joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016c49d
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x14018ce80
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x14057301b]
call fcn.140170980
mov qword [rbp + 8], 0x137
mov qword [rbp + 0x28], 0x9c
mov qword [rbp + 0x48], 0
jmp 0x14018cec4
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0x9c
jae 0x14018cf6d
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x48]
mov rax, qword [rax + rcx*8 + 0x9c8]
and rax, 0xffffffff80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rcx + rdx*8 + 0x9d0]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
and rax, 1
test rax, rax
je 0x14018cf2c
movabs rax, 0xb5026f5aa96619e9
mov qword [rbp + 0x1b8], rax
jmp 0x14018cf37
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0x68]
shr rax, 1
xor rax, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
xor rax, qword [rcx + rdx*8 + 0xea8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14018ceb9
mov qword [rbp + 0x88], 0x9c
jmp 0x14018cf8b
mov rax, qword [rbp + 0x88]
inc rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0x137
jae 0x14018d04c
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x88]
mov rax, qword [rax + rcx*8 + 0x9c8]
and rax, 0xffffffff80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rcx + rdx*8 + 0x9d0]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
and rax, 1
test rax, rax
je 0x14018d002
movabs rax, 0xb5026f5aa96619e9
mov qword [rbp + 0x1b8], rax
jmp 0x14018d00d
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0xa8]
shr rax, 1
xor rax, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
xor rax, qword [rcx + rdx*8 - 0x4d8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14018cf7a
mov qword [rbp + 0xc8], 0x137
mov eax, 8
imul rax, rax, 0x26f
mov rcx, qword [rbp + 0x1e0]
mov rax, qword [rcx + rax + 8]
and rax, 0xffffffff80000000
mov ecx, 8
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x1e0]
mov rcx, qword [rdx + rcx + 8]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
and rax, 1
test rax, rax
je 0x14018d0be
movabs rax, 0xb5026f5aa96619e9
mov qword [rbp + 0x1b8], rax
jmp 0x14018d0c9
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0xe8]
shr rax, 1
xor rax, qword [rbp + 0x1b8]
mov ecx, 8
imul rcx, rcx, 0x9b
mov rdx, qword [rbp + 0x1e0]
xor rax, qword [rdx + rcx + 8]
mov ecx, 8
imul rcx, rcx, 0x137
mov rdx, qword [rbp + 0x1e0]
mov qword [rdx + rcx + 8], rax
mov rax, qword [rbp + 0x1e0]
mov dword [rax], 0
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x14016c619
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x14035c1a0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14035bb20
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14035c1df
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140575020]
jmp 0x14035c1e9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x14016ca15
Capabilities:
Query environment variable

Disassembly:
jmp 0x140425e90
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x140425f78
mov rsi, rax
cmp word [rax], r14w
je 0x140425ee3
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r14w
jne 0x140425ecb
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], r14w
jne 0x140425ec7
mov qword [rsp + 0x38], r14
sub rsi, rbx
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
mov r8, rbx
mov r9d, esi
mov dword [rsp + 0x28], r14d
xor edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
call fcn.14016e716
movsxd rbp, eax
test eax, eax
je 0x140425f78
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov rcx, rbp
lea edx, [r9 - 0x64]
call fcn.14016c376
mov rdi, rax
test rax, rax
je 0x140425f66
mov qword [rsp + 0x38], r14
mov r9d, esi
mov qword [rsp + 0x30], r14
mov r8, rbx
mov dword [rsp + 0x28], ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.14016e716
test eax, eax
je 0x140425f66
mov rsi, rdi
mov rdi, r14
jmp 0x140425f69
mov rsi, r14
mov edx, 2
mov rcx, rdi
call fcn.14016985b
jmp 0x140425f7b
mov rsi, r14
test rbx, rbx
je 0x140425f89
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14016ca42
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x14035c0d0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.14035baa0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14035c111
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140575020]
jmp 0x14035c117
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x14016cb82
Capabilities:
Get geographical location

Disassembly:
jmp 0x1403fec00
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1403fdb80
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1403fec53
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
call qword [0x140575020]
jmp 0x1403fec75
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.14016b57f
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x48
ret
Function at 0x14016cba0
Capabilities:
Terminate process

Disassembly:
jmp 0x140337890
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14016d177
Capabilities:
Print debug messages

Disassembly:
jmp 0x14042f3e0
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x140540bd0]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x14042f406
jmp 0x14042f483
mov rcx, qword [rbp + 0x30]
call fcn.14016bd95
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14042f41f
jmp 0x14042f483
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x14042f43c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401698d3
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.14016a2e2
test eax, eax
jne 0x14042f483
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.14016c209
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x14016d3b1
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x1402da420
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
lea rcx, [0x1405735c1]
call fcn.140170980
mov eax, 0x104
mov eax, eax
mov ecx, dword [0x14054d010]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x14054c028], eax
jle 0x1402da4b4
lea rcx, [0x14054c028]
call fcn.14016f9e5
cmp dword [0x14054c028], 0xffffffff
jne 0x1402da4b4
lea rdx, str.Click_to_bind
lea rcx, [0x14054c000]
call fcn.14016be80
lea rcx, [0x140456410]
call fcn.14016b5e8
nop
lea rcx, [0x14054c028]
call fcn.14016fdfa
cvtsi2ss xmm0, dword [rbp + 0x1c8]
cvtsi2ss xmm1, dword [rbp + 0x1c0]
movaps xmm2, xmm0
lea rcx, [rbp + 0xe4]
call fcn.14016d622
mov qword [rbp + 0x178], rax
lea rcx, [0x14054c000]
call fcn.140168c4e
mov qword [rbp + 0x180], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x180]
call fcn.14016ae3b
movzx eax, al
test eax, eax
je 0x1402da50e
mov byte [0x14054bfd9], 1
movzx eax, byte [0x14054bfd9]
test eax, eax
je 0x1402da597
mov dword [rbp + 4], 1
jmp 0x1402da52a
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0x100
jge 0x1402da57f
mov ecx, dword [rbp + 4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1402da57d
cmp dword [rbp + 4], 0xc
je 0x1402da57d
cmp dword [rbp + 4], 0x1b
jne 0x1402da55e
mov dword [rbp + 0x174], 0
jmp 0x1402da567
mov eax, dword [rbp + 4]
mov dword [rbp + 0x174], eax
mov rax, qword [rbp + 0x1b8]
mov ecx, dword [rbp + 0x174]
mov dword [rax], ecx
mov byte [0x14054bfd9], 0
jmp 0x1402da522
lea rdx, str.Press_a_key
lea rcx, [0x14054c000]
call fcn.140168505
jmp 0x1402da660
movzx eax, byte [0x14054bfd9]
test eax, eax
jne 0x1402da5c6
mov rax, qword [rbp + 0x1b8]
cmp dword [rax], 0
jne 0x1402da5c6
lea rdx, str.Click_to_bind
lea rcx, [0x14054c000]
call fcn.140168505
jmp 0x1402da660
movzx eax, byte [0x14054bfd9]
test eax, eax
jne 0x1402da660
mov rax, qword [rbp + 0x1b8]
cmp dword [rax], 0
je 0x1402da660
mov rax, qword [rbp + 0x1b8]
mov r8d, dword [rax]
lea rdx, [rbp + 0x108]
mov rcx, qword [rbp + 0x1b0]
call fcn.14016dcc1
mov qword [rbp + 0x178], rax
mov rax, qword [rbp + 0x178]
mov qword [rbp + 0x180], rax
mov r8, qword [rbp + 0x180]
lea rdx, str.Bound_to
lea rcx, [rbp + 0x148]
call fcn.140170d18
mov qword [rbp + 0x188], rax
mov rdx, qword [rbp + 0x188]
lea rcx, [0x14054c000]
call fcn.14016a4b3
lea rcx, [rbp + 0x148]
call fcn.14016994b
nop
lea rcx, [rbp + 0x108]
call fcn.14016994b
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x14016daa0
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1401d55b0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x1405730d6]
call fcn.140170980
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x14045e8a0]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x1401d56f5
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x1401d5649
mov dword [rbp + 0x160], 1
jmp 0x1401d5653
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x1401d56f0
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x1401d56ca
cmp qword [rbp + 0x198], 2
jb 0x1401d56ca
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401d56ca
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401d56ca
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1401d5614
jmp 0x1401d578f
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x1401d578f
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x1401d5766
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401d5766
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401d5766
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1401d56f5
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x14016de06
Capabilities:
Parse pe header

Disassembly:
jmp 0x140338e20
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140338e40
xor al, al
jmp 0x140338ec1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140338e53
xor al, al
jmp 0x140338ec1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140338e7d
xor al, al
jmp 0x140338ec1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140338e91
xor al, al
jmp 0x140338ec1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140338ea3
xor al, al
jmp 0x140338ec1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140338ebf
xor al, al
jmp 0x140338ec1
mov al, 1
add rsp, 0x38
ret
Function at 0x14016eb53
Capabilities:
Terminate process

Disassembly:
jmp 0x14035caa0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14035cace
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.14016ff17
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14016ed3d
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1403fe9f0
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.1403fda00
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1403fea25
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x140575020]
jmp 0x1403fea2f
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x38
ret
Function at 0x14016f490
Capabilities:
Create directory

Disassembly:
jmp 0x1402e6110
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140540bd0]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1402e614d
mov byte [rsp + 0x24], 1
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x24]
jmp 0x1402e61c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xb7
jne 0x1402e61b0
mov edx, 1
mov ecx, 2
call fcn.140168492
mov r9d, 0xffffffff
mov r8d, eax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.14016a6e3
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x1402e61b0
mov edx, 0x10
mov ecx, dword [rsp + 0x48]
call fcn.14016f7b0
movzx eax, al
test eax, eax
jne 0x1402e61b0
mov dword [rsp + 0x20], 0xb7
mov byte [rsp + 0x2c], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2c]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14016c209
add rsp, 0x68
ret

Function at 0x14016f837
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1403fea50
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.1403fda40
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1403fea8f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x140575020]
jmp 0x1403fea9e
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret

Function at 0x14016fe9a
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1401d5490
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x1405730d6]
call fcn.140170980
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x14045e8a0]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1401d550f
mov dword [rbp + 0x120], 1
jmp 0x1401d5519
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x1401d5562
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x1401d54da
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x14016ffe9
Capabilities:
Print debug messages

Disassembly:
jmp 0x1403fc270
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x14017022d
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x14035c210
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14035bb60
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14035c259
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140575020]
jmp 0x14035c268
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret
Function at 0x1401703c2
Capabilities:
Get graphical window text

Disassembly:
jmp 0x1402de060
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x408
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, ILFree
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x428]
mov rax, qword [0x140540bd0]
xor rax, rbp
mov qword [rbp + 0x3d8], rax
mov dword [rbp + 0x3c4], 0
lea rcx, [0x1405735fe]
call fcn.140170980
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1402de0e8
mov rcx, qword [rbp + 0x400]
call fcn.14016e98c
mov eax, dword [rbp + 0x3c4]
or eax, 1
mov dword [rbp + 0x3c4], eax
mov rax, qword [rbp + 0x400]
jmp 0x1402de122
mov r8d, 0x80
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x400]
call fcn.14016ae36
mov eax, dword [rbp + 0x3c4]
or eax, 1
mov dword [rbp + 0x3c4], eax
mov rax, qword [rbp + 0x400]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1404cf0e0]
call fcn.14016f0fd
mov rax, rdi
mov rcx, qword [rbp + 0x3d8]
xor rcx, rbp
call fcn.14016c209
lea rsp, [rbp + 0x3e8]
pop rdi
pop rbp
ret
Function at 0x14017086d
Capabilities:
Create thread

Disassembly:
jmp 0x1403d6d80
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x90], 0
je 0x1403d6dac
mov dword [rsp + 0x30], 1
jmp 0x1403d6db4
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x1403d6dfd
lea rax, str.procedure___nullptr
mov qword [rsp + 0x28], rax
lea rax, [0x1404d4738]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0xc8
lea rdx, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
mov ecx, 2
call fcn.140168f78
cmp eax, 1
jne 0x1403d6dfd
int3
cmp dword [rsp + 0x34], 0
jne 0x1403d6e3f
call fcn.14016b138
mov dword [rax], 0x16
mov qword [rsp + 0x20], 0
mov r9d, 0xc8
lea r8, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
lea rdx, str._beginthreadex
lea rcx, str.procedure___nullptr
call fcn.14016f521
xor eax, eax
jmp 0x1403d6f3f
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.1403d6870
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1403d6670
lea rcx, [rsp + 0x40]
call fcn.1403d66e0
movzx eax, al
test eax, eax
jne 0x1403d6e8f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
call fcn.1403d66c0
mov rax, qword [rsp + 0x50]
jmp 0x1403d6f3f
lea rcx, [rsp + 0x40]
call fcn.1403d6a20
mov ecx, dword [rsp + 0x88]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
mov edx, dword [rsp + 0xa0]
mov dword [rsp + 0x20], edx
mov r9, rax
lea r8, [0x1403d6460]
mov edx, ecx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x1403d6f03
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14016a805
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x40]
call fcn.1403d66c0
mov rax, qword [rsp + 0x58]
jmp 0x1403d6f3f
cmp qword [rsp + 0xa8], 0
je 0x1403d6f1c
mov rax, qword [rsp + 0xa8]
mov ecx, dword [rsp + 0x38]
mov dword [rax], ecx
lea rcx, [rsp + 0x40]
call fcn.1403d69e0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x40]
call fcn.1403d66c0
mov rax, qword [rsp + 0x60]
add rsp, 0x78
ret

Function at 0x1401713a8
Capabilities:
Move file

Disassembly:
jmp 0x1402e78a0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r8d, 3
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1402e78cc
xor eax, eax
jmp 0x1402e78d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x28
ret
Function at 0x1407ae058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407ae1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407ae089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407ae06f
add dl, dl
jne 0x1407ae096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407ae0f6
xor eax, eax
add dl, dl
jne 0x1407ae0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407ae1ad
add dl, dl
jne 0x1407ae0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407ae0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407ae0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407ae0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407ae0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407ae07e
mov eax, 1
add dl, dl
jne 0x1407ae106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407ae113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407ae0fb
sub eax, ebx
mov ebx, 1
jne 0x1407ae14c
mov ecx, 1
add dl, dl
jne 0x1407ae12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407ae13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407ae123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407ae07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407ae168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407ae175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407ae15d
cmp eax, 0x7d00
jae 0x1407ae19b
cmp eax, 0x500
jb 0x1407ae196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407ae07e
cmp eax, 0x7f
ja 0x1407ae19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407ae07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407ae1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407ae07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20