joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140167c2c
Capabilities:
Receive http response

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rsi, rdx
mov rbx, rcx
xor r13d, r13d
cmp byte [rcx + 0x84], r13b
je 0x140167c7a
mov eax, dword [rcx + 0xe8]
mov dword [rdx], eax
mov rax, qword [rcx + 0xf0]
mov qword [rdx + 8], rax
jmp 0x140167e0c
cmp byte [rcx + 0x21], r13b
jne 0x140167ca1
mov edi, 6
mov dword [rbp - 0x58], edi
mov qword [rbp - 0x50], r13
add rcx, 0xc0
lea r8, [rbp - 0x58]
call fcn.140158810
jmp 0x140167e0c
lea r12, [rcx + 0x68]
mov rax, qword [r12]
mov qword [r12 + 8], rax
mov dword [rcx + 0x80], r13d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r13
mov r14d, r13d
mov dword [rbp + 0x40], r13d
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x140167dd6
lea rdx, [rbp + 0x40]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
setne al
test al, al
je 0x140167cf6
mov dword [rbp - 0x58], r13d
mov qword [rbp - 0x50], r13
lea rax, [rbp - 0x58]
jmp 0x140167d07
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp - 0x38]
call fcn.140160084
mov edi, dword [rax]
mov r15, qword [rax + 8]
test edi, edi
jne 0x140167dde
mov eax, dword [rbp + 0x40]
lea r8, [rbp - 0x18]
lea rcx, [rbp - 0x18]
test eax, eax
je 0x140167d8e
lea edx, [r14 + rax]
call fcn.14006dc50
mov dword [rbp + 0x50], r13d
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x140167dd6
mov edx, r14d
add rdx, qword [rbp - 0x18]
lea r9, [rbp + 0x50]
mov r8d, dword [rbp + 0x40]
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
setne al
test al, al
je 0x140167d6a
mov dword [rbp - 0x48], r13d
mov qword [rbp - 0x40], r13
lea rax, [rbp - 0x48]
jmp 0x140167d7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp - 0x28]
call fcn.140160084
mov edi, dword [rax]
mov r15, qword [rax + 8]
test edi, edi
jne 0x140167dde
add r14d, dword [rbp + 0x50]
jmp 0x140167cc4
mov edx, r14d
call fcn.14006dc50
lea rax, [rbp - 0x18]
cmp r12, rax
je 0x140167dcd
mov rcx, r12
call fcn.140034a70
mov rax, qword [rbp - 0x18]
mov qword [r12], rax
mov rax, qword [rbp - 0x10]
mov qword [r12 + 8], rax
mov rax, qword [rbp - 8]
mov qword [r12 + 0x10], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r13
mov dword [rbx + 0x80], r14d
jmp 0x140167dde
mov r15, r13
mov edi, 6
mov byte [rbx + 0x84], 1
lea r8, [rbx + 0xe8]
mov dword [r8], edi
mov qword [r8 + 8], r15
lea rcx, [rbx + 0xc0]
mov rdx, rsi
call fcn.140158810
nop
lea rcx, [rbp - 0x18]
call fcn.140034a70
mov rax, rsi
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14016d200
Capabilities:
Set http header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbp, rdx
mov rdx, qword [rcx + 0x78]
lea rcx, [rax - 0x28]
call fcn.14016c9e4
lea rcx, [rsp + 0x20]
call fcn.14017118c
test al, al
je 0x14016d2d6
mov rsi, qword [rsp + 0x28]
test rsi, rsi
je 0x14016d2d6
mov edi, dword [rsp + 0x30]
cmp edi, 1
jbe 0x14016d2d6
add edi, 0xb
xor edx, edx
mov ecx, edi
add rcx, rcx
call fcn.140070918
mov rbx, rax
test rax, rax
je 0x14016d2d6
test edi, edi
jle 0x14016d282
movsxd rdx, edi
lea r8, str.Cookie:
or r9, 0xffffffffffffffff
mov rcx, rax
call fcn.14023a4c8
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call fcn.140031534
mov r8d, edi
lea rcx, [0x1402c1320]
mov rdx, rbx
call fcn.140031534
mov r9d, 0xa0000000
or r8d, 0xffffffff
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x14016d2ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edi, eax
call fcn.140070920
jmp 0x14016d2d8
mov rcx, rbx
call fcn.140070920
xor edi, edi
lea rcx, [rsp + 0x20]
call fcn.14016cb0c
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1401738b4
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
xor r9d, r9d
mov rdx, rcx
test rcx, rcx
jne 0x1401738c3
or eax, 0xffffffff
ret
movzx eax, word [rdx]
mov ecx, 0x1505
test ax, ax
je 0x1401738e8
mov r8, r9
imul ecx, ecx, 0x21
inc r8
movzx eax, ax
xor ecx, eax
movzx eax, word [rdx + r8*2]
test ax, ax
jne 0x1401738d3
imul eax, ecx, 0x41c64e6d
imul ecx, ecx, 0x10dcd
add eax, 0x3039
inc ecx
shr eax, 0x10
and ecx, 0xffff0000
or eax, ecx
ret
Function at 0x140177c44
Capabilities:
Get file size

Disassembly:
mov r11, rsp
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [r11 - 0x20], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rsi, r9
mov ebp, r8d
mov r14, rdx
mov rbx, rcx
movzx r15d, r8w
cmp r15d, 4
jae 0x140177d73
mov eax, r8d
and eax, 0xffff0000
mov ecx, 0x7f0000
or eax, ecx
cmp eax, ecx
jne 0x140177d73
lea rdx, [r11 - 0x28]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140177cc2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jne 0x140177d78
mov rax, qword [rsp + 0x20]
test rax, rax
jns 0x140177cd6
mov edi, 0x8000ffff
jmp 0x140177d78
xor edi, edi
xor ecx, ecx
test r15d, r15d
setne cl
mov dword [rbx + 0x30], ecx
mov ecx, ebp
and ecx, 0x100000
mov dword [rbx + 0x34], ecx
mov qword [rbx + 0x70], rax
mov rcx, qword [rbx + 0x28]
cmp rcx, 0xffffffffffffffff
sete al
test al, al
jne 0x140177d0c
or qword [rbx + 0x28], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x28], r14
cmp qword [rbx + 0xc0], rsi
je 0x140177d58
test rsi, rsi
je 0x140177d2f
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 8]
call qword [case.0x14002a211.0]
nop
mov rcx, qword [rbx + 0xc0]
test rcx, rcx
je 0x140177d51
and qword [rbx + 0xc0], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14002a211.0]
nop
mov qword [rbx + 0xc0], rsi
bt ebp, 0x11
jb 0x140177d78
xor r8d, r8d
xor edx, edx
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov byte [rbx + 0x68], 1
jmp 0x140177d78
mov edi, 0x80070057
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140177d94
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x38], 0
mov rbx, rcx
je 0x140177ddb
mov rcx, qword [rcx + 0x28]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140177dcd
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jne 0x140177ddb
mov rax, qword [rsp + 0x30]
test rax, rax
js 0x140177ddb
mov qword [rbx + 0x70], rax
mov rax, qword [rbx + 0x70]
add rsp, 0x20
pop rbx
ret
Function at 0x140178048
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0xa0
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r14d, r9d
mov rsi, rdx
mov rdi, rcx
call fcn.140177d94
mov r15, rax
xor r13b, r13b
mov rdx, qword [rbp + 0x7f]
lea rcx, [rbp - 0x29]
call fcn.140180354
lea rax, [0x1402e10f0]
mov qword [rbp - 0x29], rax
mov edx, 0x10000
mov r12d, edx
cmp r14d, edx
cmovb r12d, r14d
mov rax, qword [rbp + 0x77]
mov qword [rbp - 1], rax
and dword [rbp + 0xf], 0
mov eax, r14d
mov edx, 1
test r14d, r14d
cmove eax, edx
mov qword [rbp + 7], rax
lea rcx, [rsi + r14]
mov qword [rbp + 0x5f], rcx
lea rax, [r15 + 0x10000]
cmp rcx, rax
jbe 0x14017811d
cmp qword [rbp - 0x21], 0
je 0x1401780f6
lea rcx, [rbp - 0x29]
call fcn.1401803fc
mov ebx, eax
mov rcx, qword [rbp + 0x5f]
jmp 0x1401780f8
xor ebx, ebx
test ebx, ebx
js 0x14017821c
mov rax, qword [rdi]
mov r8, qword [rbp + 0x7f]
mov rdx, rcx
mov rcx, rdi
mov rax, qword [rax + 0x30]
call qword [case.0x14002a211.0]
test eax, eax
setns r13b
mov dword [rbp - 0x41], esi
mov rax, rsi
shr rax, 0x20
mov dword [rbp - 0x3d], eax
and qword [rbp - 0x39], 0
cmp qword [rbp - 0x21], 0
je 0x140178143
lea rcx, [rbp - 0x29]
call fcn.1401803fc
mov ebx, eax
jmp 0x140178145
xor ebx, ebx
test ebx, ebx
js 0x1401781ff
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f]
mov r8d, r12d
mov rdx, qword [rbp + 0x67]
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rdi + 0x34], 0
je 0x140178199
test eax, eax
jne 0x1401781b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x14017819d
mov r9b, 1
lea r8, [rbp + 0x6f]
lea rdx, [rbp - 0x51]
mov rcx, qword [rdi + 0x28]
call fcn.14004577c
movzx eax, al
test eax, eax
jne 0x1401781b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jne 0x1401781ff
mov ecx, dword [rbp + 0x6f]
sub r14d, ecx
mov rax, qword [rbp + 0x77]
add dword [rax], ecx
add qword [rbp + 0x67], rcx
add rsi, rcx
mov rax, rsi
cmp r15, rsi
cmova rax, r15
mov r15, rax
cmp r12d, ecx
jne 0x1401781fa
xor ebx, ebx
test r14d, r14d
je 0x1401781f5
mov eax, 0x10000
mov r12d, eax
cmp r14d, eax
cmovb r12d, r14d
jmp 0x14017811d
xor r13b, r13b
jmp 0x1401781ff
mov ebx, 0x80004005
test r13b, r13b
je 0x14017821c
mov rax, qword [rdi]
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
mov rax, qword [rax + 0x30]
call qword [case.0x14002a211.0]
jmp 0x140178220
mov qword [rdi + 0x70], r15
lea rax, [0x1402e10c8]
mov qword [rbp - 0x29], rax
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140178247
and qword [rbp - 0x21], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14002a211.0]
nop
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14017e6f8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x14017e730
mov rax, qword [r9 + 0x30]
and rax, rcx
mov rdi, qword [r9 + 8]
mov r8, rax
add r8, r8
mov rcx, qword [r9 + 0x18]
cmp rdi, qword [rcx + r8*8]
je 0x14017e7c8
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rcx + r8*8]
je 0x14017e7c8
mov edx, dword [r10]
add rax, rax
mov rdi, qword [rdi + 8]
cmp edx, dword [rdi + 0x10]
je 0x14017e78f
cmp rdi, qword [rcx + rax*8]
jne 0x14017e77e
jmp 0x14017e7c8
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rbx + 0x18]
call fcn.14000c764
mov rcx, rbx
call fcn.140210c50
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14017e85c
mov rax, qword [rbx]
cmp rdi, rax
je 0x14017e7fd
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x14017e81a
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14017e849
cmp rax, rdi
jne 0x14017e825
mov qword [rdx + r8*8], rbx
jmp 0x14017e849
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14017e849
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.14017edb8
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14017eb28
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1403c9cb8]
xor rax, rsp
mov qword [rbp - 8], rax
mov ebx, r8d
movsxd rsi, edx
mov rdi, rcx
call fcn.140034888
test al, al
je 0x14017ebf2
movups xmm0, xmmword [0x140304640]
movups xmmword [rbp - 0x18], xmm0
test ebx, ebx
je 0x14017eb87
sub ebx, 1
je 0x14017eb7e
cmp ebx, 1
jne 0x14017ec18
movups xmmword [rbp - 0x18], xmm0
jmp 0x14017eb93
movups xmm0, xmmword [0x140304610]
jmp 0x14017eb8e
movups xmm0, xmmword [0x140304620]
movdqu xmmword [rbp - 0x18], xmm0
and qword [rbp - 0x20], 0
lea r9, [rbp - 0x20]
xor r8d, r8d
lea rcx, [rbp - 0x18]
mov edx, 0x4e000
call sub.SHELL32.dll_SHGetKnownFolderPath
mov ebx, eax
test eax, eax
jns 0x14017ebcb
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14017ebc7
and qword [rbp - 0x20], 0
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, ebx
jmp 0x14017ebff
mov r8, qword [rbp - 0x20]
mov rdx, rsi
mov rcx, rdi
call fcn.14023c530
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14017ebee
and qword [rbp - 0x20], 0
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
jmp 0x14017ebff
mov r8d, ebx
mov edx, esi
mov rcx, rdi
call fcn.14017ead8
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14020ed60
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
mov ecx, 0x14994dc
call fcn.1400235f8
int3

Function at 0x14017ec28
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push r15
sub rsp, 0x40
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov sil, r9b
movsxd rbx, r8d
mov r14d, edx
mov rdi, rcx
cmp edx, 0x104
jge 0x14017ec6a
xor edx, edx
mov ecx, 0x3ca4d3
call fcn.1400235f8
int3
xor r15d, r15d
mov word [rcx], r15w
test r8d, r8d
jns 0x14017ec83
xor edx, edx
mov ecx, 0x3ca4d4
call fcn.1400235f8
int3
cmp ebx, 0x27
ja 0x14017ec98
movabs rcx, 0x8814010060
bt rcx, rbx
jb 0x14017eca3
mov ecx, 0x3ca4d6
call fcn.1401e41d8
nop
mov r9d, r14d
mov r8, rdi
mov edx, ebx
lea rcx, [0x1403d6790]
call fcn.14017e9c0
test eax, eax
je 0x14017ed15
cmp eax, 2
jne 0x14017ecc7
mov eax, 0x80004005
jmp 0x14017ed15
mov eax, ebx
bts eax, 0xf
mov edx, ebx
test sil, sil
cmovne edx, eax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test eax, eax
js 0x14017ed15
mov edx, r14d
mov rcx, rdi
call fcn.14003d7fc
nop
mov r8, rdi
mov edx, ebx
lea rcx, [0x1403d6790]
call fcn.14017e90c
nop
mov eax, esi
jmp 0x14017ed15
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret
Function at 0x14017ef14
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
movzx eax, byte [r9 + rdi + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, 4
jb 0x14017ef39
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14017ef91
cmp qword [rcx + rdx*8], rdi
jne 0x14017ef86
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x14017ef8a
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14017ef9e
cmp qword [rcx + rdx*8], rdi
jne 0x14017ef9e
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x18]
dec qword [r8 + 0x10]
call fcn.14000c764
mov rcx, rdi
call fcn.140210c50
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140180ae4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
and dword [r9], 0
mov r14, r9
mov rdi, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x140180b44
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140180b44
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140180b44
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [r14], eax
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov rax, r9
mov rdx, r8
mov r9, qword [rsp + 0x28]
mov r8, rax
jmp 0x140180ae4
Function at 0x140188614
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
and dword [r9], 0
mov r14, r9
mov rdi, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x140180b44
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140180b44
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140180b44
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [r14], eax
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov rax, r9
mov rdx, r8
mov r9, qword [rsp + 0x28]
mov r8, rax
jmp 0x140180ae4

Function at 0x140188758
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x48
lea eax, [rdx + rdx]
mov r9d, 2
mov dword [rsp + 0x58], eax
lea r8, str.office.odf
lea rax, [r11 + 0x10]
mov qword [r11 - 0x18], rax
lea rdx, str.SoftwareMicrosoftOffice16.0CommonFilesPaths
mov qword [r11 - 0x20], rcx
mov rcx, 0xffffffff80000002
and qword [r11 - 0x28], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
sete al
add rsp, 0x48
ret
Function at 0x140198a18
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
test byte [0x1403d1ac0], 0x20
mov rbx, rcx
je 0x140198a42
mov r9d, r8d
lea rcx, [0x1403c1580]
mov r8d, edx
lea rdx, [0x1402b5418]
call fcn.14019bf34
mov ecx, 0x1c135e
call fcn.1401e41d8
prefetchw byte [rbx + 0x10]
mov rax, qword [rbx + 0x10]
mov r8d, 0x7f000
mov qword [rsp + 0x30], rax
mov edx, dword [rsp + 0x30]
mov ecx, edx
shr ecx, 0xc
dec ecx
shl ecx, 0xc
xor ecx, edx
and ecx, r8d
xor edx, ecx
mov dword [rsp + 0x30], edx
mov rcx, qword [rsp + 0x30]
lock cmpxchg qword [rbx + 0x10], rcx
je 0x140198ab2
mov edx, eax
mov qword [rsp + 0x30], rax
shr edx, 0xc
mov rcx, rax
dec edx
shl edx, 0xc
xor edx, eax
and edx, r8d
xor edx, eax
mov dword [rsp + 0x30], edx
mov rdx, qword [rsp + 0x30]
lock cmpxchg qword [rbx + 0x10], rdx
cmp rax, rcx
jne 0x140198a85
add rsp, 0x20
pop rbx
ret
Function at 0x14019dad8
Capabilities:
Encode data using xor

Disassembly:
prefetchw byte [rcx + 0x20]
mov edx, dword [rcx + 0x20]
mov r8d, edx
mov eax, edx
and r8d, 0xffffc000
add r8d, 0x4000
xor r8d, edx
and r8d, 0xfffc000
xor edx, r8d
lock cmpxchg dword [rcx + 0x20], edx
mov edx, eax
jne 0x14019dadf
ret

Function at 0x14019f140
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
and qword [rsp + 0x58], 0
mov rbx, rcx
cmp byte [rcx + 0x10], 0
je 0x14019f165
mov edi, 0x80004005
jmp 0x14019f27b
mov eax, dword [rcx + 0x58]
cmp eax, dword [rcx + 0x54]
ja 0x14019f194
lea edx, [rax + 5]
add rcx, 0x48
shl rdx, 3
call fcn.140070928
test rax, rax
jne 0x14019f18c
mov edi, 0x8007000e
jmp 0x14019f27b
add dword [rbx + 0x58], 5
mov qword [rbx + 0x48], rax
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.14019f28c
mov edi, eax
test eax, eax
js 0x14019f24d
cmp qword [rbx + 0x60], 0
jne 0x14019f1bc
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rbx + 0x60], rax
mov rsi, qword [rsp + 0x58]
lock inc dword [rsi + 0xc24]
mov rbp, qword [rsp + 0x58]
lea r8, [0x14019f830]
mov r9, rbp
xor edx, edx
xor ecx, ecx
lea rax, [rbp + 0xbf8]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14019f228
or eax, 0xffffffff
lock xadd dword [rsi + 0xc24], eax
mov rbx, qword [rsp + 0x58]
cmp eax, 1
jne 0x14019f221
test rbx, rbx
je 0x14019f221
mov rcx, rbx
call fcn.14019ec40
mov rcx, rbx
call fcn.140070920
mov edi, 0x80004005
jmp 0x14019f252
mov qword [rbp + 0xbf0], rax
mov ecx, dword [rbx + 0x54]
mov rax, qword [rbx + 0x48]
mov qword [rax + rcx*8], rbp
mov eax, 0x3e
inc dword [rbx + 0x54]
and qword [rsp + 0x58], 0
lock xadd dword [rbx + 0x50], eax
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x14019f27b
or eax, 0xffffffff
lock xadd dword [rbx + 0xc24], eax
cmp eax, 1
jne 0x14019f27b
mov rcx, qword [rsp + 0x58]
call fcn.14019ec40
mov rcx, qword [rsp + 0x58]
call fcn.140070920
mov eax, edi
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401a38a0
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1403c9cb8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x38], rcx
test dl, dl
je 0x1401a38d4
mov edx, 1
mov dword [rbp - 0x3c], 0x20
mov dword [rbp - 0x40], edx
jmp 0x1401a38ff
mov qword [rbp - 0x40], 0x20001
mov edx, 3
mov qword [rbp - 0x30], 0x60001
mov qword [rbp - 0x28], rcx
mov dword [rbp - 0x20], 0xd
mov dword [rbp - 0x1c], 0x20
mov qword [rbp - 0x18], rcx
mov r8d, 0x10
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
setne al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14020ed60
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1401d6c1c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push r12
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r14, rdx
mov r15, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
inc rdx
cmp rdx, 4
jb 0x1401d6c53
mov rax, qword [r15 + 0x30]
and rax, rcx
lea r12, [r15 + 8]
mov rbx, qword [r12]
mov rsi, rax
add rsi, rsi
mov rcx, qword [r15 + 0x18]
cmp rbx, qword [rcx + rsi*8]
je 0x1401d6cc6
mov rbx, qword [rcx + rsi*8 + 8]
mov rbx, qword [rbx]
cmp rbx, qword [rcx + rsi*8]
je 0x1401d6cc6
mov edx, dword [r8]
add rax, rax
mov rbx, qword [rbx + 8]
cmp edx, dword [rbx + 0x10]
je 0x1401d6cb6
cmp rbx, qword [rcx + rax*8]
jne 0x1401d6ca5
jmp 0x1401d6cc6
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x1401d6d76
mov rdx, qword [r12]
mov rdx, qword [rdx]
mov rcx, r12
call fcn.1400b91b0
mov rdi, qword [r12]
mov rdi, qword [rdi]
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x1401d6d16
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + rsi*8]
cmp rax, qword [r12]
jne 0x1401d6d33
mov qword [rdx + rsi*8], rdi
mov rax, qword [r15 + 0x18]
mov qword [rax + rsi*8 + 8], rdi
jmp 0x1401d6d62
cmp rax, rbx
jne 0x1401d6d3e
mov qword [rdx + rsi*8], rdi
jmp 0x1401d6d62
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rdi
je 0x1401d6d62
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r15
call fcn.1401d7d68
nop
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret