joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fc7c0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400fc7fa
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400fc7ff
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400fc848
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140161320]
cmp byte [rcx + rax], 0
je 0x1400fc848
dec r8
sub rdx, 1
jne 0x1400fc82e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400fdc4c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400fdc96
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400fdc96
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400fdc96
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400fdc96
cmp dword [rcx + 0x84], 0xe
jbe 0x1400fdc96
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400fdc98
xor al, al
add rsp, 0x28
ret
Function at 0x1401077d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov word [rsp + 8], cx
push rdi
sub rsp, 0x40
movzx ebx, cx
mov edx, dword [0x1401acfc8]
mov rax, qword gs:[0x58]
mov ecx, 0x28
mov rax, qword [rax + rdx*8]
xor edi, edi
mov eax, dword [rcx + rax]
cmp dword [0x1401ad5cc], eax
jg 0x14010799d
movzx ecx, bl
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
movzx eax, byte [rsp + 0x51]
xor rcx, rax
imul rcx, rdx
and rcx, qword [0x1401ad5a0]
add rcx, rcx
mov rdx, qword [0x1401ad588]
mov rax, qword [rdx + rcx*8 + 8]
mov r8, qword [0x1401ad578]
cmp rax, r8
je 0x140107877
mov rdx, qword [rdx + rcx*8]
cmp bx, word [rax + 0x10]
je 0x14010787a
cmp rax, rdx
je 0x140107877
mov rax, qword [rax + 8]
cmp bx, word [rax + 0x10]
jne 0x140107866
jmp 0x14010787a
mov rax, rdi
mov rcx, r8
test rax, rax
cmovne rcx, rax
cmp rcx, r8
je 0x14010789d
mov rax, qword [rcx + 0x18]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov ecx, 0x200
call fcn.1401456fc
mov rsi, rax
nop word [rax + rax]
movzx edx, dil
shl dx, 8
movzx r8d, dx
add r8w, r8w
movzx ecx, r8w
xor cx, bx
test dx, dx
cmovs r8w, cx
movzx ecx, r8w
add cx, cx
movzx eax, cx
xor ax, bx
test r8w, r8w
cmovs cx, ax
movzx edx, cx
add dx, dx
movzx eax, dx
xor ax, bx
test cx, cx
cmovs dx, ax
movzx ecx, dx
add cx, cx
movzx eax, cx
xor ax, bx
test dx, dx
cmovs cx, ax
movzx edx, cx
add dx, dx
movzx eax, dx
xor ax, bx
test cx, cx
cmovs dx, ax
movzx ecx, dx
add cx, cx
movzx eax, cx
xor ax, bx
test dx, dx
cmovs cx, ax
movzx edx, cx
add dx, dx
movzx eax, dx
xor ax, bx
test cx, cx
cmovs dx, ax
movzx ecx, dx
add cx, cx
movzx eax, cx
xor ax, bx
test dx, dx
cmovs cx, ax
mov word [rsi + rdi*2], cx
inc rdi
cmp rdi, 0x100
jb 0x1401078b0
mov word [rsp + 0x20], bx
mov qword [rsp + 0x28], rsi
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
lea rcx, [0x1401ad570]
call fcn.1401067f0
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
lea rcx, [0x1401ad5cc]
call fcn.1400fd6c8
cmp dword [0x1401ad5cc], 0xffffffff
jne 0x140107810
vxorps xmm0, xmm0, xmm0
vmovss dword [0x1401ad570], xmm0
mov qword [0x1401ad578], rdi
mov qword [0x1401ad580], rdi
mov ecx, 0x20
call fcn.1400fcfc0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x1401ad578], rax
mov qword [0x1401ad588], rdi
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [0x1401ad590], xmm0
mov qword [0x1401ad5a0], 7
mov qword [0x1401ad5a8], 8
vmovss xmm0, dword [0x1401509fc]
vmovss dword [0x1401ad570], xmm0
mov r8, rax
mov edx, Ordinal_17
lea rcx, [0x1401ad588]
call fcn.140019390
nop
lea rcx, [0x14014db00]
call fcn.1400fd22c
nop
lea rcx, [0x1401ad5cc]
call fcn.1400fd65c
jmp 0x140107810
Function at 0x140115260
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xf0
mov rax, qword [0x1401a6c00]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov r14, rcx
xor r9d, r9d
mov r8, qword [rdx]
movzx esi, byte [r8 + 1]
movzx eax, byte [r8]
shl ax, 8
or si, ax
mov rdx, qword [0x1401ad600]
movzx ebx, word [rdx + 0xa]
mov rcx, qword [rdx]
nop dword [rax]
movzx eax, byte [r8 + r9 + 2]
shl ax, 8
xor bx, ax
movzx eax, bx
shr rax, 8
shl bx, 8
xor bx, word [rcx + rax*2]
inc r9
cmp r9, 9
jb 0x1401152b0
xor bx, word [rdx + 0xc]
cmp si, bx
sete r15b
lea rax, str._crc16___firecode__is_match_got:04X_calc:04X
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x35
mov byte [rsp + 0x60], r15b
movzx eax, si
mov dword [rsp + 0x70], eax
movzx eax, bx
mov dword [rsp + 0x80], eax
vmovups ymm0, ymmword [rsp + 0x60]
vmovups ymmword [rsp + 0xb0], ymm0
vmovups xmm1, xmmword [rsp + 0x80]
vmovups xmmword [rsp + 0xd0], xmm1
mov qword [rsp + 0x40], 0x227
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x48], rax
vmovups xmm0, xmmword [rsp + 0x40]
vmovdqa xmmword [rsp + 0x40], xmm0
vmovups xmm1, xmmword [rsp + 0x50]
vmovdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
vzeroupper
call fcn.140048a50
nop
lea rdx, [rsp + 0x90]
lea rcx, str.aac_frame_processor
call fcn.140115620
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x1401153d0
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401153cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401153cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fcffc
cmp si, bx
je 0x140115425
mov ebp, dword [r14 + 0x5c]
mov rdi, qword [r14 + 0x70]
mov r14, qword [r14 + 0x78]
cmp rdi, r14
je 0x140115425
nop word [rax + rax]
mov word [rsp + 0x20], bx
mov word [rsp + 0x28], si
mov dword [rsp + 0x30], ebp
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x140115450
mov rax, qword [rcx]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call qword [rax + Ordinal_17]
add rdi, 0x40
cmp rdi, r14
jne 0x1401153f0
movzx eax, r15b
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400fd350
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
int3
Function at 0x14011e510
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov word [rsp + 0x10], dx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
movzx esi, dx
mov r14, rcx
movzx r8d, sil
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rcx, 0x100000001b3
imul r8, rcx
movzx eax, byte [rsp + 0x79]
xor r8, rax
imul r8, rcx
mov rcx, qword [r14 + 0x40]
and rcx, r8
add rcx, rcx
mov rdx, qword [r14 + 0x28]
mov rax, qword [rdx + rcx*8 + 8]
mov r8, qword [r14 + 0x18]
xor r15d, r15d
cmp rax, r8
je 0x14011e591
mov rcx, qword [rdx + rcx*8]
cmp si, word [rax + 0x10]
je 0x14011e594
nop
cmp rax, rcx
je 0x14011e591
mov rax, qword [rax + 8]
cmp si, word [rax + 0x10]
jne 0x14011e580
jmp 0x14011e594
mov rax, r15
test rax, rax
je 0x14011e5a2
cmp rax, r8
jne 0x14011e67f
mov rcx, r14
call fcn.140122640
mov rax, qword [r14]
mov rbp, qword [rax]
movabs rax, 0x2e8ba2e8ba2e8ba
cmp qword [r14 + 8], rax
je 0x14011e6cf
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], r15
mov ecx, 0x58
call fcn.1400fcfc0
mov rdi, rax
mov qword [rsp + 0x28], rax
mov word [rax + 0x10], si
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
mov dword [rbx], r15d
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov ecx, 0x70
call fcn.1400fcfc0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x18]
mov qword [rcx], r15
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
mov qword [rbx + 0x30], 7
mov qword [rbx + 0x38], 8
mov dword [rbx], 0x3f800000
mov r8, qword [rbx + 8]
mov edx, Ordinal_17
call fcn.140019390
nop
inc qword [r14 + 8]
mov rax, qword [rbp + 8]
mov qword [rdi], rbp
mov qword [rdi + 8], rax
mov qword [rbp + 8], rdi
mov qword [rax], rdi
mov rax, qword [r14]
mov rax, qword [rax]
mov word [rsp + 0x20], si
mov qword [rsp + 0x28], rax
lea rcx, [r14 + 0x10]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call fcn.1401067f0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x18]
mov rax, qword [r14]
mov r9, qword [rax]
mov r10, qword [rcx]
cmp r9, rcx
je 0x14011e6b7
cmp r9, r10
je 0x14011e6b7
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], r9
mov rax, qword [r9 + 8]
mov qword [rax], rcx
mov qword [r9 + 8], rdx
mov qword [r10 + 8], r8
mov qword [rcx + 8], rax
lea rax, [rcx + 0x18]
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.list_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x14011f860
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
movzx esi, r8b
mov r14, rdx
mov eax, esi
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
mov rcx, qword [rdx + 0x30]
and rcx, rax
shl rcx, 4
mov rax, qword [rdx + 0x18]
add rax, rcx
mov rbx, qword [rax + 8]
mov rcx, qword [rdx + 8]
xor edi, edi
cmp rbx, rcx
je 0x14011f8d9
mov rax, qword [rax]
cmp sil, byte [rbx + 0x10]
je 0x14011f8dc
cmp rbx, rax
je 0x14011f8d9
mov rbx, qword [rbx + 8]
cmp sil, byte [rbx + 0x10]
jne 0x14011f8c8
jmp 0x14011f8dc
mov rbx, rdi
test rbx, rbx
cmove rbx, rcx
cmp rbx, rcx
jne 0x14011fa07
lea rcx, [rbp - 0x19]
call fcn.140125450
nop
mov byte [rsp + 0x20], sil
lea rax, [rsp + 0x28]
mov qword [rbp + 0x6f], rax
lea rdx, [rbp - 0x19]
lea rcx, [rsp + 0x28]
call fcn.14005a1d0
nop
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x69]
call fcn.14005a1d0
nop
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rbp - 0x51], xmm0
mov qword [rbp - 0x41], rdi
mov rbx, qword [rbp + 0x1f]
mov rdx, qword [rbp + 0x17]
sub rbx, rdx
sar rbx, 4
test rbx, rbx
je 0x14011f9d4
movabs rax, 0xfffffffffffffff
cmp rbx, rax
ja 0x14011fa29
shl rbx, 4
cmp rbx, 0x1000
jb 0x14011f992
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14011fa23
call fcn.1400fcfc0
test rax, rax
je 0x14011f98b
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14011f9a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rbx, rbx
je 0x14011f9a6
mov rcx, rbx
call fcn.1400fcfc0
mov rdi, rax
mov rdx, qword [rbp + 0x17]
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], rdi
lea rax, [rbx + rdi]
mov qword [rbp - 0x41], rax
mov rbx, qword [rbp + 0x1f]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
and rbx, 0xfffffffffffffff0
lea rax, [rbx + rdi]
mov qword [rbp - 0x49], rax
vmovups xmm0, xmmword [rbp + 0x2f]
vmovups xmmword [rbp - 0x39], xmm0
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x29]
mov rcx, r14
call fcn.14011e6e0
mov rbx, qword [rbp - 0x29]
lea rcx, [rsp + 0x28]
call fcn.140112f80
nop
lea rcx, [rbp - 0x19]
call fcn.140112f80
lea rax, [rbx + 0x18]
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14001ae60
nop
call fcn.14001b5f0
int3
Function at 0x140122200
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
mov r10, rcx
mov r9, rdx
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rcx, 0x100000001b3
movzx eax, byte [rdx + 1]
mov rdx, qword [r10 + 0x40]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
mov r8, qword [r10 + 0x18]
shl rdx, 4
add rdx, qword [r10 + 0x28]
mov rax, qword [rdx + 8]
cmp rax, r8
je 0x140122271
movzx ecx, word [r9]
mov rdx, qword [rdx]
cmp cx, word [rax + 0x10]
je 0x140122273
nop dword [rax]
cmp rax, rdx
je 0x140122271
mov rax, qword [rax + 8]
cmp cx, word [rax + 0x10]
jne 0x140122260
jmp 0x140122273
xor eax, eax
test rax, rax
cmove rax, r8
cmp rax, r8
jne 0x140122282
xor eax, eax
ret
mov rcx, qword [rax + 0x18]
mov rax, qword [r10]
mov r10, qword [rcx]
mov r9, qword [rax]
cmp r9, rcx
je 0x1401222ba
cmp r9, r10
je 0x1401222ba
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], r9
mov rax, qword [r9 + 8]
mov qword [rax], rcx
mov qword [r9 + 8], rdx
mov qword [r10 + 8], r8
mov qword [rcx + 8], rax
lea rax, [rcx + 0x18]
ret
Function at 0x1401222c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov word [rsp + 0x10], dx
push rbp
push rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x1401a6c00]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, r8
movzx edi, dx
mov rsi, rcx
movzx r8d, dil
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rcx, 0x100000001b3
imul r8, rcx
movzx eax, byte [rsp + 0x109]
xor r8, rax
imul r8, rcx
mov rcx, qword [rsi + 0x40]
and rcx, r8
shl rcx, 4
add rcx, qword [rsi + 0x28]
mov rax, qword [rcx + 8]
mov rdx, qword [rsi + 0x18]
cmp rax, rdx
je 0x140122353
mov rcx, qword [rcx]
cmp di, word [rax + 0x10]
je 0x140122355
cmp rax, rcx
je 0x140122353
mov rax, qword [rax + 8]
cmp di, word [rax + 0x10]
jne 0x140122342
jmp 0x140122355
xor eax, eax
test rax, rax
je 0x140122363
cmp rax, rdx
jne 0x140122420
mov rcx, rsi
call fcn.140122490
mov word [rsp + 0x40], di
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.14005a760
nop
mov rax, qword [rsi]
mov rbp, qword [rax]
movabs rax, 0x1af286bca1af286
cmp qword [rsi + 8], rax
je 0x14012247f
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], 0
mov ecx, 0x98
call fcn.1400fcfc0
mov rbx, rax
movzx ecx, word [rsp + 0x40]
mov word [rax + 0x10], cx
lea rcx, [rax + 0x18]
lea rdx, [rsp + 0x48]
call fcn.14005a6b0
nop
inc qword [rsi + 8]
mov rcx, qword [rbp + 8]
mov qword [rbx], rbp
mov qword [rbx + 8], rcx
mov qword [rbp + 8], rbx
mov qword [rcx], rbx
lea rcx, [rsp + 0xb0]
call fcn.14005b510
lea rcx, [rsp + 0x58]
call fcn.14002b0b0
mov rax, qword [rsi]
mov rax, qword [rax]
mov word [rsp + 0x20], di
mov qword [rsp + 0x28], rax
lea rcx, [rsi + 0x10]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call fcn.1401067f0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x18]
mov rax, qword [rsi]
mov r9, qword [rax]
mov r10, qword [rcx]
cmp r9, rcx
je 0x140122458
cmp r9, r10
je 0x140122458
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], r9
mov rax, qword [r9 + 8]
mov qword [rax], rcx
mov qword [r9 + 8], rdx
mov qword [r10 + 8], r8
mov qword [rcx + 8], rax
lea rax, [rcx + 0x18]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400fd350
mov rbx, qword [rsp + 0x118]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.list_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140122490
Capabilities:
Hash data using fnv

Disassembly:
push r14
sub rsp, 0x30
mov rax, qword [rcx + 0x50]
mov r14, rcx
cmp qword [rcx + 8], rax
jbe 0x140122638
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov rdi, qword [rcx]
mov rsi, qword [rdi]
test rax, rax
je 0x1401224ca
mov rsi, qword [rsi]
sub rax, 1
jne 0x1401224c1
mov rbx, rsi
cmp rsi, rdi
je 0x140122629
mov qword [rsp + 0x48], rbp
xor ebp, ebp
mov qword [rsp + 0x28], r12
movabs r12, 0xcbf29ce484222325
mov qword [rsp + 0x20], r15
movabs r15, 0x100000001b3
nop dword [rax + rax]
movzx edx, word [rbx + 0x10]
mov rcx, qword [r14 + 0x40]
mov eax, edx
shr rax, 8
movzx r8d, dl
xor r8, r12
imul r8, r15
xor r8, rax
mov rax, qword [r14 + 0x28]
imul r8, r15
and rcx, r8
shl rcx, 4
add rax, rcx
mov rcx, qword [rax + 8]
cmp rcx, qword [r14 + 0x18]
je 0x140122552
mov rax, qword [rax]
cmp dx, word [rcx + 0x10]
je 0x140122555
cmp rcx, rax
je 0x140122552
mov rcx, qword [rcx + 8]
cmp dx, word [rcx + 0x10]
jne 0x140122541
jmp 0x140122555
mov rcx, rbp
test rcx, rcx
je 0x1401225c1
mov rdx, qword [r14 + 0x28]
mov rax, qword [r14 + 0x40]
and rax, r8
add rax, rax
lea r9, [rdx + rax*8]
lea r8, [rdx + rax*8]
mov rax, qword [rdx + rax*8]
cmp qword [r9 + 8], rcx
jne 0x140122596
cmp rax, rcx
jne 0x14012258c
mov rax, qword [r14 + 0x18]
mov qword [r8], rax
mov qword [r9 + 8], rax
jmp 0x1401225a1
mov rax, qword [rcx + 8]
mov qword [r9 + 8], rax
jmp 0x1401225a1
cmp rax, rcx
jne 0x1401225a1
mov rax, qword [rcx]
mov qword [r8], rax
mov rdx, qword [rcx]
dec qword [r14 + 0x20]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.1400fcffc
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140122500
mov rax, qword [rsi + 8]
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov qword [rax], rdi
mov qword [rdi + 8], rax
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rsi]
lea rcx, [rsi + 0x80]
call fcn.14005b510
lea rcx, [rsi + 0x28]
call fcn.14002b0b0
mov edx, 0x98
mov rcx, rsi
call fcn.1400fcffc
inc rbp
mov rsi, rbx
cmp rbx, rdi
jne 0x1401225f0
sub qword [r14 + 8], rbp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140122640
Capabilities:
Hash data using fnv

Disassembly:
push r14
sub rsp, 0x30
mov rax, qword [rcx + 0x50]
mov r14, rcx
cmp qword [rcx + 8], rax
jbe 0x1401227ce
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov rdi, qword [rcx]
mov rsi, qword [rdi]
test rax, rax
je 0x14012267a
mov rsi, qword [rsi]
sub rax, 1
jne 0x140122671
mov rbx, rsi
cmp rsi, rdi
je 0x1401227bf
mov qword [rsp + 0x48], rbp
xor ebp, ebp
mov qword [rsp + 0x28], r12
movabs r12, 0xcbf29ce484222325
mov qword [rsp + 0x20], r15
movabs r15, 0x100000001b3
nop dword [rax + rax]
movzx edx, word [rbx + 0x10]
mov rcx, qword [r14 + 0x40]
mov eax, edx
shr rax, 8
movzx r8d, dl
xor r8, r12
imul r8, r15
xor r8, rax
mov rax, qword [r14 + 0x28]
imul r8, r15
and rcx, r8
shl rcx, 4
add rax, rcx
mov rcx, qword [rax + 8]
cmp rcx, qword [r14 + 0x18]
je 0x140122702
mov rax, qword [rax]
cmp dx, word [rcx + 0x10]
je 0x140122705
cmp rcx, rax
je 0x140122702
mov rcx, qword [rcx + 8]
cmp dx, word [rcx + 0x10]
jne 0x1401226f1
jmp 0x140122705
mov rcx, rbp
test rcx, rcx
je 0x140122771
mov rdx, qword [r14 + 0x28]
mov rax, qword [r14 + 0x40]
and rax, r8
add rax, rax
lea r9, [rdx + rax*8]
lea r8, [rdx + rax*8]
mov rax, qword [rdx + rax*8]
cmp qword [r9 + 8], rcx
jne 0x140122746
cmp rax, rcx
jne 0x14012273c
mov rax, qword [r14 + 0x18]
mov qword [r8], rax
mov qword [r9 + 8], rax
jmp 0x140122751
mov rax, qword [rcx + 8]
mov qword [r9 + 8], rax
jmp 0x140122751
cmp rax, rcx
jne 0x140122751
mov rax, qword [rcx]
mov qword [r8], rax
mov rdx, qword [rcx]
dec qword [r14 + 0x20]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.1400fcffc
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1401226b0
mov rax, qword [rsi + 8]
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov qword [rax], rdi
mov qword [rdi + 8], rax
mov rbx, qword [rsi]
lea rcx, [rsi + 0x18]
call fcn.140112b10
mov edx, 0x58
mov rcx, rsi
call fcn.1400fcffc
inc rbp
mov rsi, rbx
cmp rbx, rdi
jne 0x140122792
sub qword [r14 + 8], rbp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140125b30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov rdx, qword [rcx + 0x18]
cmp rdx, 2
jae 0x140125b45
xor al, al
add rsp, 8
ret
mov r9, qword [rcx]
lea r10, [rdx - 2]
mov qword [rsp], rbx
mov rbx, qword [0x1401ad7b0]
movzx eax, byte [rdx + r9 - 1]
movzx r11d, byte [rdx + r9 - 2]
xor edx, edx
shl r11w, 8
or r11w, ax
movzx eax, word [rbx + 0xa]
test r10, r10
je 0x140125ba4
mov r8, qword [rbx]
nop word [rax + rax]
movzx ecx, byte [rdx + r9]
inc rdx
shl cx, 8
xor ax, cx
movzx ecx, ax
shr rcx, 8
shl ax, 8
xor ax, word [r8 + rcx*2]
cmp rdx, r10
jb 0x140125b80
xor ax, word [rbx + 0xc]
mov rbx, qword [rsp]
cmp r11w, ax
sete al
add rsp, 8
ret
Function at 0x140002fd0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
movaps xmmword [rax - 0x28], xmm6
mov rbp, r8
movsxd r8, dword [0x1400ebfc4]
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm7
lea rdx, [rax - 0x78]
movaps xmmword [rax - 0x48], xmm8
mov rdi, rcx
shl r8, 5
lea rcx, [0x1400ebfe0]
add r8, qword [0x1400ebfc8]
mov rbx, r9
movaps xmmword [rax - 0x58], xmm9
movaps xmmword [rax - 0x68], xmm10
call fcn.140004ba0
lea r8, [rsp + 0x30]
xorps xmm9, xmm9
mov rcx, qword [rax]
mov eax, dword [rcx + 0x40]
mov rcx, qword [0x1400ebe10]
shl eax, 5
movsxd rdx, eax
add rdx, rbx
mov qword [rsp + 0x30], 0
xor ebx, ebx
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 0xc]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm8, dword [rsp + 0x34]
movss xmm7, dword [rsp + 0x30]
subss xmm8, dword [rdi + 0x24]
subss xmm7, dword [rdi + 0x20]
movss xmm6, dword [rsp + 0x38]
subss xmm6, dword [rdi + 0x28]
movaps xmm1, xmm8
movaps xmm0, xmm7
xorps xmm6, xmmword [0x1400d91e0]
call fcn.14009c968
movaps xmm1, xmm0
movaps xmm0, xmm6
call fcn.14009ccb8
movaps xmm10, xmm0
movaps xmm1, xmm7
mulss xmm10, dword [0x1400d8ce0]
movaps xmm0, xmm8
subss xmm10, dword [rdi + 0x38]
call fcn.14009ccb8
movaps xmm7, xmm0
xorps xmm8, xmm8
mulss xmm7, dword [0x1400d8ce0]
movaps xmm0, xmm10
xorps xmm6, xmm6
subss xmm7, dword [rdi + 0x3c]
movaps xmm1, xmm7
call fcn.14009c968
movss xmm1, dword [0x1400ebfb8]
comiss xmm1, xmm0
jbe 0x1400030fe
movaps xmm8, xmm10
movaps xmm6, xmm7
movss xmm7, dword [0x1400d8cec]
comiss xmm8, xmm7
movss xmm1, dword [0x1400d8d10]
movss xmm0, dword [0x1400d8d00]
jbe 0x140003122
comiss xmm0, xmm8
jae 0x140003140
comiss xmm8, xmm0
movaps xmm7, xmm8
jbe 0x140003130
subss xmm7, xmm1
movss xmm2, dword [0x1400d8d80]
comiss xmm2, xmm7
jbe 0x140003140
movaps xmm7, xmm2
comiss xmm6, xmm0
jbe 0x140003149
subss xmm6, xmm1
movss xmm0, dword [0x1400d8d88]
comiss xmm0, xmm6
jbe 0x14000315a
addss xmm6, xmm1
divss xmm7, dword [0x1400ebfb4]
divss xmm6, dword [0x1400ebfb4]
ucomiss xmm7, xmm9
jp 0x140003186
jne 0x140003186
ucomiss xmm6, xmm9
jp 0x140003186
jne 0x140003186
mov qword [0x1400ebdf8], rbx
jmp 0x140003207
cmp byte [0x1400ebff0], bl
je 0x1400031c2
movsxd r8, dword [0x1400ebff4]
lea rdx, [rsp + 0x40]
shl r8, 5
lea rcx, [0x1400ec028]
add r8, qword [0x1400ec010]
call fcn.140004ba0
mov rcx, qword [rax]
mov ecx, dword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140003207
addss xmm7, dword [rsi]
addss xmm6, dword [rsi + 4]
movss xmm1, dword [rsi + 8]
lea r8, [rsp + 0x30]
mov rcx, qword [0x1400ebe10]
addss xmm1, xmm9
mov r9d, 0xc
mov qword [rsp + 0x20], rbx
movaps xmm0, xmm7
mov rdx, rbp
unpcklps xmm0, xmm6
movsd qword [rsp + 0x30], xmm0
movss dword [rsp + 0x38], xmm1
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop rdi
pop rsi
pop rbp
ret