joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140051f88
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rdi, r9
mov esi, r8d
mov rbx, rcx
lea rcx, [rsp + 0x50]
call fcn.140002970
nop
cmp rbx, 0xffffffff80000000
jne 0x140052014
call fcn.14002919c
cmp eax, 1
jne 0x140052014
lea r8, [rsp + 0x50]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x30]
call fcn.14001bb70
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400024d0
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14005200d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, 0xffffffff80000001
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8d, esi
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140052053
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400670d8
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x1400670fe
mov r8, rdx
mov rdx, qword [rbx]
call fcn.14004a070
jmp 0x140067165
cmp byte [0x1420b3978], 0
jne 0x140067142
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140067132
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1420b3970], rax
jmp 0x140067139
mov rax, qword [0x1420b3970]
mov byte [0x1420b3978], 1
jmp 0x140067149
mov rax, qword [0x1420b3970]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14006715f
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x140067165
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400674f8
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rdx]
mov rbx, rdx
cmp dword [rcx - 0x10], 0
je 0x14006752a
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14006752a
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.1400c5344
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ca49c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r13, rcx
test r8, r8
jne 0x1400ca4cd
call fcn.140029c0c
mov rdi, qword [rax + 0x18]
mov r8, qword [0x1420b6158]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbp, rax
test rax, rax
jne 0x1400ca4ec
xor eax, eax
jmp 0x1400ca538
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1400ca4e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x1400ca52d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r12
mov rcx, r13
mov r8d, eax
call fcn.1400ca360
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x140113084
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x140113095
xor eax, eax
jmp 0x1401130c3
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140113258
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x140113269
xor eax, eax
jmp 0x14011328d
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140113294
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
lea r9, [r11 + 0x20]
mov qword [r11 - 0x10], rax
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor edx, edx
test eax, eax
jne 0x1401132d6
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret
Function at 0x1401133e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x140113413
call fcn.14001e6d0
int3
test rbx, rbx
jne 0x14011341e
call fcn.14001e6d0
int3
test r9, r9
jne 0x140113429
call fcn.14001e6d0
int3
and qword [r8], 0
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], r9
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1401134ac
cmp dword [rsp + 0x48], 3
jne 0x1401134ac
test eax, eax
jne 0x1401134ac
cmp dword [rdi], eax
je 0x1401134ac
mov ecx, dword [rdi]
call fcn.14001c0b4
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rbx], rax
mov rcx, qword [rbp + 8]
mov rdx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1401134a0
cmp dword [rsp + 0x48], 3
jne 0x1401134a0
test eax, eax
jne 0x1401134a0
mov eax, 1
jmp 0x1401134ae
mov rcx, qword [rbx]
call fcn.14001c100
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1401135b8
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x14014ec64
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
je 0x14014ec8d
mov rdi, qword [rdx + 0x10]
jmp 0x14014ecde
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rbx + 8]
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x14014ecae
call fcn.1400351c8
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x14014ecc8
call fcn.1400351c8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x14014ecde
call fcn.1400351c8
call fcn.140029c0c
cmp qword [rax + 0x68], 0
je 0x14014ecf8
mov rdx, rdi
mov rcx, rbp
call fcn.14014d3f4
mov rdi, rax
mov edx, esi
mov rcx, rdi
call fcn.14014eaa4
mov rcx, qword [rbp + 0xe8]
mov rsi, rax
test rcx, rcx
je 0x14014ed1f
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xe8], 0
test rsi, rsi
je 0x14014ed2e
mov rdi, rsi
mov qword [rbp + 0xe8], rsi
or dword [rbx + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401764e0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140176350
Function at 0x140179fa3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140238ff8]
jne 0x1401729aa
rol rcx, 0x10
test cx, 0xffff
jne 0x1401729a6
repz ret
ror rcx, 0x10
jmp 0x140179efc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1420b96a0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1420b9798]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140179f81
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1420b96a0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140179fa3
mov rax, qword [rsp + 0x88]
mov qword [0x1420b9798], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1420b9738], rax
mov rax, qword [0x1420b9798]
mov qword [0x1420b9610], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1420b9720], rax
mov dword [0x1420b9600], 0xc0000409
mov dword [0x1420b9604], 1
mov rax, qword [0x140238ff8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140239000]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1420b9698], eax
mov ecx, 1
call fcn.140187d0c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1401edf48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1420b9698], 0
jne 0x14017a02a
mov ecx, 1
call fcn.140187d0c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1401886d4
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140238ff8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14017af54
xor ebx, ebx
cmp qword [0x1420ba6c8], rbx
mov rdi, rax
jne 0x1401887e7
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1401888be
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401888be
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1401f02c0]
mov rcx, rsi
mov qword [0x1420ba6c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1401f02a8]
mov rcx, rsi
mov qword [0x1420ba6d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1420ba6d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1420ba6e8], rax
test rax, rax
je 0x1401887de
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1420ba6e0], rax
jmp 0x1401887ee
mov rax, qword [0x1420ba6e0]
jmp 0x1401887f5
mov rax, qword [0x1420ba6e0]
mov r11, qword [0x1420ba6e8]
cmp rax, rdi
je 0x14018885c
cmp r11, rdi
je 0x14018885c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1420ba6e8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14018885c
test rax, rax
je 0x14018885c
call rsi
test rax, rax
je 0x140188856
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140188856
test byte [rsp + 0x40], 1
jne 0x14018885c
bts ebp, 0x15
jmp 0x14018889c
mov rcx, qword [0x1420ba6d0]
cmp rcx, rdi
je 0x14018889c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14018889c
call rax
mov rbx, rax
test rax, rax
je 0x14018889c
mov rcx, qword [0x1420ba6d8]
cmp rcx, rdi
je 0x14018889c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14018889c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1420ba6c8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1401888be
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1401888c0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140172990
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800071f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
movsx eax, byte [rcx + rax]
test eax, eax
jne 0x180007220
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
jmp 0x18000726c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rcx + rax]
mov rcx, qword [rsp + 0x48]
xor rcx, rax
mov rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
mov ecx, 1
imul rcx, rcx, 1
mov rdx, qword [rsp + 0x40]
add rdx, rcx
mov rcx, rdx
mov rdx, rax
call fcn.1800071f0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x18000d600
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x1802ffb80]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0xc0]
call fcn.18000eaf0
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x50], 0x40
mov dword [rsp + 0x54], 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
xor r8d, r8d
lea rdx, str.MachineGuid
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x34], 0
jne 0x18000d6d0
cmp dword [rsp + 0x38], 0
jne 0x18000d6d0
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xc0]
call fcn.18000e8f0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18024c230
add rsp, 0xb8
ret
Function at 0x18000d700
Capabilities:
Check http status code
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x1098
call fcn.18024d060
sub rsp, rax
mov rax, qword [0x1802ffb80]
xor rax, rsp
mov qword [rsp + 0x1080], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.Authorization
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x18000d758
xor al, al
jmp 0x18000d86d
mov r8, qword [rsp + 0x10a0]
lea rdx, str.https:__nonagonzone.ru_authorize_guid
lea rcx, [rsp + 0x58]
call fcn.18000fed0
lea rcx, [rsp + 0x58]
call fcn.18000e530
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x4000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x18000d7d1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov byte [rsp + 0x31], 0
lea rcx, [rsp + 0x58]
call fcn.180004c00
movzx eax, byte [rsp + 0x31]
jmp 0x18000d86d
mov byte [rsp + 0x30], 0
lea r9, [rsp + 0x48]
mov r8d, 0x1000
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x18000d83f
cmp dword [rsp + 0x48], 0
jbe 0x18000d83f
mov dword [rsp + 0x4c], 4
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x50]
mov edx, 0x20000013
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x18000d83d
cmp dword [rsp + 0x50], 0xc8
jne 0x18000d83d
mov byte [rsp + 0x30], 1
jmp 0x18000d7d6
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x32], al
lea rcx, [rsp + 0x58]
call fcn.180004c00
movzx eax, byte [rsp + 0x32]
mov rcx, qword [rsp + 0x1080]
xor rcx, rsp
call fcn.18024c230
add rsp, 0x1098
ret

Function at 0x18000db30
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x18
xor eax, eax
cmp eax, 1
je 0x18000db64
movsx eax, byte [rsp + 0x28]
cmp eax, 0x41
jl 0x18000db64
movsx eax, byte [rsp + 0x28]
cmp eax, 0x5a
jg 0x18000db64
movsx eax, byte [rsp + 0x28]
or eax, 0x20
mov dword [rsp], eax
jmp 0x18000db6c
movsx eax, byte [rsp + 0x28]
mov dword [rsp], eax
mov eax, dword [rsp]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
add rsp, 0x18
ret
Function at 0x180012a70
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x180012aa1
cmp dword [rsp + 0x24], 1
je 0x180012ad1
cmp dword [rsp + 0x24], 2
je 0x180012afd
jmp 0x180012b01
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetKeyState]
movsx rax, ax
shr rax, 0x10
and rax, 0xffff
test ax, ax
je 0x180012ac5
mov byte [rsp + 0x20], 1
jmp 0x180012aca
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
jmp 0x180012b03
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetKeyState]
movsx rax, ax
and rax, 0xffff
test ax, ax
je 0x180012af1
mov byte [rsp + 0x21], 1
jmp 0x180012af6
mov byte [rsp + 0x21], 0
movzx eax, byte [rsp + 0x21]
jmp 0x180012b03
mov al, 1
jmp 0x180012b03
mov al, 1
add rsp, 0x38
ret
Function at 0x180014770
Capabilities:
Access peb ldr_data

Disassembly:
movss dword [rsp + 0x20], xmm3
movss dword [rsp + 0x18], xmm2
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov eax, 0x20
mov eax, eax
mov ecx, dword [0x18031b2e4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x18031d4d0], eax
jle 0x180014869
lea rcx, [0x18031d4d0]
call fcn.18024c2f8
cmp dword [0x18031d4d0], 0xffffffff
jne 0x180014869
lea rcx, [0x18031b650]
call fcn.180004850
mov qword [rbp + 0x18], rax
lea rax, [rbp]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 1]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp]
movzx r8d, byte [rbp + 1]
movzx edx, byte [rbp + 2]
lea rcx, [rbp + 0x40]
call fcn.1800150c0
mov rcx, rax
call fcn.18000db90
mov qword [rbp + 8], rax
lea rcx, [0x18031d448]
call fcn.180004850
mov rcx, rax
call fcn.1800035c0
mov qword [rbp + 0x10], rax
mov r8, qword [rbp + 8]
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x18]
call fcn.180118320
mov qword [0x18031d4a8], rax
lea rcx, [0x18031d4d0]
call fcn.18024c28c
cmp qword [0x18031d4a8], 0
je 0x1800148c0
mov rax, qword [0x18031d4a8]
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov eax, dword [rsp + 0x128]
mov dword [rsp + 0x20], eax
movss xmm3, dword [rsp + 0x120]
movss xmm2, dword [rsp + 0x118]
movss xmm1, dword [rsp + 0x110]
mov rcx, qword [rsp + 0x108]
call qword [rbp + 0x20]
add rsp, 0xe8
pop rdi
pop rbp
ret
Function at 0x180021090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
movss dword [rsp + 0x18], xmm2
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1802ffb80]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x28], 0
mov edx, 0x18
mov rcx, qword [rsp + 0x88]
call fcn.1800035d0
mov rcx, qword [rsp + 0x88]
call fcn.180004ab0
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x28]
or eax, 1
mov dword [rsp + 0x28], eax
movsxd rax, dword [rsp + 0x98]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.180024d00
movss xmm0, dword [0x1802d9d80]
call fcn.18001c1d0
movss xmm1, dword [0x1802d9d3c]
subss xmm1, xmm0
movaps xmm0, xmm1
cvtss2sd xmm0, xmm0
movsd xmm1, qword [0x1802d9d08]
mulsd xmm1, xmm0
movaps xmm0, xmm1
cvtsd2ss xmm0, xmm0
movss dword [rsp + 0x34], xmm0
mov dword [rsp + 0x20], 0
jmp 0x180021154
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x98]
cmp dword [rsp + 0x20], eax
jge 0x180021270
cvtsi2ss xmm0, dword [rsp + 0x20]
mov eax, dword [rsp + 0x98]
dec eax
cvtsi2ss xmm1, eax
divss xmm0, xmm1
mulss xmm0, dword [0x1802d9d00]
movss xmm1, dword [0x1802d9c98]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x24], xmm0
movss xmm0, dword [rsp + 0x24]
mulss xmm0, dword [rsp + 0x24]
movss xmm1, dword [0x1802d9c98]
subss xmm1, xmm0
movaps xmm0, xmm1
call fcn.18001c1d0
movss dword [rsp + 0x30], xmm0
cvtsi2ss xmm0, dword [rsp + 0x20]
movss xmm1, dword [rsp + 0x34]
mulss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x2c], xmm0
movss xmm0, dword [rsp + 0x2c]
call fcn.180015ed0
mulss xmm0, dword [rsp + 0x30]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x2c]
call fcn.180015ef0
mulss xmm0, dword [rsp + 0x30]
movss dword [rsp + 0x3c], xmm0
xorps xmm3, xmm3
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rsp + 0x58]
call fcn.180003530
movss xmm0, dword [rsp + 0x38]
mulss xmm0, dword [rsp + 0x90]
movss xmm1, dword [rsp + 0x24]
mulss xmm1, dword [rsp + 0x90]
movss xmm2, dword [rsp + 0x3c]
mulss xmm2, dword [rsp + 0x90]
movaps xmm3, xmm2
movaps xmm2, xmm1
movaps xmm1, xmm0
lea rcx, [rsp + 0x40]
call fcn.180003530
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x88]
call fcn.180024d50
jmp 0x18002114a
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18024c230
add rsp, 0x78
ret
Function at 0x18002d4e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1802ffb80]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.180023670
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.18002d830
nop
lea rax, [0x18002d8c0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.180004850
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x18002d597
lea rcx, [rsp + 0x40]
call fcn.18002d6b0
jmp 0x18002d5af
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rcx, [rsp + 0x40]
call fcn.18002d6e0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18024c230
add rsp, 0x58
ret