joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400035c4
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x380]
sub rsp, 0x480
or rbx, 0xffffffffffffffff
xor edi, edi
test rcx, rcx
je 0x140003735
cmp word [rcx], di
je 0x140003735
mov rdx, rcx
mov r8d, 0x104
lea rcx, [rsp + 0x20]
call fcn.14001d2ac
lea rcx, [rsp + 0x20]
mov word [rbp + 0x128], di
call fcn.14001ce58
mov rdx, rax
cdqe
lea rcx, [rsp + rax*2 + 0x1e]
lea eax, [rdx - 2]
cmp eax, 1
ja 0x14000366a
cmp word [rsp + 0x22], 0x3a
jne 0x14000366a
cmp edx, 2
jne 0x14000364a
lea rdx, [0x1400d5904]
lea rcx, [rsp + 0x20]
call fcn.14001d2f4
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x140003735
mov rbx, 0xfffffffffffffffe
jmp 0x140003735
cmp word [rcx], 0x5c
je 0x140003676
cmp word [rcx], 0x2f
jne 0x14000367f
mov word [rcx], di
sub rcx, 2
jmp 0x14000366a
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, rax
cmp rax, rbx
je 0x1400036c6
test byte [rbp + 0x130], 0x10
je 0x1400036ab
mov rbx, 0xfffffffffffffffe
jmp 0x1400036be
mov ebx, dword [rbp + 0x14c]
mov eax, dword [rbp + 0x150]
shl rbx, 0x20
or rbx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140003735
movzx ecx, word [rsp + 0x20]
movzx eax, word [rsp + 0x22]
cmp cx, 0x5c
jne 0x1400036db
cmp ax, cx
je 0x1400036f1
cmp cx, 0x2f
jne 0x1400036e6
cmp ax, cx
je 0x1400036f1
cmp cx, 0x2e
jne 0x140003735
cmp ax, cx
jne 0x140003735
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140003716
not eax
mov rbx, 0xfffffffffffffffe
shr rax, 4
and eax, 1
or rbx, rax
jmp 0x140003735
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rcx, rbx
mov rbx, 0xfffffffffffffffe
cmp eax, 1
cmova rcx, rbx
mov rbx, rcx
lea r11, [rsp + 0x480]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x140003770
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
mov dword [rsp + 0x40], eax
cmp dword [rcx + 0x1c], eax
jne 0x1400037b4
mov r8d, dword [rcx + 0x10]
lea r9, [rsp + 0x40]
sub r8d, dword [rcx + 0x14]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
movsxd rax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
cdqe
add rsp, 0x30
pop rbx
ret
Function at 0x1400037c0
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
mov rcx, qword [0x1400f55d0]
jne 0x1400037e0
add rsp, 0x30
pop rdi
jmp fcn.14001a798
mov rdx, rdi
mov qword [rsp + 0x48], rbx
call fcn.14001a644
mov rbx, rax
test rax, rax
je 0x140003855
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14000383d
xor eax, eax
mov dword [rsp + 0x40], eax
cmp dword [rbx + 0x1c], eax
jne 0x14000382a
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x40]
sub r8d, dword [rbx + 0x14]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
mov r8, qword [rbx + 8]
xor edx, edx
mov rcx, qword [0x1400f5178]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1400f55d0]
mov rdx, rdi
call fcn.14001a6a4
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400039c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov edi, r8d
mov dword [rsp + 0x48], ebx
mov rsi, rdx
test rdx, rdx
je 0x140003a38
test r8d, r8d
je 0x140003a38
mov rdx, rcx
mov rcx, qword [0x1400f55d0]
call fcn.14001a644
test rax, rax
je 0x140003a34
mov r8d, edi
mov rdx, rsi
cmp qword [rax + 8], rbx
je 0x140003a21
mov rcx, rax
call fcn.14001d320
mov ebx, eax
cdqe
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140003ea0
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x30
mov r15d, ecx
mov edi, r9d
mov ecx, dword [0x1400f55ec]
mov esi, r8d
mov r14d, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [rsp + 0x60]
mov rbx, rax
cmp edx, dword [rax + 0x120]
je 0x140003eef
mov rcx, rax
mov dword [rax + 0x120], edx
call qword [rax + 0x80]
mov r8d, dword [rbx + 0x104]
mov r9d, esi
mov edx, dword [rbx + 0x100]
add r8d, r14d
add edx, r15d
mov dword [rsp + 0x60], edi
mov rcx, rbx
mov rax, qword [rbx + 8]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
jmp rax

Function at 0x140003f30
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ebx, r8d
mov ecx, dword [0x1400f55ec]
mov edi, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rsi
mov rcx, rax
mov r9d, dword [rax + 0x104]
mov r8d, dword [rax + 0x100]
add r9d, ebx
add r8d, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x48]
Function at 0x140003f80
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x40
mov ecx, dword [0x1400f55ec]
mov edi, r9d
movaps xmmword [rax - 0x18], xmm6
mov rsi, r8
movaps xmmword [rax - 0x28], xmm7
movaps xmm6, xmm1
movaps xmm7, xmm0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
cmp edi, dword [rax + 0x120]
je 0x140003fcc
mov edx, edi
mov dword [rax + 0x120], edi
mov rcx, rax
call qword [rax + 0x80]
mov edx, dword [rsp + 0x70]
cmp edx, dword [rbx + 0x124]
je 0x140003fe3
mov rcx, rbx
mov dword [rbx + 0x124], edx
call qword [rbx]
movd xmm2, dword [rbx + 0x104]
mov r9, rsi
movd xmm1, dword [rbx + 0x100]
mov rcx, rbx
cvtdq2pd xmm2, xmm2
cvtdq2pd xmm1, xmm1
addsd xmm2, xmm6
addsd xmm1, xmm7
mov rax, qword [rbx + 0x60]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x40
pop rdi
jmp rax

Function at 0x14000402c
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, dword [0x1400f55ec]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, ebx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [rax + 0x40]

Function at 0x140004050
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400f55ec], eax
add rsp, 0x28
ret

Function at 0x140004084
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
test rcx, rcx
je 0x1400040f9
call qword [rcx + 0xb0]
mov edx, dword [rbx + 0xf4]
mov rdi, rax
mov dword [rbx + 0x108], edx
mov edx, dword [rbx + 0xf8]
mov dword [rbx + 0x10c], edx
test rax, rax
jne 0x1400040f9
mov rax, qword [rbx + 0xe0]
test rax, rax
je 0x1400040d1
xor edx, edx
mov rcx, rbx
call rax
mov rcx, qword [0x1400f5178]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x1400f55ec]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
and qword [0x1400f55f0], 0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x140004108
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x1400f55ec]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140004169
mov rcx, rax
call qword [rax + 0xb8]
mov rax, qword [rbx + 0xe0]
test rax, rax
je 0x140004141
mov edx, 1
mov rcx, rbx
call rax
mov rcx, qword [0x1400f5178]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x1400f55ec]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
and qword [0x1400f55f0], 0
add rsp, 0x20
pop rbx
ret
Function at 0x140006730
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov esi, 0x40
mov ecx, esi
call fcn.14001d9c0
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.140022310
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x140006763
sub esi, edx
mov ecx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14001da70

Function at 0x1400068c8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1400f5770]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x140006949
mov r8, qword [0x1400f5768]
lea edx, [rax + 8]
mov rcx, qword [0x1400f5178]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400f5770]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [0x1400f5760]
jmp 0x140006935
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x140006932
mov rcx, qword [rbx + 0x10]
add rcx, rdi
call rdx
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140006920
mov rdx, rdi
lea rcx, [0x140006a64]
call fcn.14002233c
mov rbx, qword [rsp + 0x30]
lea rax, [rdi + rsi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140006960
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
mov rbp, r8
mov rsi, rdx
and ecx, 7
je 0x14000698a
mov eax, 8
sub eax, ecx
add edi, eax
mov rbx, qword [0x1400f5768]
test rbx, rbx
jne 0x1400069d0
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [0x1400f5178]
lea edx, [rbx + 8]
movsxd rdi, edi
mov r8, rdi
mov dword [0x1400f5770], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400f5770]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [0x1400f5768]
jmp 0x1400069d3
movsxd rdi, edi
mov ecx, dword [0x1400f5770]
lea rax, [rdi + rbx]
mov qword [0x1400f5768], rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, qword [0x1400f5768]
mov edx, 8
mov rcx, qword [0x1400f5178]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [0x1400f5770]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test rsi, rsi
jne 0x140006a22
test rbp, rbp
je 0x140006a49
mov edx, 0x28
lea rcx, [0x1400f5760]
call fcn.1400073a0
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rbp
test rsi, rsi
je 0x140006a49
lea rcx, [rdi + rbx]
call rsi
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140006ae0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
movsxd rbx, edx
mov ecx, dword [0x1400f4208]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [0x1400f5778]
xor edx, edx
mov rsi, rax
mov rax, qword [r14]
mov r8d, dword [rsi + 0x10]
sub r8d, ebx
movsxd rdi, r8d
lea r9, [rdi + 0xa]
test rax, rax
jne 0x140006b34
mov r8, r9
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x140006b3d
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [r14], rax
mov rcx, rax
mov rdx, qword [rsi]
shr rdi, 1
add rdx, rbx
mov r8d, edi
call fcn.140022570
mov rdi, qword [rsp + 0x40]
mov qword [rsi + 0x10], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret

Function at 0x140006bb0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1400f4208]
cmp ecx, 0xffffffff
jne 0x140006bc6
call fcn.140006db0
jmp 0x140006bd6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140006bf5
call fcn.1400225b0
mov ecx, dword [0x1400f4208]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x140006b70]
add rsp, 0x28
jmp fcn.14002233c
add rsp, 0x28
ret

Function at 0x140006db0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x1400f5778], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400f4208], eax
add rsp, 0x28
jmp fcn.1400225b0

Function at 0x140006e10
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1400f4208]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rax]
add rsp, 0x28
ret

Function at 0x140006e30
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1400f4208]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rbx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140006e70
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1400f4208]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add qword [rax + 0x10], 2
add rsp, 0x28
ret

Function at 0x140019920
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140019966
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140019935
mov ecx, eax
call fcn.14001d9c0
sub rax, rbx
nop dword [rax]
movzx ecx, word [rbx]
mov word [rax + rbx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x140019950
add rsp, 0x20
pop rbx
ret
mov ecx, edx
add rsp, 0x20
pop rbx
jmp fcn.140019980
Function at 0x140019980
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movsxd rbx, ecx
mov ecx, dword [0x1400f4208]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edx, edx
mov qword [rax + 0x10], rbx
mov rax, qword [rax]
mov word [rbx + rax], dx
add rsp, 0x20
pop rbx
ret

Function at 0x140019d00
Capabilities:
Create thread
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12d, ecx
mov rsi, r9
mov rcx, qword [0x1400f5268]
mov rbp, r8
mov r14, rdx
xor ebx, ebx
call fcn.1400068c8
mov r15, rax
test r14, r14
je 0x140019e39
mov rcx, qword [0x1400f5178]
lea edx, [rbx + 8]
mov r8d, 0x98
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, r14
mov rdi, rax
or dword [rax + 4], 0xffffffff
mov dword [rax], 1
call fcn.1400221a8
lea rcx, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
mov qword [rdi + 8], rax
call fcn.1400221a8
mov ecx, dword [rsp + 0x80]
mov qword [rdi + 0x60], rax
mov dword [rdi + 0x40], ecx
mov eax, dword [r15]
mov dword [rdi + 0x44], eax
mov eax, dword [r15 + 4]
mov dword [rdi + 0x48], eax
mov rax, qword [rsp + 0x88]
mov qword [rdi + 0x78], rax
mov dword [rdi + 0x80], r12d
mov qword [rdi + 0x88], rsi
test cl, 1
je 0x140019e2a
test rsi, rsi
je 0x140019de5
mov rcx, qword [0x1400f5178]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0x70], rax
test rax, rax
je 0x140019ddf
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.1400077a0
cmp qword [rdi + 0x70], rbx
je 0x140019e20
lea rax, [rsp + 0x68]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x14001a3ec]
mov edx, 0x10000
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140019e1a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140019e36
cmp dword [rsp + 0x68], ebx
jne 0x140019e36
mov rcx, rdi
call fcn.140001ca8
jmp 0x140019e39
mov rcx, rdi
mov qword [rdi + 0x70], rbp
call fcn.140019f6c
mov rbx, rdi
mov rbp, qword [rsp + 0x70]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14001c08c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x40
mov r14, rcx
xor ebx, ebx
call qword [sym.imp.USER32.dll_GetFocus]
lea rdx, str.PB_WindowID
mov rcx, r14
mov rdi, rax
xor ebp, ebp
call qword [sym.imp.USER32.dll_GetPropW]
lea r12d, [rbx + 9]
mov rsi, rax
test rax, rax
je 0x14001c13d
lea rdx, [rsp + 0x68]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x14001c13d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x68], eax
jne 0x14001c13d
mov rcx, qword [0x1400f57f8]
lea rdx, [rsi - 1]
call fcn.14001a644
mov rbx, rax
lea ebp, [r12 - 8]
cmp dword [rax + 0x20], 0
jle 0x14001c13d
mov rcx, qword [rax + 8]
xor edx, edx
movsxd rax, dword [rax + 0x20]
add rcx, 4
cmp word [rcx - 2], r12w
jne 0x14001c12d
mov r8d, 0xfa01
cmp word [rcx], r8w
je 0x14001c13b
inc rdx
add rcx, 6
cmp rdx, rax
jge 0x14001c13d
jmp 0x14001c11a
xor ebp, ebp
mov sil, 0x80
test rdi, rdi
je 0x14001c20d
mov ecx, r12d
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
je 0x14001c20d
mov ecx, send
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14001c20d
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14001c20d
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14001c20d
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
test ebp, ebp
jne 0x14001c20d
lea r8d, [rbp + 5]
lea rdx, str.RichE
lea rcx, [rsp + 0x20]
call fcn.14002222c
test eax, eax
je 0x14001c1dd
lea r8d, [rbp + 4]
lea rdx, str.RICHE
lea rcx, [rsp + 0x20]
call fcn.14002222c
test eax, eax
jne 0x14001c1f8
xor r9d, r9d
xor r8d, r8d
mov edx, 0x44e
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xb
jae 0x14001c274
lea rdx, str.Scintilla
lea rcx, [rsp + 0x20]
call fcn.140039348
test eax, eax
je 0x14001c274
test r14, r14
je 0x14001c24f
mov ecx, send
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14001c242
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14001c242
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
je 0x14001c24f
mov edx, 1
mov rcx, r14
call fcn.14001c404
test rdi, rdi
je 0x14001c269
lea rdx, str.PB_Hotkey
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetPropW]
test rax, rax
jne 0x14001c274
test rbx, rbx
je 0x14001c274
mov rax, qword [rbx + 0x10]
jmp 0x14001c276
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r12
pop rdi
ret
Function at 0x14001d320
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0x38
xor ebp, ebp
movsxd rbx, r8d
mov r14, rdx
mov rsi, rcx
mov dword [rsp + 0x60], ebp
cmp dword [rcx + 0x24], ebp
jne 0x14001d41a
cmp dword [rcx + 0x1c], 1
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], r15
jne 0x14001d37b
mov eax, dword [rcx + 0x14]
lea r9d, [rbp + 1]
mov rcx, qword [rcx]
lea r8, [rsp + 0x7c]
neg eax
cdqe
mov edx, eax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [rsi + 0x10]
mov dword [rsi + 0x14], eax
mov dword [rsi + 0x1c], ebp
mov ecx, dword [rsi + 0x14]
cmp ecx, ebx
jle 0x14001d3dc
mov eax, dword [rsi + 0x10]
mov edx, ebx
sub eax, ecx
movsxd rcx, eax
add rcx, qword [rsi + 8]
sub edx, 1
je 0x14001d3d4
sub edx, 1
je 0x14001d3cb
cmp edx, 2
je 0x14001d3c4
mov r8, rbx
mov rdx, r14
call fcn.1400077a0
sub dword [rsi + 0x14], ebx
mov rax, rbx
mov rdi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
add rsp, 0x38
pop r14
pop rsi
pop rbp
pop rbx
ret
mov eax, dword [r14]
mov dword [rcx], eax
jmp 0x14001d3aa
movzx eax, word [r14]
mov word [rcx], ax
jmp 0x14001d3aa
movzx eax, byte [r14]
mov byte [rcx], al
jmp 0x14001d3aa
mov rcx, rsi
call fcn.140003770
mov eax, dword [rsi + 0x10]
mov rdx, r14
cmp ebx, eax
jl 0x14001d40b
mov rcx, qword [rsi]
lea r9, [rsp + 0x60]
mov r8d, ebx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x60]
jmp 0x14001d3b0
sub eax, dword [rsi + 0x14]
mov r8, rbx
movsxd rcx, eax
add rcx, qword [rsi + 8]
jmp 0x14001d3a5
movsxd rax, ebp
add rsp, 0x38
pop r14
pop rsi
pop rbp
pop rbx
ret

Function at 0x14001d9c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rbp, ecx
mov esi, edx
mov ecx, dword [0x1400f4208]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
cmp esi, 0xffffffff
jne 0x14001d9f0
mov esi, dword [rax + 0x10]
mov eax, dword [rax + 0x10]
mov r8, qword [rbx + 8]
lea edx, [rax + rbp*2]
movsxd rax, edx
lea rcx, [r8 - 4]
cmp rax, rcx
jl 0x14001da11
lea eax, [rdx + 0x4000]
movsxd r9, eax
jmp 0x14001da23
mov eax, 0x100000
cmp r8, rax
jle 0x14001da40
cmp edx, eax
cmovl edx, eax
mov r9d, edx
mov r8, qword [rbx]
xor edx, edx
mov qword [rbx + 8], r9
add r9, 0xa
mov rcx, qword [0x1400f5778]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rbx], rax
mov rax, qword [rbx]
movsxd rdx, esi
mov rsi, qword [rsp + 0x40]
add rax, rdx
lea rcx, [rdx + rbp*2]
mov rbp, qword [rsp + 0x38]
mov qword [rbx + 0x10], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001da70
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, dword [0x1400f4208]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [rbx + rbx]
movsxd rdx, ecx
sub qword [rax + 0x10], rdx
add rsp, 0x20
pop rbx
ret
Function at 0x14001e068
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
mov edx, 8
mov rcx, qword [0x1400f5178]
mov r8d, 0x258
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400f55ec]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [0x1400f55f0], rdi
or eax, 0xffffffff
and dword [rdi + 0x11c], 0
mov edx, ebx
mov rcx, rdi
mov dword [rdi + 0x120], eax
mov dword [rdi + 0x124], eax
mov dword [rdi + 0x118], 0xffffff
mov dword [rdi + 0xe8], 2
mov dword [rdi + 0xec], 0x3f
call fcn.14003af34
mov rbx, qword [rsp + 0x30]
lea rax, [0x14001f64c]
mov qword [rdi + 0xb0], rax
lea rax, [0x14001f6b0]
mov qword [rdi + 0xb8], rax
lea rax, [fcn.14001e278]
mov qword [rdi + 0x20], rax
lea rax, [0x14001e450]
mov qword [rdi + 0x60], rax
lea rax, [0x14001e698]
mov qword [rdi + 0xc8], rax
lea rax, [0x14001e700]
mov qword [rdi + 0xc0], rax
lea rax, [0x14001ef88]
mov qword [rdi + 0x68], rax
lea rax, [0x14001edc8]
mov qword [rdi + 0x48], rax
lea rax, [0x14001edf4]
mov qword [rdi + 0x50], rax
lea rax, [0x14001ee24]
mov qword [rdi + 0x58], rax
lea rax, [0x14001f424]
mov qword [rdi + 0x88], rax
lea rax, [0x14001e1d8]
mov qword [rdi + 0xd0], rax
lea rax, [0x14001e25c]
mov qword [rdi + 0xd8], rax
mov rax, rdi
add rsp, 0x20
pop rdi
ret