15, [rsp + 0x28]
mov ebx, 0xff
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
test rax, rax
setne cl
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
lea rcx, [0x180013c50]
mov rdx, r14
call rdi
test eax, eax
jne 0x180013bdb
call fcn.180015f40
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], edx
mov qword [rsp + 0x60], 1
test rax, rax
je 0x180013bdb
lea rcx, [rsp + 0x68]
call fcn.1800168b0
mov r12, qword [rsp + 0x50]
cmp qword [rsp + 0x48], 0
jne 0x180013c20
xor ecx, ecx
mov edx, 0x5f5e100
call fcn.180020810
mov rcx, r15
call fcn.180025c10
xor ecx, ecx
cmp rax, r13
setne cl
cmovb ecx, ebx
xor eax, eax
cmp edx, ebp
setne al
cmovb eax, ebx
test cl, cl
cmovne eax, ecx
cmp al, 1
jne 0x180013b80
jmp 0x180013c2a
mov eax, 1
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rdx, r12
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180013cd0
Capabilities:
Get graphical window text

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1c0], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
lea rbx, [rbp - 0x60]
mov r8d, 0x200
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rdi]
mov rdx, rbx
mov r8d, pe_nt_image_headers64
call qword [sym.imp.user32.dll_GetWindowTextW]
movsxd r8, eax
cmp r8d, 0x101
jae 0x180013e10
lea rdi, [rbp + 0x1a0]
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.180024390
mov rcx, rdi
call fcn.18002a170
mov r8, rdx
lea rcx, [rbp - 0x60]
mov rdx, rax
call fcn.18002a180
movabs rax, 0x8000000000000000
cmp qword [rbp - 0x60], rax
jne 0x180013da3
mov rbx, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x50]
test rdi, rdi
je 0x180013de3
js 0x180013e27
movzx eax, byte [0x180071be1]
mov r15d, 1
mov edx, 1
mov rcx, rdi
call fcn.180002f30
test rax, rax
je 0x180013e2a
mov r14, rax
jmp 0x180013de9
mov rax, qword [rbp - 0x50]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x1a0]
test rdx, rdx
je 0x180013dd0
mov rcx, qword [rbp + 0x1a8]
mov r8d, 1
call fcn.180002f40
mov rax, rsi
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov r14d, 1
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi], rdi
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
mov rdx, qword [rbp + 0x1a0]
test rdx, rdx
jne 0x180013dbe
jmp 0x180013dd0
lea rax, str.C:UsersKerroX.cargogitcheckouts_rust_hooking_utils_f7ee34eac6a81147_a36a365_srcpatchingprocess.rs_O
mov edx, pe_nt_image_headers64
mov rcx, r8
mov r8, rax
call fcn.180041000
xor r15d, r15d
mov rcx, r15
mov rdx, rdi
call fcn.180040a20
ud2

Function at 0x180013ed0
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
sub rsp, 0x58
movzx edi, dx
cmp edi, 0x100
ja 0x180013f1a
mov rsi, rcx
mov ecx, edi
call qword [sym.imp.user32.dll_GetAsyncKeyState]
xor ecx, ecx
test ax, ax
setns dl
cmp edi, 0x100
je 0x180013f51
mov cl, dl
lea ecx, [rcx + rcx*2]
cmp byte [rsi + rdi], cl
je 0x180013f0d
mov byte [rsi + rdi + 0x100], cl
movzx eax, ax
shr eax, 0xf
add rsp, 0x58
pop rdi
pop rsi
ret
lea rax, str.Virtual_keys_cant_have_an_index_of_more_than_256_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str.C:UsersKerroX.cargogitcheckouts_rust_hooking_utils_f7ee34eac6a81147_a36a365_src_raw_inputkey_manager.rs
lea rcx, [rsp + 0x28]
call fcn.180040b50
lea r8, str.C:UsersKerroX.cargogitcheckouts_rust_hooking_utils_f7ee34eac6a81147_a36a365_src_raw_inputkey_manager.rs
mov ecx, pe_nt_image_headers64
mov edx, pe_nt_image_headers64
call fcn.180040ca0
int3
Function at 0x180021a80
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x180021b20
jmp 0x180021b0f
jae 0x180021bdf
cmp r8, 0x201
jae 0x180021b20
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x180021b77
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x180021b4f
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.18003fd10
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x180021ba0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x180021c4b
mov r8d, r13d
cmp r12, r8
jne 0x180021b00
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x180021c7f
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x180021b0f
jmp 0x180021b20
cmp r14, r8
jb 0x180021c99
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.180024390
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x180021c34
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.180002f40
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x180021c1f
jmp 0x180021c34
lea rcx, str.internal_error:_entered_unreachable_code_rustc_debd22da66cfa97c74040ebf68e420672ac8560elibrary_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.180040c10
jmp 0x180021cae
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.180041000
ud2