joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1809aa5f5
Capabilities:
Encode data using xor

Disassembly:
add rbp, 0x4de259c4
sub word [rsp + 0x50], 0x4387
cmp byte [rsp + 8], 0xc7
not word [rsp + 0x40]
not byte [rsp + 0x50]
not dword [rsp + 0x48]
not byte [rsp + 0x50]
lea r8, [r12*4 + 0x437310de]
movabs r12, 0x7013405b283b60a1
setb r8b
call fcn.18055d6a8
lodsb al, byte [rsi]
in al, 0x95
or dh, 0xca
lodsd eax, dword [esi]
cld
xchg dword [0x1a295258c], edi
jl 0x1809aa5de
add eax, 0x5c2bfe3
sti
mov ebx, dword [rcx]
mov eax, 0x978afefb
loope 0x1809aa649
sti
dec byte [rdx + 0x48fae197]
stosb byte [rdi], al
cli
stosb byte [rdi], al
fst dword [rcx + 0x23b7cd04]
add al, 4
xor al, 0x50
sub dword [rbp + rax + 0x73513010], esp
cli
int1
mov r8b, 0x99
add eax, 0xb8b730a6
cld
jg 0x1809aa64e
sub byte [rdx - 6], 0xd9
xor eax, 0x89058aac
test dword [rdx], edx
adc bl, bh
test eax, 0xfbadfe43
mov edx, 0xfaf44798
jbe 0x1809aa690
or dword [rsp + rax - 0x45240ea5], eax
add eax, 0xb4e9fff7
pushfq
in al, dx
invalid
idiv edi
jmp 0x1e487434b

Function at 0x1809bf0a2
Capabilities:
Encode data using xor

Disassembly:
adc al, dh
add byte [rax], al
setns r11b
neg rdi
cmp r9d, edi
setb r11b
or r8w, 0x5f8
lea rdi, [r9 + r11*8 + 0x6370730e]
add r9w, 0x27bb
add r8d, 0x3d7601f3
not r11b
or dil, 0x29
neg rdi
setl r11b
call fcn.180a65233
or dword [rax + rcx*8 + 0x77], edx
mov esp, 0xcf928598
cdq
push rcx
mov ebx, gs
pushfq
and r10b, bl
xor al, 0xb9
int1
xchg edi, eax
movabs byte [0xc3d07bdf957781c], al
sub eax, 0xb1b2bd8e
jp 0x1809bf09e
fcom qword [rax + rdx*2 - 0x14]
fcomp dword [rax - 0xa]
invalid

Function at 0x180a0140b
Capabilities:
Encode data using xor

Disassembly:
test qword [rsp + 0x38], 0x48631564
jg 0x180a69cc8
add byte [rsp + 8], 0x7d
call fcn.180983076
mov rdx, qword [rsp + 0x48]
test word [rsp + 0x38], 0x6d35
jge 0x18056028d

Function at 0x180a32bb9
Capabilities:
Authenticate hmac

Disassembly:
test qword [rsp + 0x50], 0x29cc1837
jbe 0x180b287e1
sub r14d, r13d
sub byte [rsp + 0x50], r14b
test r14, r13
call fcn.180a90d4e
mov dword [rsp + 0x10], 0xa1711d3
sete r9b
mov r9, qword [rsp + 8]
lea rsp, [rsp + 0x18]
ret 8
push r15

Function at 0x180a4a04c
Capabilities:
Execute syscall

Disassembly:
push qword [rsp + 0x68]
popfq
lea rsp, [rsp + 0x70]
call fcn.180b9a78d
sbb al, 0x55
invalid
Function at 0x180a8d699
Capabilities:
Encode data using xor

Disassembly:
and qword [rsp + 0x20], 0x6a3d424f
cmp r8w, cx
movsx r8w, byte [rsp + 0x25]
mov rcx, qword [rsp + 0x18]
call fcn.1809903a5
add byte [rdi - 0x2ef81eea], dh
jge 0x180a8d6f8
sub byte [rdi], dh
cmpsd dword [rsi], dword [rdi]
pop r11
sbb ch, byte [rcx]
jmp 0x180a8d6df
imul byte [rbp - 0x5d01d2ad]
sahf
sbb cl, dh
add eax, 0x1aa6b570
outsb dx, byte [rsi]
invalid
loope 0x180a8d6ee
sbb cl, byte [rcx + 0x15]
cmpsb byte [rsi], byte [rdi]
sbb eax, 0x6e2daace
add ebp, dword [rcx]
sal dword [rcx - 0x77], cl
push rcx
add dword [rsi], ebp
jle 0x180a8d765
adc ebx, dword [rcx + rcx*4 + 0x5e]
xor eax, 0x98e1495d
sbb al, 0x42
sub eax, 0x871c50b6
xor al, 0x74
xchg esp, eax
xchg ecx, eax
movabs dword [0xfd922049b903743e], eax
cmp eax, 0xa3e763c6
pop rsp
scasb al, byte [rdi]
stosd dword [rdi], eax
and dword [rbp + 0x29166cd5], ebx
sbb rax, 0xffffffffbcf75809
fimul word [rdi + 0x46]
adc ah, byte [rsi + 0x72]
sal ah, 0xa4
test eax, 0x75c65449
pop rdi
ja 0x180a8d70e
push rsi
invalid
pop rdi
invalid

Function at 0x180a9f4b7
Capabilities:
Encode data using xor

Disassembly:
movzx r14w, r14b
setle byte [rsp + 0x20]
mov qword [rsp + 0x20], 0x200b0175
or dword [rsp + 0x20], 0x21ad4ee1
cmp qword [rsp + 0x20], 0x6997419c
jno 0x180ad81b1
setns r14b
cmp rcx, 0x129e3334
mov rcx, qword [rsp + 0x18]
movabs r14, 0x16c06f804c670ded
movsx r14w, r14w
movsxd r14, r14d
jae 0x180a80755
xchg eax, ebx
or eax, 0x457dffaf
invalid

Function at 0x180aa516c
Capabilities:
Authenticate hmac

Disassembly:
mov r13, qword [rsp + 0x18]
jg 0x180aa5e71

Function at 0x180ae9f2e
Capabilities:
Encode data using xor

Disassembly:
lea rcx, [rcx*2 + 0x3b881a15]
ja 0x18098dee9
lea rcx, [rcx*4 + 0x6ead61fc]
jne 0x180a070c6

Function at 0x180af24b4
Capabilities:
Authenticate hmac

Disassembly:
add qword [rsp + 8], 0x7fa71208
sub word [rsp + 0x20], 0x6248
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x68]
add qword [rsp + 0x10], 0x7faa5ddc
neg byte [rsp + 0x28]
add word [rsp + 0x28], 0x1fef
not byte [rsp + 0x28]
setbe byte [rsp + 0x28]
neg dword [rsp + 0x20]
mov byte [rsp + 0x28], 0x94
mov r12, qword [rsp + 0x50]
mov dword [rsp + 0x28], 0x39e820c6
jae 0x180a72651
add byte [rsp + 0x28], 2
jae 0x180a8de16
push r10
movabs r10, 0x477d6cdf65fa0ad4
movsx r10w, r10w
pushfq
sub r10w, 0x349
push r15
setge r10b
push rsi
mov rsi, r10
mov r15, rsi
xor r15, 0x5d6148b0
not r15
add r10, rsi
push r11
je 0x180aed23f
cmp rsi, r10
movabs r11, 0x2ed103d44b4c294e
push rbp
not si
movabs rbp, 0x55042e81645d7fff
not r15w
call fcn.180556fdb
setno r9b
mov r9w, 0x91
xor byte [rsp + 0x20], 0x82
xor dword [rsp + 0x28], 0x637c7b36
setle byte [rsp + 0x28]
test qword [rsp + 0x20], 0x754a73bd
setae byte [rsp + 0x28]
mov qword [rsp + 0x28], 0xb654a7e
js 0x180b16dcb
add qword [rsp + 0x28], 0x8231e60
cmp dword [rsp + 0x28], 0x4efb4cc4
jne 0x180a03dc1
neg si
lea rbx, [rbx*2 + 0x3c3e725e]
and r13w, 0x67a2
lea rdx, [rbx*4 + 0x271671a4]
jno 0x180a7b7f0
jg 0x1809bdc3b
mov word [rsp + 0x28], 0x3f5f
jl 0x180a826cf
lea r13, [r13 + 0x2fa42038]
lea r9, [r13 + r9*4 + 0xdae11b5]
mov r13, qword [rsp + 0x10]
mov r9d, 0x79c6c4c
mov r9, qword [rsp]
lea rsp, [rsp + 8]
ret 0x10
Function at 0x1409480b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140948237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1409480e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409480c7
add dl, dl
jne 0x1409480ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14094814e
xor eax, eax
add dl, dl
jne 0x1409480fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140948205
add dl, dl
jne 0x14094810e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14094811b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140948128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140948135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140948142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1409480d6
mov eax, 1
add dl, dl
jne 0x14094815e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14094816b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140948153
sub eax, ebx
mov ebx, 1
jne 0x1409481a4
mov ecx, 1
add dl, dl
jne 0x140948186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140948193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14094817b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409480d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1409481c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409481cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409481b5
cmp eax, 0x7d00
jae 0x1409481f3
cmp eax, 0x500
jb 0x1409481ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409480d6
cmp eax, 0x7f
ja 0x1409481f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409480d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14094822a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1409480d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140ba8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140ba81df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140ba8089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ba806f
add dl, dl
jne 0x140ba8096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ba80f6
xor eax, eax
add dl, dl
jne 0x140ba80a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ba81ad
add dl, dl
jne 0x140ba80b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ba80c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ba80d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ba80dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140ba80ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140ba807e
mov eax, 1
add dl, dl
jne 0x140ba8106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ba8113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ba80fb
sub eax, ebx
mov ebx, 1
jne 0x140ba814c
mov ecx, 1
add dl, dl
jne 0x140ba812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ba813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ba8123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ba807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140ba8168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ba8175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ba815d
cmp eax, 0x7d00
jae 0x140ba819b
cmp eax, 0x500
jb 0x140ba8196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ba807e
cmp eax, 0x7f
ja 0x140ba819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ba807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140ba81d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140ba807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140003748
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss xmm0, dword [r8]
xorps xmm1, xmm1
ucomiss xmm0, xmm1
jp 0x140003764
jne 0x140003764
movss xmm0, dword [r8 + 4]
ucomiss xmm0, xmm1
jp 0x140003764
je 0x140003782
mov rax, qword [0x140110e60]
movsd xmm0, qword [r8]
movsd qword [rax + 0x1af4], xmm0
mov dword [rax + 0x1acc], 4
comiss xmm3, xmm1
jb 0x1400037a0
mov rax, qword [0x140110e60]
movss dword [rax + 0x1b28], xmm3
mov dword [rax + 0x1ae0], 1
mov r8d, dword [rsp + 0x28]
jmp fcn.1400037ac
Function at 0x140009398
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0x1e8]
mov r10, r8
movsxd r9, dword [rcx + 0x1e0]
mov r11, rdx
mov rcx, r11
mov r8d, dword [rax + r9*4 - 4]
mov eax, r10d
sub eax, edx
neg r10
sbb edx, edx
and edx, eax
jmp fcn.140009e08

Function at 0x140009a98
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r15, r9d
mov rsi, r8
test r8, r8
je 0x140009abf
and qword [r8], 0
call fcn.140009bd4
mov rbx, rax
test rax, rax
je 0x140009bb8
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140009baf
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140009baf
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140009baf
mov rax, qword [0x140110e60]
mov rbp, rdi
test rax, rax
je 0x140009b27
inc dword [rax + 0x3c8]
mov rdx, qword [0x140110e70]
lea rcx, [r15 + rdi]
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x140009baf
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rbp
je 0x140009b86
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140110e60]
test rax, rax
je 0x140009b74
dec dword [rax + 0x3c8]
mov rdx, qword [0x140110e70]
mov rcx, rdi
call qword [0x14004d008]
jmp 0x140009bb8
test r15d, r15d
jle 0x140009b99
lea rcx, [rdi + rbp]
mov r8, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140009baa
mov qword [rsi], rbp
mov rax, rdi
jmp 0x140009bba
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140009e08
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
cmp dword [0x140110e94], 0
lea rsi, [0x140110e90]
mov ebx, r8d
mov edi, edx
mov r10, rcx
jne 0x140009e6f
xor r9d, r9d
mov r11, rsi
mov r8d, r9d
mov edx, 8
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov r8d, ecx
xor r8d, eax
sub rdx, 1
jne 0x140009e3d
mov dword [r11], r8d
inc r9d
add r11, 4
cmp r9d, 0x100
jb 0x140009e35
not ebx
mov edx, ebx
test edi, edi
jle 0x140009e91
movzx eax, byte [r10]
inc r10
movzx ecx, dl
xor rcx, rax
shr edx, 8
xor edx, dword [rsi + rcx*4]
sub edi, 1
jne 0x140009e77
jmp 0x140009ecb
mov r8b, byte [r10]
inc r10
test r8b, r8b
je 0x140009ecb
mov r9b, 0x23
cmp r8b, r9b
jne 0x140009eb0
cmp byte [r10], r9b
jne 0x140009eb0
cmp byte [r10 + 1], r9b
cmove edx, ebx
movzx ecx, dl
movzx eax, r8b
mov r8b, byte [r10]
xor rcx, rax
shr edx, 8
inc r10
xor edx, dword [rsi + rcx*4]
test r8b, r8b
jne 0x140009e9f
mov rbx, qword [rsp + 8]
not edx
mov rsi, qword [rsp + 0x10]
mov eax, edx
mov rdi, qword [rsp + 0x18]
ret
Function at 0x14000f240
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140110e60]
mov rbx, rcx
and dword [rax + 0x2d9c], 0
test rcx, rcx
je 0x14000f2a9
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.14000f2b4
lea rdx, [0x140042a54]
mov rcx, rbx
mov rdi, rax
call fcn.140009bd4
mov rbx, rax
test rax, rax
je 0x14000f2a9
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001dae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r14d, r14d
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rsi, rdx
movsxd rdi, r9d
mov rbp, rcx
test r9d, r9d
jle 0x14001dcd1
lea rbx, [r8 + 0x20]
xor r13d, r13d
lea r8d, [r14 + 1]
mov r11d, 0x100
xorps xmm7, xmm7
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x14001db82
movsxd r10, dword [rsi + 0x24]
mov r9, qword [rsi + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
mov r8d, 1
movd xmm0, eax
jmp 0x14001dba4
movsxd rdx, dword [rsi + 0x1c]
mov rax, qword [rsi + 8]
xorps xmm6, xmmword [0x140042be0]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
mov al, byte [rbp + 0x20]
xor r15d, r15d
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
mov al, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], r15d
jle 0x14001dcc4
mov rcx, qword [rsp + 0xe0]
mov rax, r13
shl rax, 4
add rcx, 6
xor r12d, r12d
add rcx, rax
mov qword [rsp + 0x60], rcx
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x14001dbf2
mov edx, dword [rbx - 0x1c]
add edx, r15d
jmp 0x14001dbf6
mov edx, dword [rax + r12]
mov rcx, rsi
call fcn.14001d24c
mov edx, eax
xorps xmm3, xmm3
mov eax, dword [rbp + 0x24]
xorps xmm2, xmm2
mov rcx, rsi
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
mulss xmm3, xmm6
mulss xmm2, xmm6
movss dword [rsp + 0x20], xmm7
call fcn.14001d684
mov rcx, qword [rsp + 0x60]
mov r8d, 1
movzx eax, word [rbp + 0x20]
add r14d, r8d
sub ax, word [rsp + 0xd8]
add r13, r8
add ax, word [rbp + 0x1c]
add r15d, r8d
add ax, word [rsp + 0x50]
add r12, 4
sub ax, r8w
mov word [rcx - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x54]
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x58]
sub ax, r8w
mov word [rcx], ax
add rcx, 0x10
mov qword [rsp + 0x60], rcx
cmp r15d, dword [rbx - 0x10]
jl 0x14001dbe1
mov r11d, 0x100
add rbx, 0x28
sub rdi, r8
jne 0x14001db30
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov eax, r14d
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001ee30
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140110d40]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.1400093c8
mov rcx, qword [0x1401112e8]
lea rdx, [rbp - 0x18]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp - 0x10]
sub ecx, dword [rbp - 0x18]
movd xmm1, ecx
mov ecx, dword [rbp - 0xc]
sub ecx, dword [rbp - 0x14]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rbp - 0x20]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x20]
xorps xmm1, xmm1
sub rax, qword [0x1401112f0]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x1401112f8]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rbp - 0x20]
mov qword [0x1401112f0], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov ecx, 0x10
mov byte [rdi + 0x128], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, bl
mov byte [rdi + 0x129], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
mov byte [rdi + 0x12b], 0
mov byte [rdi + 0x12a], al
call fcn.1400093c8
cmp byte [rax + 0x3a7], 0
lea rbx, [rax + 0x110]
je 0x14001ef59
cvttss2si ecx, dword [rbx]
lea rdx, [rbp - 0x30]
cvttss2si eax, dword [rax + 0x114]
mov dword [rbp - 0x30], ecx
mov rcx, qword [0x1401112e8]
mov dword [rbp - 0x2c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x2c]
mov ecx, dword [rbp - 0x30]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, 0xff7fffff
mov dword [rbx], eax
mov dword [rbx + 4], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x1401112e8]
jne 0x14001efae
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14001efae
mov rcx, qword [0x1401112e8]
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x14001efae
movd xmm0, dword [rbp - 0x28]
movd xmm1, dword [rbp - 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x14001efbc
or eax, 0xffffffff
jmp 0x14001efc1
call fcn.14000944c
cmp dword [0x14004d138], eax
je 0x14001efd4
mov dword [0x14004d138], eax
call fcn.14001effc
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003f820
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x14002be98
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov dword [rsp + 0x34], 0xc0000001
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0x240
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwOpenKey]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x14002bfe8
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call fcn.140038c38
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14002bf3c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
xor eax, eax
jmp 0x14002bfea
mov eax, dword [rsp + 0x30]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x30]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x40]
mov r8d, 1
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwQueryValueKey]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x14002bfa5
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x30], eax
je 0x14002bfbf
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
jmp 0x14002bfea
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + rax]
jmp 0x14002bfea
xor eax, eax
add rsp, 0x88
ret
Function at 0x140030a64
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x48
mov eax, 4
imul rax, rax, 2
lea rcx, [0x140111fe8]
add rcx, rax
mov rax, rcx
mov ecx, 4
imul rcx, rcx, 1
lea rdx, [0x140111fe8]
add rdx, rcx
mov rcx, rdx
mov edx, 4
imul rdx, rdx, 0
lea r8, [0x140111fe8]
add r8, rdx
mov rdx, r8
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9, rdx
movss xmm2, dword [0x1401113d8]
movss xmm1, dword [0x1401113d4]
movss xmm0, dword [0x14010f520]
call fcn.1400073f8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140111ff4]
cmp eax, 1
jb 0x140030b4c
mov eax, dword [0x140111ff4]
cmp dword [0x140111ff8], eax
je 0x140030b40
movss xmm0, dword [0x1400482a8]
mulss xmm0, dword [0x14004d164]
mov eax, 4
imul rax, rax, 0
lea rcx, [0x140111fe8]
movss xmm1, dword [rcx + rax]
addss xmm1, xmm0
movaps xmm0, xmm1
mov eax, 4
imul rax, rax, 0
lea rcx, [0x140111fe8]
movss dword [rcx + rax], xmm0
mov eax, dword [0x140111ff4]
mov dword [0x140111ff8], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140111ff4], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x140111fe8]
xorps xmm0, xmm0
comiss xmm0, dword [rcx + rax]
jbe 0x140030b97
mov eax, 4
imul rax, rax, 0
lea rcx, [0x140111fe8]
movss xmm0, dword [rcx + rax]
addss xmm0, dword [0x140042b34]
mov eax, 4
imul rax, rax, 0
lea rcx, [0x140111fe8]
movss dword [rcx + rax], xmm0
mov eax, 4
imul rax, rax, 2
lea rcx, [0x140111fe8]
mov edx, 4
imul rdx, rdx, 1
lea r8, [0x140111fe8]
mov r9d, 4
imul r9, r9, 0
mov qword [rsp + 0x30], r9
lea r10, [0x140111fe8]
lea r11, [0x1401113d8]
mov qword [rsp + 0x28], r11
lea r11, [0x1401113d4]
mov qword [rsp + 0x20], r11
lea r9, [0x14010f520]
movss xmm2, dword [rcx + rax]
movss xmm1, dword [r8 + rdx]
mov rax, qword [rsp + 0x30]
movss xmm0, dword [r10 + rax]
call fcn.1400072ac
add rsp, 0x48
ret