joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011253
Capabilities:
Terminate process

Disassembly:
jmp 0x140013b00
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112f3
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014e50
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014e70
xor al, al
jmp 0x140014ef1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014e83
xor al, al
jmp 0x140014ef1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014ead
xor al, al
jmp 0x140014ef1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014ec1
xor al, al
jmp 0x140014ef1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014ed3
xor al, al
jmp 0x140014ef1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014eef
xor al, al
jmp 0x140014ef1
mov al, 1
add rsp, 0x38
ret
Function at 0x140009b9d
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov esi, ecx
mov eax, 0x30
mov rax, qword gs:[eax]
mov rax, qword [rax + 0x60]
mov rdi, qword [rax + 0x18]
add rdi, 0x10
mov rdi, qword [rdi]
movzx edx, word [rdi + 0x58]
mov rcx, qword [rdi + 0x60]
call fcn.140009c7d
cmp eax, 0x1edab0ed
jne 0x140009bc5
mov rbx, qword [rdi + 0x30]
movsxd rax, dword [rbx + 0x3c]
mov eax, dword [rax + rbx + 0x88]
test rax, rax
je 0x140009c5b
mov r15d, dword [rax + rbx + 0x18]
mov ecx, dword [rax + rbx + 0x1c]
add rcx, rbx
mov qword [rsp + 0x20], rcx
mov r12d, dword [rax + rbx + 0x20]
add r12, rbx
mov r13d, dword [rax + rbx + 0x24]
add r13, rbx
xor edi, edi
xor r14d, r14d
cmp r14, r15
je 0x140009c5d
mov rbp, r14
mov ecx, dword [r12 + r14*4]
add rcx, rbx
mov rax, rcx
mov rdx, rax
inc rax
cmp byte [rdx], 0
jne 0x140009c28
lea r14, [rbp + 1]
sub rdx, rcx
call fcn.140009c7d
cmp eax, esi
jne 0x140009c16
movzx eax, word [r13 + rbp*2]
cmp r15, rax
jbe 0x140009c79
mov rcx, qword [rsp + 0x20]
mov edi, dword [rcx + rax*4]
add rdi, rbx
jmp 0x140009c5d
xor edi, edi
movzx eax, word [rdi + 4]
add rdi, 0x12
mov rdx, rdi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2

Function at 0x140009c7d
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
xor r8d, r8d
cmp r8, rdx
jae 0x140009cb9
mov r9b, byte [rcx + r8]
test r9b, r9b
jne 0x140009c98
inc r8
jmp 0x140009c85
lea r10d, [r9 - 0x20]
cmp r9b, 0x61
movzx r9d, r9b
movzx r10d, r10b
cmovb r10d, r9d
imul r9d, eax, 0x21
movzx eax, r10b
add eax, r9d
jmp 0x140009c93
ret

Function at 0x14000a79c
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rcx
test r9, r9
je 0x14000a7df
mov r15, r9
mov r14, r8
mov rbx, qword [rsp + 0x100]
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x14000a7fc
Function at 0x14000c1e3
Capabilities:
Query environment variable

Disassembly:
mov r8d, 0x11
jmp fcn.14000be8c

Function at 0x14000c25b
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x14000c288
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.14000a2b3
ud2

Function at 0x14000c4c1
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
test rcx, rcx
je 0x14000c4e0
mov rax, qword [rcx]
and qword [rcx], 0
test rax, rax
je 0x14000c4e0
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
jmp 0x14000c514
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x14000c50f
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x14000c514
call fcn.14000c25b
mov ecx, dword [0x140030b84]
mov r8, qword gs:[0x58]
mov rcx, qword [r8 + rcx*8]
mov qword [rcx + 0xa0], 1
mov qword [rcx + 0xa8], rax
mov qword [rcx + 0xb0], rdx
add rsp, 0x38
ret

Function at 0x14000f6c5
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x2c]
mov rcx, rax
call sub.SHELL32.dll_CommandLineToArgvW
test rax, rax
je 0x14000f75e
mov rdi, rax
movsxd r12, dword [rsp + 0x2c]
lea rbx, [rsp + 0x30]
mov qword [rbx], 8
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
shl r12, 3
xor r13d, r13d
lea r14, [rsp + 0x48]
cmp r12, r13
je 0x14000f743
mov r15, qword [rdi + r13]
mov rcx, r15
call fcn.140017034
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.14000cc5f
mov rcx, rbx
mov rdx, r14
call fcn.14000f94d
add r13, 8
jmp 0x14000f713
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
jmp 0x14000f76c
mov qword [rsi], 8
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140012b19
Capabilities:
Reference wmi statements

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
and qword [rsp + 0x38], 0
mov rsi, rdx
mov rdi, rcx
cmp qword [rdx + 0x10], 0
je 0x140012bdd
lea rcx, [0x140025112]
call sub.OLEAUT32.dll_SysReAllocString
mov rbx, rax
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.OLEAUT32.dll_SysReAllocString
mov r14, rax
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
and qword [rsp + 0x20], 0
mov rdx, rbx
mov r8, r14
mov r9d, 0x30
call qword [rax + 0xa0]
mov ebp, eax
mov rcx, rbx
call sub.OLEAUT32.dll_SysStringLen
mov rcx, r14
call sub.OLEAUT32.dll_SysStringLen
test ebp, ebp
js 0x140012bdd
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
call fcn.140011685
mov qword [rsi + 0x20], 1
mov qword [rsi + 0x28], rbx
mov rax, qword [rsi + 0x30]
mov qword [rdi + 0x30], rax
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rax, qword [rsi + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [rsi + 0x28]
mov qword [rdi + 0x28], rax
jmp 0x140012bec
mov qword [rdi], 2
mov rcx, rsi
call fcn.140011609
nop
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140013a6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140013ab6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140013ab6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140013ab6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140013ab6
cmp dword [rcx + 0x84], 0xe
jbe 0x140013ab6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140013ab8
xor al, al
add rsp, 0x28
ret

Function at 0x140017e7c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140017c78
Function at 0x14001af8c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14001afbc
xor eax, eax
jmp 0x14001b07f
mov rbp, rbx
cmp word [rax], si
je 0x14001afe1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14001afc8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14001afc4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14001aeac
movsxd r14, eax
test eax, eax
jne 0x14001b01f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14001afb5
mov rcx, r14
call fcn.14001887c
mov rdi, rax
test rax, rax
jne 0x14001b038
xor ecx, ecx
call fcn.1400188dc
jmp 0x14001b014
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14001aeac
test eax, eax
jne 0x14001b069
mov rcx, rdi
call fcn.1400188dc
jmp 0x14001b073
xor ecx, ecx
call fcn.1400188dc
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14001e510
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140019f7c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14001e59a
cmp byte [rbp - 0x21], r15b
je 0x14001e595
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14001e5d0
call fcn.14001c618
test eax, eax
jne 0x14001e5bc
cmp byte [rbp - 0x21], r15b
je 0x14001e5b4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14001e5d0
cmp byte [rbp - 0x21], r15b
je 0x14001e5cd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14001955c
test eax, eax
jne 0x14001e670
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140019f7c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001e60f
cmp byte [rbp - 0x21], r15b
je 0x14001e644
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14001e644
call fcn.14001c618
test eax, eax
jne 0x14001e630
cmp byte [rbp - 0x21], r15b
je 0x14001e629
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14001e644
cmp byte [rbp - 0x21], r15b
je 0x14001e641
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14001955c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14001e670
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14001e673
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14001e681
mov rcx, rdi
call fcn.1400188dc
cmp byte [rbp + 0x3f], r15b
je 0x14001e690
mov rcx, qword [rbp + 0x27]
call fcn.1400188dc
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180e067e8
Capabilities:
Encode data using xor

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x180e06811
pop rbp
sub rbp, 0x29
sub rbp, 0xe067e8
jmp 0x180e06871
cmp edx, 1
je 0x180e068a5
ldmxcsr dword [rsp]
add rsp, 8
popfq
pop r15
pop r14
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rdi
pop rsi
pop rbp
pop rbx
pop rdx
pop rcx
pop rax
xor rax, rax
ret
sub rsp, 0x20
in al, dx
and byte [rax], al
add byte [rax], al
jmp 0x180e068b5
mov rax, 0xe067e8
add rax, rbp
add rax, 0xff
mov rcx, 0x64a
mov rdx, 0x3f4f56ab
add byte [rax + 1], cl
call fcn.180a0ea0b
add byte [rax], al
add byte [rax - 0x39], cl
ror dword [rdx + 6], 0
add byte [rax - 0x39], cl
ret 0x56ab
xor byte [rax], dl
inc rax
dec rcx
jne 0x180e068d4
test edx, esi
invalid
jmp 0x180e068eb
jrcxz 0x180e0690f
and byte [rdx], spl
xchg edi, eax
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
jrcxz 0x180e06920
push 0xffffffffffffffa3
stosb byte [rdi], al
stosd dword [rdi], eax
stosd dword [rdi], eax
jrcxz 0x180e068a7
jrcxz 0x180e0696c
imul esp, dword [rcx - 0x1c545455], 0x6c
imul eax, dword [rbx - 0x1c545455], 0xaae3495c
jrcxz 0x180e068bb
push 0x20
sub ah, byte [rdi - 0x1c545455]
stosb byte [rdi], al
sti
sti
jrcxz 0x180e06932
invalid
invalid
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
jrcxz 0x180e0693b
xlatb
js 0x180e06992
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
jrcxz 0x180e068dd
stosb byte [rdi], al
jrcxz 0x180e06947
std
sub dword [rcx + 0x78], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
scasb al, byte [rdi]
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
mov ebp, 0x6aababab
test eax, 0x2ae3ba9a
stosd dword [rdi], eax
push 0x43
test eax, 0x2ae3ba9a
push 0xffffffffffffffaf
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
jrcxz 0x180e069aa
invalid
jrcxz 0x180e06980
xlatb
js 0x180e069d7
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
jrcxz 0x180e06922
scasb al, byte [rdi]
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
test eax, 0x43f9abab
test eax, 0x43f9abab
invalid
invalid
sub edx, dword [rax + 0x43]
movsb byte [rdi], byte [rsi]
invalid
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
jrcxz 0x180e06a06
scasd eax, dword [rdi]
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
sbb dl, byte [rsp + r10*2 + 0x54]
invalid
std
cld
invalid
Function at 0x140002f40
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140002f9d
lea rbx, [0x140033810]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002f84
cmp r10, 2
jb 0x140002f84
cmp byte [r9], r8b
jne 0x140002f84
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002f60
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140002fdf
lea rbx, [0x140033810]
cmp r8b, 0x23
jne 0x140002fc3
cmp byte [r9], r8b
jne 0x140002fc3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002fb0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003140
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000315a
mov qword [r8], 0
lea rdx, [0x140033370]
call fcn.140002ff0
mov rbx, rax
test rax, rax
jne 0x14000317a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140003265
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003265
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140003265
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003265
cmp rdi, 0xffffffffffffffff
je 0x140003265
mov rax, qword [0x14003e6a8]
test rax, rax
je 0x1400031f6
inc dword [rax + 0xec]
mov rdx, qword [0x14003e698]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rsi, rax
test rax, rax
je 0x140003265
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140003252
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14003e6a8]
test rax, rax
je 0x140003241
dec dword [rax + 0xec]
mov rdx, qword [0x14003e698]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x14000326e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140003260
mov qword [r14], rdi
mov rax, rsi
jmp 0x140003270
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140005a10
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x140033810]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f20], ebx
jne 0x140005aa6
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.140018150
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1400116b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14003e6a8]
mov edi, ecx
cmp byte [rbx + 0x4a81], 0
jne 0x140011711
cmp byte [rbx + 0x4a82], 0
jne 0x140011711
movsx r9d, word [rbx + 0x5bb2]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002e30
test dil, 2
je 0x14001183f
jmp 0x14001179a
movss xmm1, dword [rbx + 0x3894]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5bb2]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140038710]
mulss xmm1, dword [0x140038708]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe00]
addss xmm1, dword [rbx + 0xe04]
mov qword [rbx + 0x47d0], rax
mov dword [rbx + 0x47bc], 1
movss dword [rbx + 0x47c8], xmm0
movss dword [rbx + 0x47cc], xmm1
movss xmm0, dword [rbx + 0x38f0]
mulss xmm0, dword [0x140038670]
or dword [rbx + 0x47b8], 0x41
movss dword [rbx + 0x4818], xmm0
call fcn.140002e30
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400117f0
lea r11, [0x140033810]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x1400117d3
cmp byte [r8], r9b
jne 0x1400117d3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400117c0
not ecx
call fcn.140009200
test rax, rax
je 0x14001183f
cmp byte [rax + 0xb6], 0
je 0x14001183f
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5bb2]
movsx r9d, word [rbx + 0x5bb2]
call fcn.140002e30
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000ba50
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14002fe00
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140016a20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5ca0], 0
lea rbx, [rcx + 0x5ca8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140016ac7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140016a7a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140018d20
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400035c0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5ca0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5cb0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14003e6a0]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140016acf
mov rcx, rbx
call fcn.1400035c0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140016f70
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14003e6a8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140016fd3
mov qword [rsp], rbx
lea rbx, [0x140033810]
nop dword [rax]
cmp r9b, 0x23
jne 0x140016fb3
cmp byte [r8], r9b
jne 0x140016fb3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140016fa0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c10]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x140017007
mov r10, qword [r10 + 0x5c18]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14001700e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140016ff4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14002a350
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x14003e6a8]
mov edx, 0x210
call fcn.14000e5d0
cmp byte [rax], 0
je 0x14002a3c6
xor edx, edx
mov ecx, 0x210
call fcn.140010a80
test al, al
je 0x14002a3c6
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14002a3c6
mov rbx, qword [0x14003e6a8]
cmp byte [rbx + 0x37b1], 0
je 0x14002a3b2
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.1400028e0
mov dword [rbx + 0x378], 0x210
mov dword [rbx + 0x938], 0xa0
mov rcx, qword [0x14003e6a8]
mov edx, 0x214
call fcn.14000e5d0
cmp byte [rax], 0
je 0x14002a436
xor edx, edx
mov ecx, 0x214
call fcn.140010a80
test al, al
je 0x14002a436
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14002a436
mov rbx, qword [0x14003e6a8]
cmp byte [rbx + 0x37b1], 0
je 0x14002a422
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.1400028e0
mov dword [rbx + 0x37c], 0x214
mov dword [rbx + 0x948], 0xa1
mov rcx, qword [0x14003e6a8]
mov edx, 0x212
call fcn.14000e5d0
cmp byte [rax], 0
je 0x14002a4a6
xor edx, edx
mov ecx, 0x212
call fcn.140010a80
test al, al
je 0x14002a4a6
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14002a4a6
mov rbx, qword [0x14003e6a8]
cmp byte [rbx + 0x37b1], 0
je 0x14002a492
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.1400028e0
mov dword [rbx + 0x264], 0x212
mov dword [rbx + 0x940], 0x5b
mov rcx, qword [0x14003e6a8]
mov edx, 0x216
call fcn.14000e5d0
cmp byte [rax], 0
je 0x14002a516
xor edx, edx
mov ecx, 0x216
call fcn.140010a80
test al, al
je 0x14002a516
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14002a516
mov rbx, qword [0x14003e6a8]
cmp byte [rbx + 0x37b1], 0
je 0x14002a502
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.1400028e0
mov dword [rbx + 0x268], 0x216
mov dword [rbx + 0x950], 0x5c
add rsp, 0x20
pop rbx
ret