joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403b2f80
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1403b2fbc
test edx, edx
je 0x1403b2fec
movzx eax, byte [0x14055fab9]
cmp al, 0x9b
je 0x1403b2fb4
mov cl, 0xce
nop word [rax + rax]
mov al, 0x81
lock cmpxchg byte [0x14055fab9], cl
je 0x1403b304c
cmp al, 0x9b
jne 0x1403b2fa0
lea rax, [0x14055fab0]
ret
test edx, edx
je 0x1403b301c
movzx eax, byte [0x14055ff81]
cmp al, 0x13
je 0x1403b2fe4
mov cl, 0x37
nop dword [rax]
mov al, 0xbc
lock cmpxchg byte [0x14055ff81], cl
je 0x1403b3088
cmp al, 0x13
jne 0x1403b2fd0
lea rax, [0x14055fe80]
ret
movzx eax, byte [0x14055f8c5]
cmp al, 6
je 0x1403b3014
mov cl, 0x63
nop dword [rax]
mov al, 0x43
lock cmpxchg byte [0x14055f8c5], cl
je 0x1403b30c1
cmp al, 6
jne 0x1403b3000
lea rax, [0x14055f8c0]
ret
movzx eax, byte [0x14055f86c]
cmp al, 0x51
je 0x1403b3044
mov cl, 0xb3
nop dword [rax]
mov al, 0x1a
lock cmpxchg byte [0x14055f86c], cl
je 0x1403b3128
cmp al, 0x51
jne 0x1403b3030
lea rax, [0x14055f860]
ret
xor eax, eax
lea rcx, [0x14055fab0]
lea rdx, [0x140460060]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1403b3078
inc rax
jmp 0x1403b3060
mov al, 0x9b
xchg byte [0x14055fab9], al
lea rax, [0x14055fab0]
ret
xor eax, eax
lea rcx, [0x14055fe80]
lea rdx, [0x1404603f0]
xor r8d, 0x2d60825c
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140561988]
add r10d, r8d
cmp r9d, r10d
jge 0x1403b3118
inc rax
jmp 0x1403b30a0
xor edx, edx
lea rax, [0x14055f8c0]
lea rcx, [0x14045fe90]
xor r8d, 0x2d60815c
nop dword [rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, dword [0x140561988]
add r9d, r8d
mov r10d, edx
xor r10d, r9d
and r9d, edx
lea edx, [r10 + r9*2]
cmp edx, 5
jl 0x1403b30e0
mov al, 6
xchg byte [0x14055f8c5], al
lea rax, [0x14055f8c0]
ret
mov al, 0x13
xchg byte [0x14055ff81], al
lea rax, [0x14055fe80]
ret
xor eax, eax
lea rcx, [0x14055f860]
lea rdx, [0x14045fe30]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x1403b3158
inc rax
jmp 0x1403b3140
mov al, 0x51
xchg byte [0x14055f86c], al
lea rax, [0x14055f860]
ret
Function at 0x1403b3180
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1403b31f4
test edx, edx
je 0x1403b323c
movzx eax, byte [0x14055f99d]
cmp al, 0xeb
je 0x1403b31ec
nop dword [rax]
movzx ecx, byte [0x140561998]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0xc5
mov eax, r8d
and al, 0x3a
or al, r9b
add al, cl
and dl, 0x1d
mov r9d, r8d
and r9b, 0xe2
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x14055f99d], r9b
je 0x1403b32f8
mov ecx, r8d
xor cl, 0xf4
add cl, byte [0x140561998]
cmp al, cl
jne 0x1403b31a0
lea rax, [0x14055f990]
ret
mov eax, r8d
xor eax, 0x4a5f1794
add eax, dword [0x140561988]
cmp edx, eax
jne 0x1403b328c
movzx eax, byte [0x14055fce5]
cmp al, 0xc4
je 0x1403b3234
mov cl, 0x39
nop word [rax + rax]
mov al, 0xd8
lock cmpxchg byte [0x14055fce5], cl
je 0x1403b339d
cmp al, 0xc4
jne 0x1403b3220
lea rax, [0x14055fcd0]
ret
movzx eax, byte [0x14055fde0]
cmp al, 0xbc
je 0x1403b3284
nop word [rax + rax]
movzx ecx, byte [0x140561998]
mov eax, r8d
xor al, 0x63
add al, cl
mov edx, r8d
xor dl, 0x13
add dl, cl
lock cmpxchg byte [0x14055fde0], dl
je 0x1403b334b
mov ecx, r8d
xor cl, 0x87
add cl, byte [0x140561998]
cmp al, cl
jne 0x1403b3250
lea rax, [0x14055fdd0]
ret
movzx eax, byte [0x14055f896]
mov ecx, r8d
xor cl, 0xeb
add cl, byte [0x140561998]
cmp al, cl
je 0x1403b32f0
nop word cs:[rax + rax]
movzx ecx, byte [0x140561998]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0xe1
mov eax, r8d
and al, 0x1e
or al, r9b
add al, cl
and dl, 0x1b
mov r9d, r8d
and r9b, 0xe4
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x14055f896], r9b
je 0x1403b33f7
cmp al, 0xd8
jne 0x1403b32b0
lea rax, [0x14055f890]
ret
xor eax, eax
lea rcx, [0x14055f990]
lea rdx, [0x14045ff60]
xor r8d, 0x4a5f17eb
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140561988]
mov r11d, r8d
xor r11d, r10d
and r10d, r8d
lea r10d, [r11 + r10*2]
cmp r9d, r10d
jge 0x1403b333b
inc rax
jmp 0x1403b3310
mov al, 0xeb
xchg byte [0x14055f99d], al
lea rax, [0x14055f990]
ret
xor eax, eax
lea rcx, [0x14055fdd0]
lea rdx, [0x140460370]
xor r8d, 0x4a5f1797
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x140561988]
add r9d, r8d
add eax, r9d
cmp eax, 0x10
jl 0x1403b3370
mov al, 0xbc
xchg byte [0x14055fde0], al
lea rax, [0x14055fdd0]
ret
xor eax, eax
lea rcx, [0x14055fcd0]
lea rdx, [0x140460280]
mov r9d, r8d
xor r9d, 0x4a5f1797
nop word [rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
add byte [rax + rcx], r10b
mov r10d, dword [0x140561988]
add r10d, r9d
add eax, r10d
cmp eax, 0x15
jl 0x1403b33c0
xor r8b, 0x9f
add r8b, byte [0x140561998]
xchg byte [0x14055fce5], r8b
lea rax, [0x14055fcd0]
ret
xor edx, edx
lea rax, [0x14055f890]
lea rcx, [0x14045fe60]
xor r8d, 0x4a5f1797
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, dword [0x140561988]
add r9d, r8d
mov r10d, edx
xor r10d, r9d
and r9d, edx
lea edx, [r10 + r9*2]
cmp edx, 6
jl 0x1403b3410
mov al, 0xd8
xchg byte [0x14055f896], al
lea rax, [0x14055f890]
ret
Function at 0x140002ed0
Capabilities:
Acquire debug privileges
Hide graphical window
Set console window title

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14007e328]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___Checking_for_admin_privileges
call fcn.140001090
mov rcx, rax
lea rdx, [0x14007138c]
call fcn.140001090
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x44], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
lea r9d, [rax + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140071350]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___Authenticating_your_license__not_really_
call fcn.140001090
mov rcx, rax
lea rdx, [0x14007138c]
call fcn.140001090
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___Authenticated
call fcn.140001090
mov rcx, rax
lea rdx, [0x14007138c]
call fcn.140001090
mov byte [0x14007e002], 0
call fcn.1400018f0
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140045420
add rsp, 0x68
ret
Function at 0x140008080
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14007e328]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14007e4b0]
mov esi, edx
mov edi, ecx
cmp byte [rbx + 0x1f45], 0
jne 0x1400080e7
cmp byte [rbx + 0x1f46], 0
jne 0x1400080e7
mov r9d, dword [rbx + 0x2fe8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000c880
test sil, 1
je 0x140008216
jmp 0x14000817f
movss xmm1, dword [rbx + 0x1614]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x140071f44]
xor eax, eax
mov edx, 0x10
mulss xmm1, dword [0x140071f3c]
addss xmm0, dword [rbx + 0x128]
addss xmm1, dword [rbx + 0x12c]
or dword [rbx + 0x1ca8], 1
mov qword [rbx + 0x1cc0], rax
movss dword [rbx + 0x1cb8], xmm0
mov dword [rbx + 0x1cac], 1
movss dword [rbx + 0x1cbc], xmm1
movss xmm0, dword [rbx + 0x1670]
mov rax, qword [0x14007e4b0]
mulss xmm0, dword [0x140071ef0]
or dword [rax + 0x1ca8], 0x40
movss dword [rax + 0x1d08], xmm0
mov r9d, dword [rbx + 0x2fe8]
call fcn.14000c880
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400081d0
lea r11, [0x1400716e0]
nop
cmp r9b, 0x23
jne 0x1400081b3
cmp byte [r8], r9b
jne 0x1400081b3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400081a0
not ecx
call fcn.14000b4c0
test rax, rax
je 0x140008216
cmp byte [rax + 0x8e], 0
je 0x140008216
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xac], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2fe8]
mov edx, 0x10
mov r9d, dword [rbx + 0x2fe8]
call fcn.14000c880
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.1400053f0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140045420
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000bf60
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0xd0]
mov r9, r8
movsxd r8, dword [rcx + 0xc8]
mov r10, rdx
xor ecx, ecx
mov rdx, r9
sub rdx, r10
test r9, r9
mov r8d, dword [rax + r8*4 - 4]
cmove rdx, rcx
mov rcx, r10
jmp fcn.14000c990

Function at 0x14000c990
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000c9ed
lea rbx, [0x1400716e0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000c9d4
cmp r10, 2
jb 0x14000c9d4
cmp byte [r9], r8b
jne 0x14000c9d4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000c9b0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000ca2f
lea rbx, [0x1400716e0]
cmp r8b, 0x23
jne 0x14000ca13
cmp byte [r9], r8b
jne 0x14000ca13
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000ca00
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x14000cd00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push r13
push r14
push r15
mov qword [rsp + 0x28], rbp
xor r10d, r10d
mov qword [rsp + 0x30], rsi
mov rbx, rdx
mov qword [rsp + 0x38], rdi
mov rax, rcx
mov qword [rsp + 0x40], r12
mov r14d, r10d
lea r15, [0x140000000]
mov r13, rax
test rbx, rbx
je 0x14000cd40
cmp rax, rbx
jae 0x14000ceec
movzx r8d, byte [rax]
test r8b, r8b
je 0x14000ceec
mov r11d, r10d
mov ecx, r8d
shr rcx, 3
mov rdx, rbx
movsx r9, byte [rcx + r15 + 0x71c20]
test r9d, r9d
sete r11b
add r11d, r9d
test rbx, rbx
jne 0x14000cd78
movsxd rdx, r11d
add rdx, rax
cmp rax, rdx
lea rcx, [rax + 1]
mov edi, r8d
cmovae edi, r10d
cmp rcx, rdx
jae 0x14000cd91
movzx r12d, byte [rcx]
jmp 0x14000cd94
xor r12b, r12b
lea rcx, [rax + 2]
cmp rcx, rdx
jae 0x14000cda2
movzx ebp, byte [rcx]
jmp 0x14000cda5
xor bpl, bpl
lea rcx, [rax + 3]
cmp rcx, rdx
jae 0x14000cdb3
movzx esi, byte [rcx]
jmp 0x14000cdb6
xor sil, sil
lea r9, [r9*4]
movzx ecx, dil
mov r15d, dword [r9 + r15 + 0x71c40]
and r15d, ecx
movzx r8d, r12b
shl r15d, 6
mov ecx, r8d
and ecx, 0x3f
movzx edx, bpl
or r15d, ecx
movzx r10d, sil
shl r15d, 6
mov ecx, edx
and ecx, 0x3f
and edx, 0xc0
or r15d, ecx
and r8d, 0xc0
mov ecx, r10d
shl r15d, 6
and ecx, 0x3f
shr r10d, 2
or r10d, edx
or r15d, ecx
shr r10d, 2
lea rcx, [0x140000000]
mov ecx, dword [r9 + rcx + 0x71c70]
or r10d, r8d
shr r15d, cl
lea rcx, [0x140000000]
shr r10d, 2
mov edx, r15d
cmp r15d, dword [r9 + rcx + 0x71c58]
sbb ecx, ecx
and edx, 0xfffff800
and ecx, 0x40
xor r8d, r8d
or r10d, ecx
mov ecx, 0x80
cmp edx, 0xd800
cmove r8d, ecx
xor edx, edx
or r10d, r8d
mov ecx, pe_nt_image_headers64
cmp r15d, 0xffff
cmova edx, ecx
lea rcx, [0x140000000]
mov ecx, dword [r9 + rcx + 0x71c88]
or r10d, edx
xor r10d, 0x2a
sar r10d, cl
test r10d, r10d
je 0x14000ced6
xor r10d, r10d
test dil, dil
mov eax, r10d
mov ecx, r10d
setne cl
test sil, sil
setne al
add ecx, eax
mov eax, r10d
test bpl, bpl
setne al
add ecx, eax
mov eax, r10d
test r12b, r12b
setne al
add ecx, eax
cmp r11d, ecx
cmovl ecx, r11d
movsxd rax, ecx
add rax, r13
inc r14d
jmp 0x14000cd28
movsxd rcx, r11d
add rax, rcx
test r15d, r15d
je 0x14000ceec
xor r10d, r10d
inc r14d
jmp 0x14000cd28
mov r12, qword [rsp + 0x40]
mov eax, r14d
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
pop r15
pop r14
pop r13
pop rbx
ret
Function at 0x14000cf60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x30
movsxd rax, edx
mov rdi, rcx
dec rax
mov qword [r11 + 0x18], rbp
mov rbp, r9
xor r9d, r9d
lea rax, [rcx + rax*2]
mov qword [rsp + 8], rax
cmp rcx, rax
jae 0x14000d189
mov qword [r11 + 0x20], rsi
lea rsi, [0x140000000]
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
mov qword [rsp], r8
test rbp, rbp
je 0x14000cfc2
cmp r8, rbp
jae 0x14000d166
movzx edx, byte [r8]
test dl, dl
je 0x14000d166
mov eax, edx
mov rcx, rbp
shr rax, 3
movsx r9, byte [rax + rsi + 0x71c20]
xor eax, eax
test r9d, r9d
mov ebx, eax
sete bl
add ebx, r9d
test rbp, rbp
jne 0x14000cff8
movsxd rcx, ebx
add rcx, r8
cmp r8, rcx
mov r14d, edx
cmovae r14d, eax
lea rax, [r8 + 1]
cmp rax, rcx
jae 0x14000d011
movzx r13d, byte [rax]
jmp 0x14000d014
xor r13b, r13b
lea rax, [r8 + 2]
cmp rax, rcx
jae 0x14000d023
movzx r12d, byte [rax]
jmp 0x14000d026
xor r12b, r12b
lea rax, [r8 + 3]
cmp rax, rcx
jae 0x14000d035
movzx r15d, byte [rax]
jmp 0x14000d038
xor r15b, r15b
lea r10, [r9*4]
movzx eax, r14b
mov esi, dword [r10 + rsi + 0x71c40]
and esi, eax
movzx r9d, r13b
shl esi, 6
mov eax, r9d
and eax, 0x3f
movzx edx, r12b
or esi, eax
movzx r11d, r15b
shl esi, 6
and r9d, 0xc0
mov eax, edx
and edx, 0xc0
and eax, 0x3f
or esi, eax
mov eax, r11d
and eax, 0x3f
shr r11d, 2
or r11d, edx
shl esi, 6
or esi, eax
shr r11d, 2
or r11d, r9d
lea rax, [0x140000000]
mov ecx, dword [r10 + rax + 0x71c70]
shr r11d, 2
shr esi, cl
mov ecx, pe_nt_image_headers64
cmp esi, dword [r10 + rax + 0x71c58]
sbb eax, eax
xor r9d, r9d
and eax, 0x40
mov edx, r9d
or r11d, eax
mov eax, esi
and eax, 0xfffff800
cmp eax, 0xd800
mov eax, 0x80
cmove edx, eax
mov eax, r9d
or r11d, edx
cmp esi, 0xffff
cmova eax, ecx
or r11d, eax
lea rax, [0x140000000]
mov ecx, dword [r10 + rax + 0x71c88]
xor r11d, 0x2a
sar r11d, cl
test r11d, r11d
je 0x14000d143
test r14b, r14b
mov eax, r9d
mov ecx, r9d
mov esi, 0xfffd
setne cl
test r15b, r15b
setne al
add ecx, eax
mov eax, r9d
test r12b, r12b
setne al
add ecx, eax
mov eax, r9d
test r13b, r13b
setne al
add ecx, eax
cmp ebx, ecx
cmovl ecx, ebx
movsxd r8, ecx
add r8, qword [rsp]
jmp 0x14000d14d
movsxd rax, ebx
add r8, rax
test esi, esi
je 0x14000d166
mov word [rdi], si
add rdi, 2
lea rsi, [0x140000000]
cmp rdi, qword [rsp + 8]
jb 0x14000cfb0
mov rcx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x10]
mov r14, qword [rsp + 0x18]
mov r13, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x50]
mov word [rdi], r9w
test rax, rax
je 0x14000d19f
mov qword [rax], r8
sub rdi, rcx
sar rdi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x14000eb60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3088], 0
lea rbx, [rcx + 0x3090]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14000ec07
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14000ebba
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001a770
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.14001a2a0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3088]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x3098]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14007e4b8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14000ec0f
mov rcx, rbx
call fcn.14001a2a0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400141d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x14007e4b0]
mov r8d, ecx
mov rbx, qword [rax + 0x1c08]
add rbx, 0xc8
movzx eax, r8b
lea r8, [0x1400716e0]
movsxd rdx, dword [rbx]
mov r9, qword [rbx + 8]
mov edi, dword [r9 + rdx*4 - 4]
not edi
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x140014290
lea ecx, [rdx + 1]
test r8d, r8d
je 0x140014276
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x14001427b
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.14001a8b0
mov edx, dword [rbx]
mov r9, qword [rbx + 8]
movsxd rax, edx
mov dword [r9 + rax*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140016b70
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x14007e4b0]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x3024], ecx
test rbx, rbx
je 0x140016bdf
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.140016bf0
lea rdx, [0x140071e30]
mov rcx, rbx
mov rdi, rax
call fcn.14000c730
mov rbx, rax
test rax, rax
je 0x140016bda
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x140018fd0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x14007e4b0]
cmp byte [rbx + 0x3021], 0
jne 0x140019123
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14001911c
lea rdx, [0x140071e2c]
mov qword [rsp + 0x40], rdi
call fcn.14000c730
mov rdi, rax
test rax, rax
je 0x140019117
mov qword [rsp + 0x30], rbp
mov rcx, rax
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140019104
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140019104
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140019104
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140019104
mov rbp, rsi
cmp rsi, 0xffffffffffffffff
je 0x140019104
mov rax, qword [0x14007e4b0]
test rax, rax
je 0x140019093
inc dword [rax + 0x3b4]
mov rdx, qword [0x14007e4c0]
mov rcx, rbp
call qword [0x14007e060]
mov rsi, rax
test rax, rax
je 0x140019104
mov r9, rdi
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
cmp rax, rbp
je 0x1400190cf
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x1400190e0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdx, rbp
mov rcx, rsi
call fcn.14000e5a0
mov rax, qword [0x14007e4b0]
test rax, rax
je 0x1400190f2
dec dword [rax + 0x3b4]
mov rdx, qword [0x14007e4c0]
mov rcx, rsi
call qword [0x14007e068]
jmp 0x14001910d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov byte [rbx + 0x3021], 1
movss xmm0, dword [rbx + 0x3024]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x140019174
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x3024], xmm0
jb 0x140019174
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140019163
call fcn.140016b70
mov dword [rbx + 0x3024], 0
add rsp, 0x20
pop rbx
ret
mov byte [rbx + 0x39c], 1
mov dword [rbx + 0x3024], 0
add rsp, 0x20
pop rbx
ret
Function at 0x14002c3d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14007e328]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.14000bf90
mov rcx, qword [0x14007e520]
lea rdx, [rsp + 0x38]
xorps xmm0, xmm0
mov rdi, rax
movdqu xmmword [rsp + 0x38], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rsp + 0x40]
sub ecx, dword [rsp + 0x38]
movd xmm1, ecx
mov ecx, dword [rsp + 0x44]
sub ecx, dword [rsp + 0x3c]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rsp + 0x28]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
mov qword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x28]
xorps xmm1, xmm1
sub rax, qword [0x14007e528]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x14007e530]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rsp + 0x28]
mov qword [0x14007e528], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rdi + 0x138], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rdi + 0x139], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x13b], 0
mov byte [rdi + 0x13a], al
call fcn.14000bf90
mov rbx, rax
cmp byte [rax + 0x393], 0
je 0x14002c513
cvttss2si ecx, dword [rax + 0x120]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], ecx
cvttss2si ecx, dword [rax + 0x124]
mov dword [rsp + 0x24], ecx
mov rcx, qword [0x14007e520]
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x14002c513
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx + 0x120], 0xff7fffff
mov dword [rbx + 0x124], 0xff7fffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x14002c592
mov rdx, qword [0x14007e520]
cmp rax, rdx
je 0x14002c54b
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x14002c592
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14002c592
mov rcx, qword [0x14007e520]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x14002c592
movd xmm0, dword [rsp + 0x30]
movd xmm1, dword [rsp + 0x34]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0x120], xmm0
movss dword [rbx + 0x124], xmm1
cmp byte [rdi + 0xc0], 0
je 0x14002c5a2
mov eax, 0xffffffff
jmp 0x14002c5a7
call fcn.14000bfa0
cmp dword [0x14007e220], eax
je 0x14002c5ba
mov dword [0x14007e220], eax
call fcn.14002c940
call fcn.14002c640
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140045420
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret