joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180009948
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov dword [rbp - 0x1c], 0x54646e65
or ebx, 0xffffffff
mov dword [rbp - 0x16], 0x646165
mov word [rbp - 0x1f], 0x7375
mov word [rbp - 0x18], 0x7268
mov byte [rbp - 0x1d], 0x70
mov byte [rbp - 0x20], 0x53
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800099ae
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x1800099d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
mov dword [rbp - 0x12], 0x797469
mov ebx, 0x7fffffff
mov dword [rbp - 0x20], 0x54746547
mov dword [rbp - 0x16], 0x726f6972
mov dword [rbp - 0x1c], 0x61657268
mov word [rbp - 0x18], 0x5064
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009a3c
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x180009a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov dword [rbp - 0x17], 0x6c616369
mov dword [rbp - 0x1b], 0x74697243
mov dword [rbp - 0x20], 0x7661654c
mov word [rbp - 0x10], 0x6974
mov word [rbp - 0x13], 0x6553
mov word [rbp - 0xd], 0x6e
mov byte [rbp - 0xe], 0x6f
mov byte [rbp - 0x1c], 0x65
mov byte [rbp - 0x11], 0x63
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009acd
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
lea rcx, [0x180055b28]
jmp 0x180009a60

Function at 0x180009b50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov word [rbp - 0x14], 0x79
mov rbx, rcx
mov dword [rbp - 0x1f], 0x655a6c74
mov word [rbp - 0x1a], 0x4d6f
mov word [rbp - 0x17], 0x6f6d
mov byte [rbp - 0x20], 0x52
mov byte [rbp - 0x1b], 0x72
mov byte [rbp - 0x18], 0x65
mov byte [rbp - 0x15], 0x72
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009bbe
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x180009be0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov word [rbp - 0xf], 0x6f69
mov word [rbp - 0x15], 0x6c61
mov dword [rbp - 0x19], 0x63697469
mov word [rbp - 0x12], 0x6365
mov word [rbp - 0x1d], 0x7265
mov word [rbp - 0xd], 0x6e
mov word [rbp - 0x20], 0x6e45
mov byte [rbp - 0x1e], 0x74
mov word [rbp - 0x1b], 0x7243
mov byte [rbp - 0x13], 0x53
mov byte [rbp - 0x10], 0x74
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009c57
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
sub rsp, 0x28
cmp dword [0x180055b20], 0
jne 0x18000a2d8
lea rcx, [0x180055b28]
call fcn.180009204
mov edx, 0x200
lea rcx, [0x180055b50]
call fcn.180009b50
mov dword [0x180055b20], 1
lea rcx, [0x180055b28]
add rsp, 0x28
jmp 0x180009be0

Function at 0x18000a77c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
call fcn.180008bc8
test rax, rax
je 0x18000a7e3
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1d], 0x65726f46
mov rcx, rax
mov dword [rbp - 0x11], 0x776f646e
mov dword [rbp - 0x16], 0x57646e75
mov word [rbp - 0x20], 0x6553
mov word [rbp - 0x19], 0x7267
mov byte [rbp - 0x1e], 0x74
mov byte [rbp - 0xd], bl
mov byte [rbp - 0x12], 0x69
mov byte [rbp - 0x17], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x18000a82c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
call fcn.180008bc8
test rax, rax
je 0x18000a888
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1b], 0x6957
mov rcx, rax
mov dword [rbp - 0x20], 0x6e697242
mov dword [rbp - 0x19], 0x776f646e
mov dword [rbp - 0x13], 0x706f54
mov byte [rbp - 0x1c], 0x67
mov word [rbp - 0x15], 0x6f54
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x18000a8d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp + 0x80], rax
and dword [rsp + 0x30], 0
mov rbx, rcx
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x104
call fcn.18000cfb0
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x5f], 0x73255c45
mov dword [rsp + 0x5a], 0x41575446
mov word [rsp + 0x58], 0x4f53
mov byte [rsp + 0x63], 0
mov byte [rsp + 0x5e], 0x52
call fcn.18000b218
mov rcx, rax
call fcn.18000ba1c
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], rax
or r8, 0xffffffffffffffff
lea rcx, [rsp + 0x70]
mov edx, 0x104
call fcn.18000bb94
lea rcx, [rsp + 0x38]
call fcn.18000b394
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.18000b358
mov rax, rbx
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x190
pop rbp
ret

Function at 0x18000aa24
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp + 0x40], rax
cmp edx, 1
jne 0x18000aaf6
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call fcn.18000903c
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x26], 0x75732074
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x2c], 0x74726f
mov dword [rsp + 0x21], 0x6174736e
mov word [rsp + 0x2a], 0x7070
mov byte [rsp + 0x20], 0x69
mov byte [rsp + 0x25], 0x6e
call fcn.18000981c
test rax, rax
jne 0x18000ab2a
lea rdx, [sym.drvhlp.dll_eqwkgu]
lea rcx, [0x180055ae8]
call fcn.180009ffc
test eax, eax
je 0x18000ab2a
lea rdx, [sym.drvhlp.dll_noq4gr]
lea rcx, [0x180055a20]
call fcn.180009ffc
test eax, eax
je 0x18000ab2a
lea rdx, [sym.drvhlp.dll_ql944l]
lea rcx, [0x180055a98]
call fcn.180009ffc
test eax, eax
je 0x18000ab2a
lea rdx, [sym.drvhlp.dll_sbnevz]
lea rcx, [0x180055a88]
call fcn.180009ffc
jmp 0x18000ab2a
test edx, edx
jne 0x18000ab2a
lea rcx, [0x180055ae8]
call fcn.18001d5e4
lea rcx, [0x180055a20]
call fcn.18001d5e4
lea rcx, [0x180055a98]
call fcn.18001d5e4
lea rcx, [0x180055a88]
call fcn.18001d5e4
mov eax, 1
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.18000bcc0
add rsp, 0x150
pop rbp
ret

Function at 0x18001d098
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
call fcn.180008bc8
test rax, rax
je 0x18001d0ee
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1f], 0x69577465
mov rcx, rax
mov dword [rbp - 0x18], 0x736f5077
mov word [rbp - 0x1b], 0x646e
mov byte [rbp - 0x20], 0x53
mov byte [rbp - 0x14], bl
mov byte [rbp - 0x19], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x18001d138
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
call fcn.180008bc8
test rax, rax
je 0x18001d191
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x15], 0x776f646e
mov rcx, rax
mov dword [rbp - 0x1b], 0x65766974
mov dword [rbp - 0x20], 0x41746553
mov word [rbp - 0x17], 0x6957
mov byte [rbp - 0x11], bl
mov byte [rbp - 0x1c], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x18001d524
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r15, r9
mov r14, r8
mov esi, edx
mov rdi, rcx
xor ebx, ebx
call fcn.180008bc8
test rax, rax
je 0x18000901a
lea rdx, [rbp - 0x28]
mov word [rbp - 0x20], 0x6f48
mov rcx, rax
mov word [rbp - 0x25], 0x4e6c
mov word [rbp - 0x28], 0x6143
mov dword [rbp - 0x1d], 0x78456b
mov word [rbp - 0x23], 0x7865
mov byte [rbp - 0x26], 0x6c
mov byte [rbp - 0x21], 0x74
mov byte [rbp - 0x1e], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000901a
mov r9, r15
mov r8, r14
mov edx, esi
mov rcx, rdi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.18000bcc0
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r9, r8
mov r8, rdx
mov edx, ecx
xor ecx, ecx
jmp 0x180008f98
Function at 0x1400111f9
Capabilities:
Terminate process

Disassembly:
jmp 0x140012e70
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011276
Capabilities:
Execute command

Disassembly:
jmp 0x140011890
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rcx, [0x1400210a2]
call fcn.140011375
mov dword [rbp + 0x44], 0
mov eax, dword [rbp + 0x44]
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
mov dword [rbp + 4], eax
xor eax, eax
cmp eax, 1
je 0x140011944
lea rcx, [0x140019c24]
call qword [sym.imp.ucrtbased.dll_system]
mov r9d, dword [rbp + 0x44]
mov r8d, dword [rbp + 0x24]
mov edx, dword [rbp + 4]
lea rcx, str._02d:__02d:__02d
call fcn.14001119f
mov eax, dword [rbp + 0x44]
inc eax
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0x3c
jne 0x140011906
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
mov dword [rbp + 0x44], 0
cmp dword [rbp + 0x24], 0x3c
jne 0x14001191b
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov dword [rbp + 0x24], 0
cmp dword [rbp + 4], 0x18
jne 0x140011934
mov dword [rbp + 0x44], 0
mov eax, dword [rbp + 0x44]
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
mov dword [rbp + 4], eax
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400118be
xor eax, eax
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x140011280
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400141c0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400141e0
xor al, al
jmp 0x140014261
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400141f3
xor al, al
jmp 0x140014261
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001421d
xor al, al
jmp 0x140014261
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014231
xor al, al
jmp 0x140014261
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014243
xor al, al
jmp 0x140014261
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001425f
xor al, al
jmp 0x140014261
mov al, 1
add rsp, 0x38
ret
Function at 0x1406f3058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406f31df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406f3089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406f306f
add dl, dl
jne 0x1406f3096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406f30f6
xor eax, eax
add dl, dl
jne 0x1406f30a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406f31ad
add dl, dl
jne 0x1406f30b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f30c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f30d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f30dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406f30ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406f307e
mov eax, 1
add dl, dl
jne 0x1406f3106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f3113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406f30fb
sub eax, ebx
mov ebx, 1
jne 0x1406f314c
mov ecx, 1
add dl, dl
jne 0x1406f312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406f313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406f3123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406f307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406f3168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406f3175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406f315d
cmp eax, 0x7d00
jae 0x1406f319b
cmp eax, 0x500
jb 0x1406f3196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406f307e
cmp eax, 0x7f
ja 0x1406f319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406f307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406f31d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406f307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400033c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
movaps xmmword [rax - 0x28], xmm6
mov rsi, rdx
movsxd rdx, dword [0x1400e7054]
mov rdi, rcx
movaps xmmword [rax - 0x38], xmm7
lea rcx, [0x1400e7070]
movaps xmmword [rax - 0x48], xmm8
mov rbx, r9
shl rdx, 5
mov rbp, r8
add rdx, qword [0x1400e7058]
movaps xmmword [rax - 0x58], xmm9
movaps xmmword [rax - 0x68], xmm10
call fcn.140003ed0
lea r8, [rsp + 0x30]
xorps xmm9, xmm9
mov ecx, dword [rax]
shl ecx, 5
movsxd rdx, ecx
mov rcx, qword [0x1400e6ea0]
add rdx, rbx
xor ebx, ebx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 0xc]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm8, dword [rsp + 0x30]
movss xmm7, dword [rsp + 0x34]
movss xmm6, dword [rsp + 0x38]
subss xmm8, dword [rdi + 0x20]
subss xmm7, dword [rdi + 0x24]
subss xmm6, dword [rdi + 0x28]
movaps xmm0, xmm8
movaps xmm1, xmm7
xorps xmm6, xmmword [0x1400d4050]
call fcn.140098e78
movaps xmm1, xmm0
movaps xmm0, xmm6
call fcn.1400991c8
movaps xmm10, xmm0
movaps xmm1, xmm8
mulss xmm10, dword [0x1400d3b4c]
movaps xmm0, xmm7
subss xmm10, dword [rdi + 0x38]
call fcn.1400991c8
movaps xmm7, xmm0
xorps xmm8, xmm8
mulss xmm7, dword [0x1400d3b4c]
movaps xmm0, xmm10
xorps xmm6, xmm6
subss xmm7, dword [rdi + 0x3c]
movaps xmm1, xmm7
call fcn.140098e78
movss xmm1, dword [0x1400e7048]
comiss xmm1, xmm0
jbe 0x1400034e6
movaps xmm8, xmm10
movaps xmm6, xmm7
movss xmm7, dword [0x1400d3b58]
comiss xmm8, xmm7
movss xmm1, dword [0x1400d3b7c]
movss xmm0, dword [0x1400d3b6c]
jbe 0x14000350a
comiss xmm0, xmm8
jae 0x140003528
comiss xmm8, xmm0
movaps xmm7, xmm8
jbe 0x140003518
subss xmm7, xmm1
movss xmm2, dword [0x1400d3be8]
comiss xmm2, xmm7
jbe 0x140003528
movaps xmm7, xmm2
comiss xmm6, xmm0
jbe 0x140003531
subss xmm6, xmm1
movss xmm0, dword [0x1400d3bf0]
comiss xmm0, xmm6
jbe 0x140003542
addss xmm6, xmm1
divss xmm7, dword [0x1400e7044]
divss xmm6, dword [0x1400e7044]
ucomiss xmm7, xmm9
jp 0x14000356e
jne 0x14000356e
ucomiss xmm6, xmm9
jp 0x14000356e
jne 0x14000356e
mov qword [0x1400e6e88], rbx
jmp 0x1400035ee
cmp byte [0x1400e7080], bl
je 0x1400035a1
movsxd rdx, dword [0x1400e7084]
lea rcx, [0x1400e70b8]
shl rdx, 5
add rdx, qword [0x1400e70a0]
call fcn.140003ed0
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400035ee
movss xmm0, dword [rsi + 8]
lea r8, [rsp + 0x30]
addss xmm7, dword [rsi]
addss xmm6, dword [rsi + 4]
mov rcx, qword [0x1400e6ea0]
addss xmm0, xmm9
mov r9d, 0xc
mov qword [rsp + 0x20], rbx
mov rdx, rbp
movaps xmm1, xmm7
unpcklps xmm1, xmm6
movss dword [rsp + 0x48], xmm0
mov eax, dword [rsp + 0x48]
movsd qword [rsp + 0x30], xmm1
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001f210
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14001f26d
lea rbx, [0x1400cc530]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14001f254
cmp r10, 2
jb 0x14001f254
cmp byte [r9], r8b
jne 0x14001f254
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14001f230
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14001f2af
lea rbx, [0x1400cc530]
cmp r8b, 0x23
jne 0x14001f293
cmp byte [r9], r8b
jne 0x14001f293
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14001f280
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x1400221a0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x1400cc530]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f28], ebx
jne 0x140022236
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.140036880
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140022240
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xf8]
lea r9, [0x1400cc530]
movss xmm2, dword [rcx + 0x110]
movss xmm3, dword [rcx + 0x114]
movsxd rcx, dword [rcx + 0xf0]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret