joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180025c70
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1800ad0c0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x180025cfe
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x180025ca2
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x180025d10
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1800ad0c0]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x180025e14
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x180025e0f
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x180025de4
cmp qword [rsp + 0x38], 2
jb 0x180025de4
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180025de4
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180025de4
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x180025d57
jmp 0x180025ea6
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x180025ea6
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x180025e7c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180025e7c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180025e7c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x180025e14
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x18005d2f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
movss xmm0, dword [rsp + 0x78]
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rsp + 0x7c]
movss dword [rsp + 0x34], xmm0
movss xmm0, dword [rsp + 0x80]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x84]
movss dword [rsp + 0x3c], xmm0
movzx eax, byte [rsp + 0x88]
test eax, eax
je 0x18005d3cb
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
mov rdi, rax
lea rsi, [rcx + 0x88]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
movss xmm0, dword [rsp + 0x40]
comiss xmm0, dword [rsp + 0x30]
jbe 0x18005d380
movss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rsp + 0x44]
comiss xmm0, dword [rsp + 0x34]
jbe 0x18005d399
movss xmm0, dword [rsp + 0x44]
movss dword [rsp + 0x34], xmm0
movss xmm0, dword [rsp + 0x38]
comiss xmm0, dword [rsp + 0x48]
jbe 0x18005d3b2
movss xmm0, dword [rsp + 0x48]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x3c]
comiss xmm0, dword [rsp + 0x4c]
jbe 0x18005d3cb
movss xmm0, dword [rsp + 0x4c]
movss dword [rsp + 0x3c], xmm0
movss xmm0, dword [rsp + 0x30]
comiss xmm0, dword [rsp + 0x38]
jb 0x18005d3e6
movss xmm0, dword [rsp + 0x30]
movss dword [rsp + 0x20], xmm0
jmp 0x18005d3f2
movss xmm0, dword [rsp + 0x38]
movss dword [rsp + 0x20], xmm0
movss xmm0, dword [rsp + 0x20]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x34]
comiss xmm0, dword [rsp + 0x3c]
jb 0x18005d419
movss xmm0, dword [rsp + 0x34]
movss dword [rsp + 0x24], xmm0
jmp 0x18005d425
movss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x24], xmm0
movss xmm0, dword [rsp + 0x24]
movss dword [rsp + 0x3c], xmm0
mov rax, qword [rsp + 0x70]
add rax, 0x58
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.18006ace0
mov rax, qword [rsp + 0x70]
lea rcx, [rsp + 0x30]
lea rdi, [rax + 0x88]
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x70]
call fcn.180066ca0
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x1800a5cf4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800a5d24
xor eax, eax
jmp 0x1800a5de7
mov rbp, rbx
cmp word [rax], si
je 0x1800a5d49
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800a5d30
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800a5d2c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800a5c14
movsxd r14, eax
test eax, eax
jne 0x1800a5d87
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800a5d1d
mov rcx, r14
call fcn.1800a3a54
mov rdi, rax
test rax, rax
jne 0x1800a5da0
xor ecx, ecx
call fcn.1800a23e0
jmp 0x1800a5d7c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800a5c14
test eax, eax
jne 0x1800a5dd1
mov rcx, rdi
call fcn.1800a23e0
jmp 0x1800a5ddb
xor ecx, ecx
call fcn.1800a23e0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1800a8d40
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800a8d68
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800a8d68
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov ebx, dword [rcx + 0x54]
mov r15, r8
add rbx, rdx
mov rbp, rdx
jmp 0x1400013b1
mov ecx, dword [rbx + 0xc]
add rcx, rbp
call qword [r15]
mov edi, dword [rbx]
mov r14, rax
mov esi, dword [rbx + 0x10]
add rdi, rbp
add rsi, rbp
jmp 0x1400013a7
test rdi, rdi
je 0x140001381
cmp qword [rdi], 0
jge 0x140001381
movsxd rax, dword [r14 + 0x3c]
movzx edx, word [rdi]
mov ecx, dword [rax + r14 + 0x88]
mov eax, dword [rcx + r14 + 0x10]
mov ecx, dword [rcx + r14 + 0x1c]
sub rdx, rax
add rcx, r14
mov eax, dword [rcx + rdx*4]
add rax, r14
jmp 0x140001392
mov rdx, qword [rsi]
mov rcx, r14
add rdx, 2
add rdx, rbp
call qword [r15 + 8]
mov qword [rsi], rax
lea rax, [rdi + 8]
add rsi, 8
test rdi, rdi
cmove rax, rdi
mov rdi, rax
cmp qword [rsi], 0
jne 0x14000134f
add rbx, 0x14
cmp dword [rbx + 0xc], 0
jne 0x140001336
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400014d4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [rcx + 0x18]
mov ebp, r8d
mov esi, edx
mov rcx, qword [rax + 0x20]
jmp 0x140001587
movzx edx, word [rcx + 0x48]
mov r9, qword [rcx + 0x50]
shr dx, 1
xor eax, eax
movzx r8d, word [r9]
ror eax, 0x13
cmp r8d, 0x61
jb 0x140001516
add eax, 0xffffffe0
add eax, r8d
add r9, 2
mov r8d, 0xffff
add dx, r8w
jne 0x140001506
cmp eax, esi
jne 0x140001584
mov r8, qword [rcx + 0x20]
movsxd rax, dword [r8 + 0x3c]
mov r10d, dword [rax + r8 + 0x88]
mov r9d, dword [r10 + r8 + 0x24]
mov edx, dword [r10 + r8 + 0x20]
add r9, r8
add rdx, r8
je 0x140001584
mov ebx, dword [rdx]
add rbx, r8
xor eax, eax
mov r11b, byte [rbx]
ror eax, 0x13
movsx edi, r11b
cmp r11b, 0x61
jl 0x140001569
add eax, 0xffffffe0
inc rbx
add eax, edi
mov r11b, byte [rbx]
test r11b, r11b
jne 0x140001559
cmp eax, ebp
je 0x1400015a7
add r9, 2
add rdx, 4
jne 0x14000154f
mov rcx, qword [rcx]
test rcx, rcx
jne 0x1400014f9
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
mov ecx, dword [r10 + r8 + 0x1c]
movzx edx, word [r9]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x140001592

Function at 0x140001688
Capabilities:
Encode data using xor

Disassembly:
mov r10d, dword [rdx]
mov r9, qword [r8]
add rcx, r10
mov edx, dword [rdx + 8]
mov r8, qword [r8 + 8]
jmp 0x140001688
mov qword [rsp + 8], rbx
xor r10d, r10d
mov rbx, rdx
mov r11, rcx
test rcx, rcx
je 0x1400016c9
test r8, r8
je 0x1400016c9
test r9, r9
je 0x1400016c9
test rdx, rdx
je 0x1400016c2
xor edx, edx
mov rax, r10
div r9
mov cl, byte [rdx + r8]
xor byte [r10 + r11], cl
inc r10
cmp r10, rbx
jb 0x1400016aa
mov eax, 1
jmp 0x1400016cb
xor eax, eax
mov rbx, qword [rsp + 8]
ret
Function at 0x1400016d4
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x100
xor r10d, r10d
mov edi, edx
mov esi, r9d
mov rbp, r8
mov r11, rcx
test rcx, rcx
je 0x1400017f6
test edx, edx
je 0x1400017f6
test r8, r8
je 0x1400017f6
test r9d, r9d
je 0x1400017f6
mov eax, r10d
lea rcx, [rsp]
mov byte [rcx], al
inc eax
inc rcx
cmp eax, 0x100
jl 0x140001728
mov r8d, r10d
lea rbx, [rsp]
mov r9d, r10d
movzx r14d, byte [rbx]
xor edx, edx
mov eax, r9d
div esi
movzx eax, byte [rdx + rbp]
add r8d, eax
add r8d, r14d
and r8d, 0x800000ff
jge 0x14000176b
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rcx, r8d
inc r9d
mov al, byte [rsp + rcx]
mov byte [rbx], al
inc rbx
mov byte [rsp + rcx], r14b
cmp r9d, 0x100
jl 0x140001740
mov r8d, r10d
mov r9, rdi
test edi, edi
je 0x1400017ef
inc r10d
and r10d, 0x800000ff
jge 0x1400017a9
dec r10d
or r10d, 0xffffff00
inc r10d
movsxd rbx, r10d
movzx edi, byte [rsp + rbx]
add r8d, edi
and r8d, 0x800000ff
jge 0x1400017c9
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rdx, r8d
mov cl, byte [rsp + rdx]
mov byte [rsp + rbx], cl
mov byte [rsp + rdx], dil
movzx edx, byte [rsp + rbx]
add rdx, rdi
movzx ecx, dl
mov dl, byte [rsp + rcx]
xor byte [r11], dl
inc r11
sub r9, 1
jne 0x140001790
mov eax, 1
jmp 0x1400017f8
xor eax, eax
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x180014e30
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov edx, dword [rcx + 0x2c]
mov r11, rcx
cmp edx, 0xffffffff
jae 0x180014f10
mov r10d, dword [rcx + 0x34]
inc edx
cmp r10d, dword [rcx + 0x38]
jae 0x180014f10
mov rsi, qword [rcx + 0x18]
lea ebx, [r10 + r10*2]
shl ebx, 2
nop dword [rax]
movzx eax, byte [rbx + rsi + 0x11]
movzx edi, byte [rbx + rsi + 0x10]
movzx r9d, byte [rbx + rsi + 0x14]
movzx r8d, byte [rbx + rsi + 0x18]
lea rcx, [rbx + rsi + 0x14]
shl edi, 8
or edi, eax
movzx eax, byte [rcx - 2]
shl r9d, 8
shl r8d, 8
shl edi, 8
or edi, eax
movzx eax, byte [rcx - 1]
shl edi, 8
or edi, eax
movzx eax, byte [rcx + 1]
or r9d, eax
movzx eax, byte [rcx + 2]
shl r9d, 8
or r9d, eax
movzx eax, byte [rcx + 3]
shl r9d, 8
or r9d, eax
movzx eax, byte [rcx + 5]
or r8d, eax
movzx eax, byte [rcx + 6]
shl r8d, 8
or r8d, eax
movzx eax, byte [rcx + 7]
shl r8d, 8
or r8d, eax
cmp edx, edi
cmovb edx, edi
cmp edx, r9d
ja 0x180014f00
sub r8d, edi
lea eax, [r8 + rdx]
test eax, eax
jne 0x180014f25
inc edx
cmp edx, r9d
jbe 0x180014ef1
inc r10d
add ebx, 0xc
cmp r10d, dword [r11 + 0x38]
jb 0x180014e70
mov byte [r11 + 0x28], 0
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov dword [r11 + 0x2c], edx
mov dword [r11 + 0x30], eax
mov dword [r11 + 0x34], r10d
ret

Function at 0x1800153b0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov eax, dword [rcx + 0x2c]
mov r10, rcx
cmp eax, 0xffffffff
jae 0x180015480
mov r9d, dword [rcx + 0x34]
lea edi, [rax + 1]
cmp r9d, dword [rcx + 0x38]
jae 0x180015480
mov rsi, qword [rcx + 0x18]
lea r11d, [r9 + r9*2]
shl r11d, 2
nop dword [rax + rax]
movzx eax, byte [r11 + rsi + 0x11]
movzx r8d, byte [r11 + rsi + 0x10]
movzx ecx, byte [r11 + rsi + 0x14]
movzx ebx, byte [r11 + rsi + 0x18]
lea rdx, [r11 + rsi + 0x14]
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx - 2]
shl ecx, 8
shl ebx, 8
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx - 1]
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
movzx eax, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
or ebx, eax
movzx eax, byte [rdx + 6]
shl ebx, 8
or ebx, eax
movzx eax, byte [rdx + 7]
shl ebx, 8
or ebx, eax
cmp edi, r8d
cmovb edi, r8d
cmp edi, ecx
ja 0x18001546f
test ebx, ebx
jne 0x180015495
inc r9d
add r11d, 0xc
cmp r9d, dword [r10 + 0x38]
jb 0x1800153f0
mov byte [r10 + 0x28], 0
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rsi, qword [rsp + 0x10]
mov dword [r10 + 0x2c], edi
mov rdi, qword [rsp + 0x18]
mov dword [r10 + 0x30], ebx
mov rbx, qword [rsp + 8]
mov dword [r10 + 0x34], r9d
ret
Function at 0x180022590
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
mov rsi, qword [rcx]
mov r12, qword [rsp + 0x30]
mov rbx, r9
movzx edi, word [r12]
sub edx, esi
mov r10, r8
mov eax, edx
mov rbp, rcx
cmp r9, rax
cmova rbx, rax
xor r11d, r11d
test rbx, rbx
je 0x180022614
mov r9, rsi
sub r9, r8
nop word [rax + rax]
movzx eax, byte [r9 + r10]
mov r8d, edi
mov ecx, 0x58bf
lea edx, [rax + rdi]
shr r8d, 8
inc r11d
xor r8d, eax
inc r10
mov byte [r10 - 1], r8b
imul edx, edx, 0x3193
sub ecx, edx
movzx edi, cx
mov ecx, r11d
cmp rcx, rbx
jb 0x1800225e0
lea rcx, [rsi + rbx]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov qword [rbp], rcx
mov rbp, qword [rsp + 0x18]
mov word [r12], di
mov rdi, qword [rsp + 0x28]
mov eax, r11d
pop r12
ret
Function at 0x180052b30
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1801c1080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov esi, edx
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180052b99
xorps xmm0, xmm0
mov qword [rsp + 0x34], 0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
movdqu xmmword [rsp + 0x24], xmm0
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x180052bb8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801027e0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180052c07
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, dword [rsp + 0x28]
cmp r8d, eax
je 0x180052c07
xor edx, edx
mov ecx, 0x1f03ff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x180052b99
mov rcx, rax
test esi, esi
je 0x180052bf8
call qword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x180052bfe
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180052bb8
mov eax, 1
jmp 0x180052b9b
Function at 0x180052d80
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1801c1080]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rsi, rcx
test edx, edx
je 0x180052ffa
cmp edx, 1
jne 0x180053007
call fcn.180052c30
mov qword [0x1801cad58], rsi
lea rax, str.WeaselRoot
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x38]
call fcn.180059380
nop
mov edi, 0x104
cmp qword [rsp + 0x48], 0
jne 0x180052e5d
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x80]
call fcn.1801099b0
mov r8d, edi
lea rdx, [rsp + 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rax, [rsp + 0x80]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180052e40
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x38]
call fcn.18004f440
lea r8, str._bugreport64.exe
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.180053120
xor ebp, ebp
cmp qword [rsp + 0x48], rbp
jne 0x180052e80
mov ebx, ebp
jmp 0x180052e91
lea rbx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rbx, qword [rsp + 0x58]
lea rcx, [0x1801d1450]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x1801d1448], bpl
jne 0x180052fc3
mov byte [0x1801d1448], 1
mov qword [0x1801cb5e8], rsi
test rbx, rbx
je 0x180052eca
mov r8, rbx
lea rcx, [0x1801d1040]
jmp 0x180052f16
mov r8d, edi
lea rdx, [0x1801d1040]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x5c
lea rcx, [0x1801d1040]
call fcn.180108e9c
mov rcx, rax
test rax, rax
je 0x180052fc3
lea rdx, [0x1801cb5e0]
sub rax, rdx
sub rax, 0x5a60
sar rax, 1
sub rdi, rax
lea r8, str._bugreport64.exe
mov r9, 0xffffffffffffffff
mov rdx, rdi
call fcn.1801163f0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r9, 0xffffffffffffffff
mov r8, rax
mov edx, 0x1000
lea rcx, [0x1801cbaf0]
call fcn.1801163f0
mov r9, 0xffffffffffffffff
lea r8, [0x180178270]
lea edx, [r9 + 0x41]
lea rcx, [0x1801d0f40]
call fcn.1801163f0
mov r9, 0xffffffffffffffff
lea r8, [0x180179828]
lea edx, [r9 + 0x41]
lea rcx, [0x1801d0fc0]
call fcn.1801163f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
lea r8, str.bdbugreport__u
mov rdx, 0xffffffffffffffff
lea rcx, [0x1801d1248]
call fcn.180053040
lea rbx, [0x1800526a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
cmp rax, rbx
cmove rax, rbp
mov qword [0x1801cb5e0], rax
lea rcx, [0x1801d1450]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x58]
call fcn.18004f5d0
nop
lea rcx, [rsp + 0x38]
call fcn.18004f5d0
xor edx, edx
lea rcx, [0x1801cad60]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x180053007
jmp 0x18005300c
lea rcx, [0x1801cad60]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1801027e0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180054700
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x40
mov rbp, r9
mov r14, r8
mov r15, rcx
call fcn.1800505d0
test eax, eax
je 0x180054889
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
lea rdi, [r15 + 0x78]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetKeyboardState]
movzx eax, byte [rdi + 0x14]
movsx edx, byte [rdi + 0x10]
sar edx, 0x1f
and edx, 0x10000
mov ecx, edx
bts ecx, 0x11
and al, 1
cmove ecx, edx
mov eax, ecx
bts eax, 0x12
cmp byte [rdi + 0x11], 0
cmovge eax, ecx
mov ecx, eax
bts ecx, 0x13
cmp byte [rdi + 0x12], 0
cmovge ecx, eax
mov eax, ecx
bts eax, 0x1e
test ebp, ebp
cmovns eax, ecx
mov ebx, eax
cmp r14d, 0x14
jne 0x18005478d
test ebp, ebp
js 0x18005478d
btc ebx, 0x11
mov edx, ebp
mov ecx, r14d
call fcn.1800595b0
and ebx, 0xffff0000
xor esi, esi
test eax, eax
je 0x1800547ab
movzx eax, ax
jmp 0x180054850
lea rax, [0x1801d14a0]
mov ecx, 2
nop word [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rdi]
lea rdi, [rdi + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [rdi - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [rdi - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [rdi - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [rdi - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [rdi - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [rdi - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [rdi - 0x10]
movups xmmword [rax - 0x10], xmm1
sub rcx, 1
jne 0x1800547c0
mov qword [rsp + 0x30], rsi
lea r9, [0x1801d15a0]
mov dword [rsp + 0x28], esi
lea r8, [0x1801d14a0]
mov edx, ebp
mov dword [rsp + 0x20], 8
mov ecx, r14d
mov word [0x1801d14b1], si
call qword [sym.imp.USER32.dll_ToUnicodeEx]
cmp eax, 1
jne 0x180054870
movzx eax, word [0x1801d15a0]
mov rcx, qword [r15 + 0x1e0]
or ebx, eax
mov r8d, ebx
mov edx, 0x8004
mov r9d, dword [rcx]
call fcn.18007b2f0
test rax, rax
setne sil
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov dword [rax], esi
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x180054f60
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rsi, rdx
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x180054f8b
mov edi, 0x6a
jmp 0x180054f98
movzx eax, byte [rbx + 0x38]
neg al
sbb rdi, rdi
add rdi, 0x66
mov ecx, 0x32
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x31
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov rcx, qword [0x1801cad58]
mov r8d, 1
mov r9d, eax
mov dword [rsp + 0x28], 0x8000
mov rdx, rdi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_LoadImageW]
mov rbx, qword [rsp + 0x40]
xor ecx, ecx
test rax, rax
mov qword [rsi], rax
mov rsi, qword [rsp + 0x48]
mov edx, 0x80004005
cmove ecx, edx
mov eax, ecx
add rsp, 0x30
pop rdi
ret