joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009bc90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
lea r12, [r8 - 1]
mov r13, r9
mov rbp, r12
mov r14, r8
sar rbp, 1
mov rbx, rdx
mov rsi, rcx
mov r15, rdx
mov rdi, rdx
cmp rdx, rbp
jge 0x14009bd0d
add rdi, rdi
lea rcx, [rdi + 2]
shl rcx, 5
add rcx, rsi
lea rdx, [rcx - 0x20]
call fcn.140015e50
movzx eax, al
xor rax, 1
inc rax
add rdi, rax
mov rcx, rdi
shl rcx, 5
add rcx, rsi
call fcn.140002370
shl rbx, 5
mov rdx, rax
lea rcx, [rsi + rbx]
call fcn.140008a50
mov rbx, rdi
cmp rdi, rbp
jl 0x14009bcc2
cmp rdi, rbp
jne 0x14009bd3b
test r14b, 1
jne 0x14009bd3b
shl r14, 5
lea rcx, [rsi - 0x20]
add rcx, r14
call fcn.140002370
shl rbx, 5
mov rdx, rax
lea rcx, [rsi + rbx]
call fcn.140008a50
mov rbx, r12
mov rcx, r13
call fcn.140002370
mov r14, rax
cmp r15, rbx
jge 0x14009bd90
nop dword [rax + rax]
lea rdi, [rbx - 1]
mov rdx, r14
sar rdi, 1
mov rbp, rdi
shl rbp, 5
add rbp, rsi
mov rcx, rbp
call fcn.140015e50
test al, al
je 0x14009bd90
mov rcx, rbp
call fcn.140002370
shl rbx, 5
mov rdx, rax
lea rcx, [rsi + rbx]
call fcn.140008a50
mov rbx, rdi
cmp r15, rdi
jl 0x14009bd50
mov rcx, r14
call fcn.140002370
shl rbx, 5
mov rdx, rax
lea rcx, [rsi + rbx]
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.140008a50

Function at 0x14009d6a0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x60
mov rax, qword [0x140137088]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x58], rsi
xor ebx, ebx
cmp qword [rcx + 0x20], 0xffffffffffffffff
mov r14, r9
mov qword [rsp + 0x50], rdi
mov rsi, rdx
mov qword [rsp + 0x40], r15
mov edi, r8d
mov r15, rcx
mov ebp, ebx
jne 0x14009d6e5
mov ebx, 1
jmp 0x14009d736
mov qword [rsp + 0x48], r12
mov r12d, 0x100000
mov rcx, qword [r15 + 0x20]
lea r9, [rsp + 0x30]
mov r8d, edi
mov dword [rsp + 0x30], ebx
cmp edi, r12d
mov qword [rsp + 0x20], rbx
mov rdx, rsi
cmova r8d, r12d
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x30]
add ebp, ecx
test eax, eax
je 0x14009d72c
test ecx, ecx
je 0x14009d731
add rsi, rcx
sub edi, ecx
jne 0x14009d6f0
jmp 0x14009d731
mov ebx, 1
mov r12, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
mov eax, ebx
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
test r14, r14
je 0x14009d74f
mov dword [r14], ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400a8f20
add rsp, 0x60
pop r14
pop rbp
pop rbx
ret

Function at 0x14009e0d0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
cmp rcx, 0xffffffffffffffff
je 0x14009e10b
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14009e10b
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x20]
call fcn.1400a4080
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400a4080
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x140137088]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdi, rdx
cmp rcx, 0xffffffffffffffff
je 0x1400a40de
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400a40c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400a40de
mov ecx, dword [rsp + 0x20]
mov rax, rbx
shl rcx, 0x20
mov al, 1
add rcx, rbx
mov qword [rdi], rcx
jmp 0x1400a40e0
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a8f20
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a4290
Capabilities:
Get file size
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x140137088]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r13, r9
mov r12d, r8d
mov r15, rdx
mov rsi, rcx
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x30], rax
xor edi, edi
test rax, rax
je 0x1400a42de
mov dword [rax], edi
mov dword [r9], edi
cmp qword [rcx], 0xffffffffffffffff
je 0x1400a443c
mov eax, 0x100000
mov ebp, r12d
cmp r12d, eax
cmova ebp, eax
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x68]
mov r8d, ebp
mov rdx, r15
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, 0x80004005
test eax, eax
cmovne edx, edi
cmp qword [rsi + 0x28], 0
je 0x1400a4409
test edx, edx
je 0x1400a4409
mov ecx, dword [rsp + 0x68]
cmp ecx, ebp
jae 0x1400a440d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rbx, rdi
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
jne 0x1400a4359
xor dil, dil
jmp 0x1400a438c
mov dword [rsp + 0x6c], edi
lea rdx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
jne 0x1400a437e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400a437e
xor dil, dil
jmp 0x1400a438c
mov ebx, dword [rsp + 0x6c]
shl rbx, 0x20
add rbx, rdi
mov dil, 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
lea rdx, [rsi + 8]
lea rcx, [rsp + 0x48]
call fcn.140008af0
nop
mov rcx, qword [rsi + 0x28]
mov r10, qword [rcx]
mov r9, r14
xor r8d, r8d
test dil, dil
cmovne r8, rbx
mov rdx, rax
call qword [r10 + 0x30]
mov edx, eax
xor edi, edi
test eax, eax
jne 0x1400a4409
mov dword [rsp + 0x70], edi
mov edx, dword [rsp + 0x68]
add rdx, r15
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x70]
mov r8d, ebp
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, 0x80004005
test eax, eax
cmovne edx, edi
mov ecx, dword [rsp + 0x68]
add ecx, dword [rsp + 0x70]
mov dword [rsp + 0x68], ecx
test eax, eax
je 0x1400a4337
jmp 0x1400a440d
mov ecx, dword [rsp + 0x68]
add dword [r13], ecx
test edx, edx
jne 0x1400a4430
test ecx, ecx
je 0x1400a442c
mov eax, ecx
add r15, rax
sub r12d, ecx
mov eax, 0x100000
jne 0x1400a42f0
mov al, 1
jmp 0x1400a443e
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1400a443c
mov dword [rax], edx
xor al, al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400a8f20
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400bb4cc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400bb230

Function at 0x1400c1d34
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1400c1b9a
call fcn.1400ade3c
mov dword [rax], 0x16
call fcn.1400adc4c
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400c1b7c
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1400c1b7c
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x1400c1bcc
lock or dword [rax + 0x14], 0x10
jmp 0x1400c1b7c
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400c1be9
mov rcx, qword [rbp + 0x20]
call fcn.1400c2120
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x1400c1bfe
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x1400c1c04
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1400bef3c
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400caa90
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x1400c1c57
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x1400c1b7c
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1400c1cc3
mov rcx, qword [rbp + 0x20]
call fcn.1400bef3c
cmp eax, 0xffffffff
je 0x1400c1caa
mov rcx, qword [rbp + 0x20]
call fcn.1400bef3c
cmp eax, 0xfffffffe
je 0x1400c1caa
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1400bef3c
movsxd rdi, eax
lea r15, [0x14013aa30]
mov rcx, rbx
sar rdi, 6
call fcn.1400bef3c
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x1400c1cb1
lea rax, [0x140137440]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400c1cc3
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x1400c1cf9
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400c1cf5
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400c1cf5
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x1400c1d17
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x1400c1d22
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x1400c1b81
jmp 0x1400c1b48
Function at 0x140006394
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov r14, r8
movaps xmmword [rax - 0x28], xmm6
movsxd r8, dword [0x14009cbe4]
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm7
lea rdx, [rbp - 9]
shl r8, 5
mov rdi, rcx
add r8, qword [0x14009cbe8]
lea rcx, [0x14009cc00]
movaps xmmword [rax - 0x48], xmm8
mov rbx, r9
movaps xmmword [rax - 0x58], xmm10
call fcn.1400039dc
mov rcx, qword [0x14009cab0]
mov r8, qword [rax]
mov eax, dword [r8 + 0x40]
lea r8, [rbp - 0x29]
and dword [rbp - 0x29], 0
and dword [rbp - 0x25], 0
and dword [rbp - 0x21], 0
shl eax, 5
movsxd rdx, eax
add rdx, rbx
xor ebx, ebx
mov qword [rsp + 0x20], rbx
lea r15d, [rbx + 0xc]
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp - 0x29]
lea r9, [rdi + 0x38]
movss xmm1, dword [rbp - 0x25]
lea rdx, [rdi + 0x20]
movss dword [rbp - 0x19], xmm0
lea r8, [rbp - 0x19]
movss xmm0, dword [rbp - 0x21]
lea rcx, [rbp - 9]
movss dword [rbp - 0x11], xmm0
movss dword [rbp - 0x15], xmm1
call fcn.140005cac
movss xmm6, dword [0x14009cbd8]
xorps xmm7, xmm7
xorps xmm8, xmm8
xorps xmm10, xmm10
movsd xmm0, qword [rax]
mov eax, dword [rax + 8]
movsd qword [rbp - 0x29], xmm0
movss xmm1, dword [rbp - 0x25]
movss xmm0, dword [rbp - 0x29]
mov dword [rbp - 0x21], eax
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll__hypotf]
comiss xmm6, xmm0
jbe 0x1400064a9
movss xmm7, dword [rbp - 0x29]
movss xmm8, dword [rbp - 0x25]
movss xmm10, dword [rbp - 0x21]
lea rdx, [rbp - 0x19]
movss dword [rbp - 0x19], xmm7
lea rcx, [rbp - 9]
movss dword [rbp - 0x15], xmm8
movss dword [rbp - 0x11], xmm10
call fcn.14000663c
movsd xmm0, qword [rax]
movss xmm8, dword [rax + 8]
movsd qword [rbp - 0x19], xmm0
movss xmm7, dword [rbp - 0x19]
divss xmm7, dword [0x14009cbd4]
movss xmm6, dword [rbp - 0x15]
ucomiss xmm7, dword [0x140069e18]
divss xmm6, dword [0x14009cbd4]
jp 0x14000651b
jne 0x14000651b
ucomiss xmm6, dword [0x140069e18]
jp 0x14000651b
jne 0x14000651b
ucomiss xmm8, dword [0x140069e18]
jp 0x14000651b
jne 0x14000651b
mov qword [0x14009cd08], rbx
jmp 0x140006592
cmp byte [0x14009cc10], bl
je 0x140006556
movsxd r8, dword [0x14009cc14]
lea rdx, [rbp - 9]
shl r8, 5
lea rcx, [0x14009cc48]
add r8, qword [0x14009cc30]
call fcn.1400039dc
mov rcx, qword [rax]
mov ecx, dword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140006592
addss xmm7, dword [rsi]
addss xmm6, dword [rsi + 4]
addss xmm8, dword [rsi + 8]
mov rcx, qword [0x14009cab0]
lea r8, [rbp - 0x19]
mov r9, r15
mov qword [rsp + 0x20], rbx
movaps xmm0, xmm7
mov rdx, r14
unpcklps xmm0, xmm6
movsd qword [rbp - 0x19], xmm0
movss dword [rbp - 0x11], xmm8
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm10, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140017a28
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rdi, rcx
mov ebx, edx
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor esi, esi
test ax, ax
je 0x140017aab
test dword [0x14009c110], ebx
je 0x140017aab
lea ebx, [rsi + 4]
mov qword [rbp - 8], 0xf
xorps xmm0, xmm0
mov qword [rbp - 0x10], rbx
mov r8d, ebx
lea rdx, [0x14006d2f0]
lea rcx, [rbp - 0x20]
movups xmmword [rbp - 0x20], xmm0
call sub.VCRUNTIME140.dll_memmove
lea rdx, [rbp - 0x20]
mov byte [rbp - 0x1c], sil
lea rcx, [0x14009cbb8]
call fcn.14000583c
lea rdx, [rbp + 0x30]
mov dword [rbp + 0x30], esi
mov rcx, rax
call fcn.1400044c8
mov dword [rbp + 0x38], 0x10001
jmp 0x140017b00
mov ebx, 4
mov qword [rbp - 8], 0xf
xorps xmm0, xmm0
mov qword [rbp - 0x10], rbx
mov r8d, ebx
lea rdx, [0x14006d2f0]
lea rcx, [rbp - 0x20]
movups xmmword [rbp - 0x20], xmm0
call sub.VCRUNTIME140.dll_memmove
lea rdx, [rbp - 0x20]
mov byte [rbp - 0x1c], sil
lea rcx, [0x14009cbb8]
call fcn.14000583c
lea rdx, [rbp + 0x30]
mov dword [rbp + 0x30], esi
mov rcx, rax
call fcn.1400044c8
mov dword [rbp + 0x38], pe_nt_image_headers64
movsxd rdx, dword [rbp + 0x30]
lea r8, [rbp + 0x38]
mov rcx, qword [0x14009cab0]
add rdx, rdi
mov r9, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140022f34
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
test r8, r8
je 0x140022f5b
and qword [r8], 0
call fcn.140023000
mov rbx, rax
test rax, rax
je 0x140022fe3
mov rcx, rax
call fcn.140022ebc
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140022fdb
lea rcx, [rax + rbp]
call fcn.1400254f4
mov rsi, rax
test rax, rax
je 0x140022fdb
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp rax, rdi
je 0x140022fb4
mov rcx, rbx
call fcn.140022ea8
mov rcx, rsi
call fcn.140025544
jmp 0x140022fe3
test ebp, ebp
jle 0x140022fc6
lea rcx, [rsi + rdi]
mov r8, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call fcn.140022ea8
test r14, r14
je 0x140022fd6
mov qword [r14], rdi
mov rax, rsi
jmp 0x140022fe5
mov rcx, rbx
call fcn.140022ea8
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x14002337c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
not r8d
test rdx, rdx
je 0x1400233aa
movzx eax, byte [r9]
inc r9
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x14006de00]
xor r8d, dword [rax + rcx*4]
sub rdx, 1
jne 0x140023387
not r8d
mov eax, r8d
ret

Function at 0x1400233b4
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x14002340e
mov r11b, 0x23
lea rdi, [0x14006de00]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x1400233f8
cmp rdx, 2
jb 0x1400233f8
cmp byte [r10], r11b
jne 0x1400233f8
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x1400233d6
jmp 0x14002344f
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x14002344f
mov r11b, 0x23
lea rdi, [0x14006de00]
cmp dl, r11b
jne 0x140023433
cmp byte [r10], r11b
jne 0x140023433
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x140023421
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x1400253c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5d80], 0
lea rdi, [rcx + 0x5d88]
mov rbx, rcx
mov rsi, r8
mov rcx, rdi
mov rbp, rdx
je 0x14002543c
xor edx, edx
call fcn.140031328
mov r8, rsi
mov rdx, rbp
mov rcx, rdi
call fcn.140030520
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x5d80]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x14009cde0]
movsxd r8, eax
mov rax, qword [rbx + 0x5d90]
test rax, rax
cmovne rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x140025441
call fcn.140030520
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002bc98
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x14009cdd8]
mov rbx, rcx
and dword [rax + 0x5cdc], 0
test rcx, rcx
je 0x14002bcff
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.14002bd0c
lea rdx, [0x14006f1bc]
mov rcx, rbx
mov rdi, rax
call fcn.140023000
mov rbx, rax
test rax, rax
je 0x14002bcff
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rbx
call fcn.140022ea8
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140039a28
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
mov r10, rdx
movzx r9d, cx
mov eax, 0x5e6ea9af
shr ecx, 0x10
mul r8d
mov r11d, r8d
mov ebx, r8d
shr edx, 0xb
imul eax, edx, 0x15b0
sub r11d, eax
test r8d, r8d
je 0x140039b21
xor edx, edx
cmp r11d, 7
jbe 0x140039acd
lea r8d, [rdx + 7]
movzx eax, byte [r10]
add edx, 8
add r9d, eax
add r8d, 8
movzx eax, byte [r10 + 1]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 7]
add ecx, r9d
add r9d, eax
add r10, 8
add ecx, r9d
cmp r8d, r11d
jb 0x140039a66
cmp edx, r11d
jae 0x140039aec
mov eax, r11d
sub eax, edx
mov edx, eax
movzx eax, byte [r10]
inc r10
add r9d, eax
add ecx, r9d
sub rdx, 1
jne 0x140039ad9
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
sub ebx, r11d
mov r11d, 0x15b0
jne 0x140039a5a
mov rbx, qword [rsp + 8]
shl ecx, 0x10
lea eax, [r9 + rcx]
ret

Function at 0x140041528
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
call fcn.140040c64
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rbx + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140041561
and dword [rbx + 0x2c], eax
add rsp, 0x20
pop rbx
ret

Function at 0x140042284
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
Function at 0x14005f8e4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14009c248]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14005f953
cmp byte [rcx + 0x71], 0
je 0x14005f953
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14005f9a8
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14005f96d
sub eax, 1
je 0x14005f971
cmp eax, 2
jne 0x14005f9a8
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140066800
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14005f99f
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14005f9a8
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14005f955
xor al, al
jmp 0x14005f955
Function at 0x14006156c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14009c248]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x1400615a5
xor eax, eax
jmp 0x1400616b4
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x1400615ce
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, qword [rax]
cmp qword [rax], r8
jae 0x1400615ce
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x1400616b4
cmp qword [rcx + 0x80], 0
je 0x1400616b2
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140061609
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14006162a
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
jmp 0x1400616af
lea rax, [rbp - 0x38]
mov byte [rbp - 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x3f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x40]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140061678
sub eax, 1
je 0x140061678
cmp eax, 2
jne 0x1400616b2
movsx ecx, byte [rbp - 0x40]
jmp 0x140061616
mov r14, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x1400616a3
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x1400616b2
lea rax, [rbp - 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x30], rax
cmovne edi, esi
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140066800
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret