joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002b50
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000ab10]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140002b6f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002b78
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002b90
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000ab10]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002bb0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002bb8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002bb0
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140002bb0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140002c04
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002c10
add rdx, 0x28
cmp rdx, r9
jne 0x140002bf0
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002c20
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x14000ab10]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002c42
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002c50
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002c42
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002c42
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140002c42
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140002ca5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140002cb8
add rdx, 0x28
cmp r10, rdx
jne 0x140002c90
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140002cc7
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140002cd7
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140002cae
test ecx, ecx
jg 0x140002cc0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140003180
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rbp
push r14
sub rsp, 0x2a8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor edx, edx
mov r14, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14000338e
mov qword [rsp + 0x2c0], rbx
mov qword [rsp + 0x2c8], rsi
mov qword [rsp + 0x2d0], rdi
mov qword [rsp + 0x2a0], r15
xor r15d, r15d
nop dword [rax + rax]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x238
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140003365
nop
mov rdi, qword [r14]
mov rsi, qword [r14 + 8]
cmp rdi, rsi
je 0x140003312
xorps xmm0, xmm0
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x7c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], r15w
jne 0x140003230
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x28]
call fcn.1400079b0
cmp qword [rdi + 0x18], 7
mov rax, rdi
jbe 0x140003256
mov rax, qword [rdi]
mov r10, qword [rsp + 0x40]
lea r8, [rsp + 0x28]
mov r9, qword [rsp + 0x28]
cmp r10, 7
mov rdx, qword [rsp + 0x38]
cmova r8, r9
cmp rdx, qword [rdi + 0x10]
jne 0x140003298
test rdx, rdx
je 0x140003294
sub r8, rax
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x140003298
add rax, 2
sub rdx, 1
jne 0x140003280
mov bl, 1
jmp 0x14000329a
xor bl, bl
cmp r10, 7
jbe 0x1400032d5
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x1400032cd
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000335e
mov rcx, r9
call fcn.1400091ec
test bl, bl
je 0x140003305
mov r8d, dword [rsp + 0x58]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140003305
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 0x20
cmp rdi, rsi
jne 0x140003210
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140003200
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], 1
call fcn.140006e10
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400031e0
jmp 0x14000336e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x2d0]
mov rsi, qword [rsp + 0x2c8]
mov rbx, qword [rsp + 0x2c0]
mov r15, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400090c0
add rsp, 0x2a8
pop r14
pop rbp
ret
Function at 0x140008bbc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140008bf6
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140008bfb
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140008c44
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14000b4e0]
cmp byte [rcx + rax], 0
je 0x140008c44
dec r8
sub rdx, 1
jne 0x140008c2a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140009d34
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009d7e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009d7e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009d7e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009d7e
cmp dword [rcx + 0x84], 0xe
jbe 0x140009d7e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140009d80
xor al, al
add rsp, 0x28
ret
Function at 0x140004884
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [0x140020514]
cmp r15, 1
jne 0x140004953
push qword [0x140020604]
pop rcx
call fcn.14000dd04
mov r15, rax
and r15, r15
jle 0x1400048e9
mov rcx, qword [0x140020604]
call fcn.14000dd0c
mov rcx, qword [0x140020604]
call fcn.14000dd20
or rax, rax
je 0x1400048e9
mov rbp, qword [0x14002060c]
push qword [rbp + 0x10]
pop rcx
call fcn.14000e1bc
jmp 0x1400048c6
push qword [0x1400205f4]
pop rcx
call fcn.14000dd04
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004953
push 5
push 0
push 1
push qword [0x1400205f4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009060
mov rcx, qword [0x1400205f4]
call fcn.14000dd0c
mov rcx, qword [0x1400205f4]
call fcn.14000dd20
or rax, rax
je 0x140004953
mov rbp, qword [0x1400205fc]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x140004930
mov rax, 1
jmp 0x14000495f
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006b38
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add byte [rsi + 0x1a291590], 0x49
mov es, word [rsi + 0x5d]
pop rsp
clc
mov ch, 0x44
push 0xffffffffffffffcd
jg 0x14003f6cc
invalid
xchg esp, ecx
sbb al, 0xc3
ret
sub dword [rcx], 0xd5786d33
mov byte [rax + 0x6a311852], ah
mov fs, edx
push rcx
cwde
invalid
mov cl, 0xb0
scasd eax, dword [rdi]
lea ebp, [rcx - 0x7e]
in al, 0x41
add ebx, dword [rcx + 0x1fc5c395]
invalid
push rbx
mov bpl, 0x18
xor eax, 0xf91cce9e
sbb byte [0x13920c570], dh
cmc
invalid
invalid
add al, al
invalid
out dx, eax
xor dword [rdx], ebx
imul edi, dword [rax - 0x5c39e7a8], 0xab9b2be5
lodsb al, byte [rsi]
invalid
add esi, ebx
invalid
invalid
Function at 0x18000ccf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, qword [rdx + 0x20]
mov r11, qword [rdx + 0x28]
lea r10, [r11 + 1]
mov qword [rdx + 0x28], r10
mov al, 1
cmp r10, rsi
jae 0x18000cd30
mov rax, qword [rdx + 0x18]
movzx edi, byte [rax + r10]
mov al, 1
cmp edi, 0x2b
je 0x18000cd25
cmp edi, 0x2d
jne 0x18000cd30
xor eax, eax
add r11, 2
mov qword [rdx + 0x28], r11
mov r10, r11
cmp r10, rsi
jae 0x18000cecf
mov rdi, qword [rdx + 0x18]
movzx r11d, byte [rdi + r10]
lea rbx, [r10 + 1]
mov qword [rdx + 0x28], rbx
add r11b, 0xd0
cmp r11b, 0xa
jae 0x18000cf22
movzx r11d, r11b
cmp rbx, rsi
jae 0x18000cdcd
mov ebx, 1
sub rbx, rsi
add r10, 2
jmp 0x18000cd8c
movzx esi, sil
lea r11d, [r11 + r11*4]
lea r11d, [rsi + r11*2]
lea rsi, [rbx + r10]
inc rsi
inc r10
cmp rsi, 2
je 0x18000cdcd
movzx esi, byte [rdi + r10 - 1]
add sil, 0xd0
cmp sil, 0xa
jae 0x18000cdcd
mov qword [rdx + 0x28], r10
cmp r11d, 0xccccccb
jle 0x18000cd70
cmp r11d, 0xccccccc
jne 0x18000cdb8
cmp sil, 7
jbe 0x18000cd70
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
call fcn.18006c850
jmp 0x18000cebc
mov r10d, dword [rsp + 0x80]
test al, al
je 0x18000cdea
lea eax, [r10 + r11]
sar eax, 0x1f
add eax, 0x80000000
add r10d, r11d
jmp 0x18000cdfa
xor eax, eax
cmp r10d, r11d
setns al
add eax, 0x7fffffff
sub r10d, r11d
cmovo r10d, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x180072a20]
subpd xmm1, xmmword [0x180072a30]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jb 0x18000ce6c
xorpd xmm1, xmm1
movsd xmm2, qword [0x180072a40]
nop dword [rax + rax]
ucomisd xmm0, xmm1
jne 0x18000ce48
jnp 0x18000cea5
test r10d, r10d
jns 0x18000cef8
divsd xmm0, xmm2
add r10d, 0x134
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jae 0x18000ce40
mov eax, eax
mov r9, qword [0x18009f088]
movsd xmm1, qword [r9 + rax*8]
test r10d, r10d
js 0x18000cec4
mulsd xmm0, xmm1
movq rax, xmm0
movabs r9, 0x7fffffffffffffff
and r9, rax
movabs rax, 0x7ff0000000000000
cmp r9, rax
je 0x18000cef8
test r8b, r8b
jne 0x18000ceb2
xorpd xmm0, xmmword [0x180072a50]
movsd qword [rcx + 8], xmm0
xor eax, eax
mov qword [rcx], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x18000ceaa
jmp 0x18000ceb2
mov qword [rsp + 0x28], 5
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.18006c900
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x18000cebc
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.18006c900
mov rcx, rsi
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x18000ceb9
mov qword [rsp + 0x28], 0xd
jmp 0x18000ced8
Function at 0x18001d7d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov ebx, edx
mov rdi, rcx
test dl, dl
je 0x18001d805
movzx eax, bl
lea ecx, [rax + 0x2f6]
add eax, 0x19c
and eax, ecx
shr eax, 8
inc al
cmp al, 1
jbe 0x18001d7fd
xor esi, esi
jmp 0x18001d828
test al, al
je 0x18001d8b0
lea rdx, str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember
mov esi, 1
mov r8d, 1
mov rcx, rdi
call fcn.18004caf0
test rax, rax
jne 0x18001d8d6
cmp bl, 0x64
jb 0x18001d858
movzx eax, bl
lea ecx, [rax + rax*4]
lea eax, [rax + rcx*8]
shr eax, 0xc
imul ecx, eax, 0x64
sub bl, cl
movzx ecx, bl
lea rdx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx ecx, word [rdx + rcx*2]
mov word [rsp + 0x29], cx
xor r8d, r8d
mov ebx, eax
jmp 0x18001d863
mov r8d, 2
cmp bl, 0xa
jae 0x18001d86d
or bl, 0x30
mov byte [rsp + r8 + 0x28], bl
jmp 0x18001d886
movzx eax, bl
lea rcx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx eax, word [rcx + rax*2]
mov word [rsp + 0x29], ax
mov r8d, 1
lea rdx, [rsp + r8]
add rdx, 0x28
xor r8, 3
mov rcx, rdi
mov rdi, r8
call fcn.18004caf0
test rax, rax
je 0x18001d8a9
mov esi, 1
jmp 0x18001d8d6
add rdi, rsi
xor esi, esi
jmp 0x18001d8d9
lea rbx, str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember
mov esi, 1
nop dword [rax]
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.18004caf0
test rax, rax
je 0x18001d8c0
mov rdi, rax
mov rax, rsi
mov rdx, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x18001da80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov ebx, edx
mov rdi, rcx
test dl, dl
je 0x18001dab5
movzx eax, bl
lea ecx, [rax + 0x2f6]
add eax, 0x19c
and eax, ecx
shr eax, 8
inc al
cmp al, 1
jbe 0x18001daad
xor esi, esi
jmp 0x18001dad8
test al, al
je 0x18001db60
lea rdx, str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember
mov esi, 1
mov r8d, 1
mov rcx, rdi
call fcn.18004d0b0
test rax, rax
jne 0x18001db86
cmp bl, 0x64
jb 0x18001db08
movzx eax, bl
lea ecx, [rax + rax*4]
lea eax, [rax + rcx*8]
shr eax, 0xc
imul ecx, eax, 0x64
sub bl, cl
movzx ecx, bl
lea rdx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx ecx, word [rdx + rcx*2]
mov word [rsp + 0x29], cx
xor r8d, r8d
mov ebx, eax
jmp 0x18001db13
mov r8d, 2
cmp bl, 0xa
jae 0x18001db1d
or bl, 0x30
mov byte [rsp + r8 + 0x28], bl
jmp 0x18001db36
movzx eax, bl
lea rcx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx eax, word [rcx + rax*2]
mov word [rsp + 0x29], ax
mov r8d, 1
lea rdx, [rsp + r8]
add rdx, 0x28
xor r8, 3
mov rcx, rdi
mov rdi, r8
call fcn.18004d0b0
test rax, rax
je 0x18001db59
mov esi, 1
jmp 0x18001db86
add rdi, rsi
xor esi, esi
jmp 0x18001db89
lea rbx, str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember
mov esi, 1
nop dword [rax]
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.18004d0b0
test rax, rax
je 0x18001db70
mov rdi, rax
mov rax, rsi
mov rdx, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x180026d30
Capabilities:
Enumerate gui resources

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
call fcn.180050d00
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], edx
cmp esi, 0x3b9aca00
mov r13, 0xffffffffffffffff
cmovne r13, rdi
mov ebp, 0x3b9ac9ff
cmovne ebp, esi
mov esi, dword [rbx + 8]
lea r14, [rsp + 0x38]
mov rdi, qword [sym.imp.user32.dll_EnumWindows]
mov qword [rsp + 0x20], 0
lea r15, [rsp + 0x28]
mov ebx, 0xff
nop word cs:[rax + rax]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
test rax, rax
setne cl
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
lea rcx, [0x180026e70]
mov rdx, r14
call rdi
test eax, eax
jne 0x180026dfb
call fcn.180029a50
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], edx
mov qword [rsp + 0x60], 1
test rax, rax
je 0x180026dfb
lea rcx, [rsp + 0x68]
call fcn.18002a370
mov r12, qword [rsp + 0x50]
test byte [rsp + 0x48], 1
jne 0x180026e3f
xor ecx, ecx
mov edx, 0x5f5e100
call fcn.180049df0
mov rcx, r15
call fcn.180051000
xor ecx, ecx
cmp rax, r13
setne cl
cmovb ecx, ebx
xor eax, eax
cmp edx, ebp
setne al
cmovb eax, ebx
test cl, cl
cmovne eax, ecx
cmp al, 1
jne 0x180026da0
jmp 0x180026e49
mov eax, 1
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rdx, r12
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180026ef0
Capabilities:
Get graphical window text

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1c0], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
lea rbx, [rbp - 0x60]
mov r8d, 0x200
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rdi]
mov rdx, rbx
mov r8d, pe_nt_image_headers64
call qword [sym.imp.user32.dll_GetWindowTextW]
movsxd r8, eax
cmp r8d, 0x101
jae 0x180027028
lea rdi, [rbp + 0x1a0]
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.18004e510
mov rcx, rdi
call fcn.180055b70
mov r8, rdx
lea rcx, [rbp - 0x60]
mov rdx, rax
call fcn.180055ed0
xor eax, eax
cmp rax, qword [rbp - 0x60]
jno 0x180026fbb
mov rdi, qword [rbp - 0x50]
test rdi, rdi
js 0x18002703f
mov rbx, qword [rbp - 0x58]
je 0x180026ffb
movzx eax, byte [0x18009f251]
mov r15d, 1
mov edx, 1
mov rcx, rdi
call fcn.180003390
test rax, rax
je 0x180027042
mov r14, rax
jmp 0x180027001
mov rax, qword [rbp - 0x50]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x1a0]
test rdx, rdx
je 0x180026fe8
mov rcx, qword [rbp + 0x1a8]
mov r8d, 1
call fcn.1800033a0
mov rax, rsi
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov r14d, 1
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi], rdi
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
mov rdx, qword [rbp + 0x1a0]
test rdx, rdx
jne 0x180026fd6
jmp 0x180026fe8
lea rax, str.C:UsersXairo.cargogitcheckouts_rust_hooking_utils_304217ef05c0f44c_a36a365_srcpatchingprocess.rs
mov edx, pe_nt_image_headers64
mov rcx, r8
mov r8, rax
call fcn.18006f410
xor r15d, r15d
lea r8, [0x18007b9c0]
mov rcx, r15
mov rdx, rdi
call fcn.18006eee3
ud2

Function at 0x180027410
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
sub rsp, 0x58
movzx edi, dx
cmp edi, 0x100
ja 0x180027462
mov rsi, rcx
mov ecx, edi
call qword [sym.imp.user32.dll_GetAsyncKeyState]
xor ecx, ecx
test ax, ax
setns dl
cmp edi, 0x100
je 0x180027499
mov cl, dl
lea ecx, [rcx + rcx*2]
cmp byte [rsi + rdi], cl
jne 0x180027452
movzx eax, ax
shr eax, 0xf
mov cl, 2
sub cl, al
jmp 0x180027459
mov byte [rsi + rdi + 0x100], cl
mov eax, ecx
add rsp, 0x58
pop rdi
pop rsi
ret
lea rax, str.Virtual_keys_cant_have_an_index_of_more_than_256_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str.C:UsersXairo.cargogitcheckouts_rust_hooking_utils_304217ef05c0f44c_a36a365_src_raw_inputkey_manager.rs
lea rcx, [rsp + 0x28]
call fcn.18006f000
lea r8, str.C:UsersXairo.cargogitcheckouts_rust_hooking_utils_304217ef05c0f44c_a36a365_src_raw_inputkey_manager.rs
mov ecx, pe_nt_image_headers64
mov edx, pe_nt_image_headers64
call fcn.18006f124
int3
Function at 0x180030f50
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r14, r9
mov r15, r8
mov rbx, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [rsp + 0x34]
test rcx, rcx
je 0x18003125b
mov rax, rbx
shr rax, 0x20
je 0x180030fa8
mov rax, rbx
xor edx, edx
div rcx
jmp 0x180030fae
mov eax, ebx
xor edx, edx
div ecx
lea rdi, [rcx + rbx]
sub rdi, rdx
test rdx, rdx
cmove rdi, rbx
test rdi, rdi
cmove rdi, rcx
test r14, r14
je 0x180031143
shl r14, 4
add r14, r15
xor ecx, ecx
lea r9, [0x18007e474]
lea r10, [0x18007e458]
xor r8d, r8d
xor edx, edx
xor r12d, r12d
xor r11d, r11d
xor ebx, ebx
jmp 0x180031009
add r15, 0x10
mov r12b, 1
mov r8b, 1
nop dword [rax]
cmp r15, r14
je 0x180031177
mov r13, r15
lea r15, [r13 + 0x10]
mov ebp, dword [r13]
cmp ebp, 2
jne 0x18003105e
nop dword [rax]
cmp r15, r14
je 0x1800310c0
mov ebp, dword [r15]
cmp ebp, 2
jne 0x180031040
add r15, 0x10
cmp r15, r14
jne 0x180031029
jmp 0x1800310c0
mov r12d, ebp
movsxd r12, dword [r9 + r12*4]
add r12, r9
jmp r12
mov ebp, ebp
movsxd rbp, dword [r10 + rbp*4]
add rbp, r10
jmp rbp
mov r8b, 1
jmp 0x180031000
add r15, 0x10
mov r12b, 1
mov dl, 1
jmp 0x180031000
cmp r11, 1
sete r10b
test r8b, 1
je 0x18003115d
movzx r9d, dl
and r9d, 1
shl r9d, 5
add r9d, 0x20
test r10b, r10b
je 0x1800311b9
not dl
movzx ecx, dl
and ecx, 1
lea ebp, [rcx*2 + 0x22]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, r9d
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingW
mov r14, rax
call fcn.180054810
test r14, r14
je 0x1800311f1
cmp eax, 0xb7
jne 0x1800311fa
mov dword [rsi + 8], 9
jmp 0x180031240
xor ebx, ebx
xor r10d, r10d
xor edx, edx
xor ecx, ecx
or r10b, dl
mov r9d, 1
test r10b, 1
jne 0x18003116b
jmp 0x1800311b9
or dl, r10b
mov r9d, 0x10
test dl, 1
je 0x1800311b9
mov dword [rsi + 8], 7
jmp 0x180031240
cmp r11, 1
sete r10b
test r12b, 1
jne 0x1800310c8
test r8b, 1
je 0x18003114c
movzx r8d, dl
and r8d, 1
lea r9d, [r8*2 + 2]
cmp r11, 1
jne 0x1800311b9
not dl
movzx ecx, dl
and ecx, 1
lea ebp, [rcx*2 + 2]
jmp 0x1800310fa
test rbx, rbx
je 0x1800311c7
mov dword [rsi + 8], 8
jmp 0x180031240
mov rdx, rdi
mov r8d, 0x3000
call sub.KERNEL32.dll_VirtualAlloc
test rax, rax
je 0x1800311e3
mov qword [rsi], 1
jmp 0x180031227
call fcn.180054810
mov dword [rsi + 8], 0xa
jmp 0x18003123d
mov dword [rsi + 8], 0xb
jmp 0x18003123d
mov r8, rdi
shr r8, 0x20
mov qword [rsp + 0x20], 0
mov rcx, r14
mov edx, ebp
mov r9d, ebx
call sub.KERNEL32.dll_MapViewOfFile
test rax, rax
je 0x180031231
mov qword [rsi], 0
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rdi
jmp 0x180031247
call fcn.180054810
mov dword [rsi + 8], 0xc
mov dword [rsi + 0xc], eax
mov qword [rsi], 2
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.C:UsersXairo.cargo_registry_srcindex.crates.io_6f17d22bba15001fmmap_fixed_fixed_0.1.3_srclib.rs
call fcn.18006f5c0
ud2