joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140105a20
Capabilities:
Encode data using xor

Disassembly:
push rbx
nop
add rsp, 0x1e70ae5f
sub rsp, 0x1e70ae7f
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x78]
mov rdx, qword [rbx + 0x648]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.140101eb0
lea rcx, [rbx + 0x640]
lea rdx, [rsp + 0x30]
call fcn.1400fad60
mov rcx, rbx
nop
add rsp, 0x5d8366dc
sub rsp, 0x5d8366bc
pop rbx
jmp 0x140105a20
push rbx
nop
sub rsp, 0x223a039f
add rsp, 0x223a037f
cmp qword [rcx + 0x648], 0
mov rbx, rcx
je 0x140105b6d
lea rdx, [rsp + 0x30]
call fcn.1400f0050
mov r8, qword [rsp + 0x30]
mov r11d, 0x51391d3b
xor r11d, 0x3b919d76
sub r11d, 0x6aa87fad
mov r9d, dword [rsp + 0x34]
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x648]
mov rdx, qword [rbx + 0x648]
cmp eax, r11d
cmovl r11d, eax
xor r10d, r10d
test rdx, rdx
je 0x140105b1c
mov rax, qword [rbx + 0x640]
mov qword [rsp + 0x38], rdi
lea rdi, [rax + rdx*8]
cmp rax, rdi
je 0x140105b17
mov r8d, r11d
xor r8d, 0x5cc136f8
xor r9d, 0x5cc136f8
nop word [rax + rax]
mov rdx, qword [rax]
mov ecx, r10d
xor ecx, 0x5cc136f8
add r10d, r11d
nop
add rax, 0x439cf3d9
sub rax, 0x439cf3d1
mov dword [rdx + 0x30], ecx
mov dword [rdx + 0x34], 0x157816d4
xor dword [rdx + 0x34], 0x3bffa2fe
add dword [rdx + 0x34], 0x13a2c0e4
xor dword [rdx + 0x34], 0x1eeb43f6
mov dword [rdx + 0x38], r8d
mov dword [rdx + 0x3c], r9d
cmp rax, rdi
jne 0x140105ac1
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x140105b65
sub r8d, r9d
mov dword [rax + 0x14], 0x4ea90b8
add dword [rax + 0x14], 0x2aa9d0d
add dword [rax + 0x14], 0x2e790bf6
add dword [rax + 0x14], 0x26b2fd3d
xor r8d, 0x5cc136f8
xor r9d, 0x5cc136f8
mov dword [rax + 0x10], r8d
mov dword [rax + 0x18], r9d
mov dword [rax + 0x1c], r9d
mov rcx, rbx
call fcn.1400ef7c0
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop rbx
ret
Function at 0x14011940c
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 0x10], r14
xchg r14, rbx
xchg r14, rsi
mov qword [rsp + 0x18], r14
xchg r14, rsi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
xchg r13, rsp
mov rbp, r13
xchg r13, rsp
add rsp, 0x709fcd35
sub rsp, 0x709fcdb5
xor esi, esi
mov dword [rbp - 0x50], 0xc67000f
add dword [rbp - 0x50], 0x3a6d3d26
sub dword [rbp - 0x50], 0x1b6da301
xor dword [rbp - 0x50], 0x1a371e1a
sub dword [rbp - 0x50], 0x31338388
mov dword [rbp - 0x4c], 0x292faaf4
xor dword [rbp - 0x4c], 0x355a7adc
xor dword [rbp - 0x4c], 0x16072139
add dword [rbp - 0x4c], 0x1590b0b8
xor dword [rbp - 0x4c], 0x2072a1de
mov r14d, 0x5d1c39cf
sub r14d, 0x168817b6
add r14d, 0x2ecc68ac
sub r14d, 0x5c7ae836
sub r14d, 0x18e5a287
mov dword [rbp - 0x48], 0x3a79a62b
sub dword [rbp - 0x48], 0x15a34003
add dword [rbp - 0x48], 0x50ff43ee
xor dword [rbp - 0x48], 0x6cc9e7fb
xor dword [rbp - 0x48], 0x19084d5e
mov dword [rbp - 0x44], 0x541189a4
sub dword [rbp - 0x44], 0x2e53838d
add dword [rbp - 0x44], 0x190fedd0
xor dword [rbp - 0x44], 0x3eb3f3ef
xchg rsi, rdi
mov qword [rbp + 0x20], rdi
xchg rdi, rsi
lea ebx, [rsi + 1]
mov dword [rsp - 0x14], 0x4fd4bfe4
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x20]
and cl, 3
mov r10, r10
shl cl, 1
shl cl, 2
movzx edx, word [rbp + rax*2 - 0x50]
xchg rbp, rbp
mov eax, 0x2ccc144b
xor eax, 0x3b3e2970
add eax, 0x289f44e3
xor eax, 0x72c9cee8
shr eax, cl
movzx ecx, al
mov rax, qword [rbp + 0x20]
mov r9, r9
xor cx, dx
mov word [rbp + rax*2 - 0x20], cx
mov rax, qword [rbp + 0x20]
add rax, rbx
mov rdx, rdx
mov qword [rbp + 0x20], rax
xchg rsp, rax
mov rsp, qword [rbp + 0x20]
xchg rsp, rax
cmp rax, r14
jb 0x140119510
lea rax, [rbp - 0x20]
mov dword [rsp - 0x30], esi
mov word [rbp - 0x10], si
xorps xmm0, xmm0
xchg r11, rax
mov qword [rbp - 0x38], r11
xchg r11, rax
lea r9, [rbp - 0x30]
mov dword [rbp - 0x40], 0x71422d7e
xor dword [rbp - 0x40], 0x12575cff
add dword [rbp - 0x40], 0xbfb305e
sub dword [rbp - 0x40], 0x6efea1cf
lea r8, [rbp - 0x40]
mov dword [rsp + 0x20], esi
mov dword [rsp - 0x1c], edi
xor edx, edx
xor ecx, ecx
movups xmmword [rbp - 0x30], xmm0
mov dword [rsp - 0x28], 0x6e33acd6
call fcn.140133f80
mov rdi, rax
test rax, rax
je 0x140119605
mov dword [rsp - 0x38], ecx
mov rcx, rax
call fcn.14010fc7c
test al, al
je 0x140119605
mov rbp, rbp
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.14010eb88
mov dword [rsp - 0x30], edx
test al, al
jne 0x14011960b
mov bl, sil
xchg r11, r11
xor eax, eax
lea r11, [rsp + 0x80]
mov rsi, qword [r11 + 0x30]
mov dword [rsp - 0x28], esi
lea rdi, [rbp - 0x20]
xchg rcx, rdi
mov rdi, r14
xchg rdi, rcx
rep stosb byte [rdi], al
mov al, bl
mov rbx, qword [r11 + 0x28]
mov dword [rsp - 0x44], edi
xchg r11, rbp
mov rsp, rbp
xchg r11, rbp
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x14011d850
Capabilities:
Encode data using xor

Disassembly:
push rbx
add rsp, 0x3e3fdb31
sub rsp, 0x3e3fdd61
mov rax, qword [0x1401422b0]
mov dword [rsp - 0x28], 0x55d93eb2
lea rdx, [rsp + 0x20]
mov rbx, rcx
rol rax, 5
rol rax, 5
movabs rcx, 0x653dad19773f9aa4
add rcx, 0x635ba53
sub rcx, 0xa2bcb5c
sub rcx, 0x3451a9ea
add rcx, 0x2cb4c015
xor r9d, r9d
mov rbx, rbx
xor rax, rcx
movabs rcx, 0x1ad0914909693c91
xor rcx, 0x558dd283
xor rcx, 0x47103b6a
add rcx, 0x20a5341d
sub rcx, 0x3bb78026
add rax, rcx
movabs rcx, 0x4e9f19262bb826ec
add rcx, 0x17757123
add rcx, 0x3a684e96
add rcx, 0x5485e949
not rax
add rax, rcx
xchg rbx, rbx
lea r8d, [r9 + 8]
xor ecx, ecx
call rax
mov dword [rsp - 0x24], 0x32ab8c87
lea rcx, [rbx + 8]
xorps xmm0, xmm0
xchg rcx, rdx
mov qword [rbx], rdx
xchg rdx, rcx
xchg rcx, r14
movups xmmword [r14], xmm0
xchg r14, rcx
xchg rcx, r15
movups xmmword [r15 + 0x10], xmm0
xchg r15, rcx
xchg rbp, rcx
movups xmmword [rbp + 0x20], xmm0
xchg rbp, rcx
test eax, eax
je 0x14011da74
mov dword [rsp - 0x1c], 0x320304b2
lea rax, [rsp + 0x20]
nop
movabs rdx, 0xffffffff686cacd3
sub rdx, 0x66c6d7f6
xor rdx, 0x303db9f0
add rdx, 0x24ace010
add rdx, 0x7fffffff
xor rdx, 0x29bab2c3
inc rdx
mov dword [rsp - 0x40], 0x32b1fa76
cmp word [rax + rdx*2], 0
jne 0x14011d981
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
xchg r15, rdx
mov qword [rbx + 0x38], r15
xchg rdx, r15
call fcn.140017890
xor r8d, r8d
xchg rbp, rdx
mov rbp, rax
xchg rbp, rdx
mov ecx, 0x64f460a1
add ecx, 0x11ca572a
sub ecx, 0x1ea0e426
xor ecx, 0x6646e67a
xor ecx, 0xc037929
cmp qword [rbx + 0x38], r8
mov dword [rsp - 0x18], 0x6670deb8
jbe 0x14011da7b
lea r9, [rsp + 0x20]
mov r10d, 0x62d65ccc
add r10d, 0x57c9910
xor r10d, 0x3711181a
xor r10d, 0x2bff431a
sub r10d, 0x74bcaddd
sub r9, rax
mov dword [rsp - 0x30], 0x6345a7e6
nop dword [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
mov r11, r11
and ax, r10w
ror ecx, 3
ror ecx, 2
ror ecx, 1
ror ecx, 1
ror ecx, 1
xor ax, word [r9 + rdx - 2]
inc r8
xchg r12, r12
mov word [rdx - 2], ax
cmp r8, qword [rbx + 0x38]
jb 0x14011da21
mov dword [rsp - 0x38], esi
mov rax, rbx
neg rsp
add rsp, 0xfffffffffffffdd0
neg rsp
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
xor r8d, r8d
mov qword [rbx + 0x38], r8
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
add rsp, 0x230
xchg rcx, rcx
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
Function at 0x14011dce0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov rbx, rbx
neg rsp
sub rsp, 0xfffffffffffffdd0
neg rsp
mov rdx, qword [0x1401423e0]
xchg r10, rbx
mov r10, rcx
xchg r10, rbx
movabs rcx, 0x3e70ed3f16eb7f2e
add rcx, 0x27b44584
add rcx, 0x3dc6950
add rcx, 0x7fffffff
add rcx, 0x202f9358
movabs rax, 0xb361eaae5e35d5d7
sub rax, 0x2232f2d9
sub rax, 0x2a0d7db1
add rax, 0x7fffffff
add rax, 0x3bfb426d
add rdx, rcx
mov dword [rsp - 0x2c], 0x52089ab
movabs rcx, 0x4698cdf717c3233b
add rcx, 0x63390dc8
sub rcx, 0x6184522d
sub rcx, 0xde01f48
xor rcx, 0x2f5031d3
rol rdx, 5
rol rdx, 0x15
rol rdx, 5
rol rdx, 2
rol rdx, 2
rol rdx, 1
add rax, rdx
mov edx, 0x22afbb43
add edx, 0x140e33a1
add edx, 0xaee4259
xor edx, 0x58cb9f9
sub edx, 0x442087c0
xor rax, rcx
mov dword [rsp - 0x18], 0x49661ee7
movabs rcx, 0x5a00883d0bb36031
xor rcx, 0x3597e24e
add rcx, 0x3feba898
add rcx, 0x69eb454e
sub rax, rcx
lea rcx, [rsp + 0x20]
mov r11, r11
call rax
lea rax, [rbx + 8]
xorps xmm0, xmm0
mov qword [rbx], rax
xchg r9, r9
nop
movabs rdx, 0xffffffff07fa3136
add rdx, 0x7451d4f8
sub rdx, 0x4177da31
xor rdx, 0x4a61e317
add rdx, 0x7fffffff
add rdx, 0xf4a3716
movups xmmword [rax], xmm0
mov dword [rsp - 0x3c], 0x7abcda08
xchg r12, rax
movups xmmword [r12 + 0x10], xmm0
xchg r12, rax
xchg r11, rax
movups xmmword [r11 + 0x20], xmm0
xchg r11, rax
lea rax, [rsp + 0x20]
nop dword [rax + rax]
xchg rsp, rsp
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14011de52
mov rcx, rbx
xchg r15, r15
xchg rsp, rdx
mov qword [rbx + 0x38], rsp
xchg rsp, rdx
call fcn.140017890
xchg rsp, rsp
xor r8d, r8d
mov edx, 0x30c51179
xor edx, 0x57b192f8
xor edx, 0xf5f680d
sub edx, 0x35d39e96
cmp qword [rbx + 0x38], r8
jbe 0x14011df09
mov dword [rsp - 0x20], 0x255f6880
lea r9, [rsp + 0x20]
mov r10d, 0x6fa7b61e
xor r10d, 0x144e74f8
xor r10d, 0x2b1faab4
sub r10d, 0x3d86fd46
sub r10d, 0x136f6a0d
sub r9, rax
movzx ecx, dx
lea rax, [rax + 2]
mov dword [rsp - 0x28], 0x2e76cf06
and cx, r10w
ror edx, 2
ror edx, 6
xor cx, word [r9 + rax - 2]
xchg r11, r11
inc r8
mov word [rax - 2], cx
cmp r8, qword [rbx + 0x38]
mov dword [rsp - 0x44], 0x25df1686
jb 0x14011dece
xchg rsi, rbx
mov rax, rsi
xchg rbx, rsi
add rsp, 0x230
nop
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x140133f80
Capabilities:
Execute syscall

Disassembly:
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140142ba4]
xchg rdx, rdx
cmp qword [0x140142bb8], 0
jne 0x14008deb0
syscall
ret
jmp 0x14008e9e1
Function at 0x140136638
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0x20], 0x2e57c5ef
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
xchg rsi, rsi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
xchg rbp, r10
mov r10, rsp
xchg r10, rbp
neg rsp
sub rsp, 0xffffffffffffff90
neg rsp
xchg rcx, rdi
mov rcx, r8
xchg rcx, rdi
xchg r14, rbp
mov rbp, rdx
xchg rbp, r14
xchg r10, rsi
mov r10, rcx
xchg rsi, r10
movabs r12, 0x7bd70e006f744d0a
xor r12, 0x5774fdce
add r12, 0x1cdc6861
sub r12, 0xbd61667
cmp r9d, 0x60001
jne 0x140136853
mov r13, r13
mov dword [rbp - 0x40], 0x69248d6f
xor dword [rbp - 0x40], 0x7d9c30d0
xor dword [rbp - 0x40], 0x54d26124
xor dword [rbp - 0x40], 0x5278e867
add dword [rbp - 0x40], 0x9bb4926
xor edx, edx
mov dword [rbp - 0x3c], 0x685e9ece
sub dword [rbp - 0x3c], 0x1dcbf79c
sub dword [rbp - 0x3c], 0x2d23dfa3
xor dword [rbp - 0x3c], 0x2af8a8b8
mov dword [rbp - 0x38], 0x70dfd9f7
xor dword [rbp - 0x38], 0x59b643cb
add dword [rbp - 0x38], 0xc0484
xor dword [rbp - 0x38], 0x6e7df582
xor dword [rbp - 0x38], 0x4566d1ee
mov ecx, edx
mov rsi, rsi
mov eax, 0x46824f5b
xor eax, 0x1ab89ff4
add eax, 0x19ab9ef7
add eax, 0x366c5bd
rol eax, cl
xor al, byte [rbp + rdx - 0x40]
mov dword [rsp - 0x28], ebx
mov byte [rbp + rdx - 0x34], al
inc rdx
cmp rdx, 0xc
mov r12, r12
jb 0x140136728
mov r9d, 0x3e9c2be0
add r9d, 0x275a21f8
add r9d, 0x108d21d1
sub r9d, 0x76835faa
mov qword [rsp + 0x20], 0x57bddaa3
add qword [rsp + 0x20], 0x1f93fde1
xor qword [rsp + 0x20], 0x354666bf
xor qword [rsp + 0x20], 0x4217be37
lea r8, [rbp - 0x34]
mov dword [rsp - 0x10], 0x71e99480
xchg rdx, r14
mov r14, rdi
xchg rdx, r14
xchg rcx, rsi
mov rsi, r14
xchg rcx, rsi
call fcn.140133bc8
mov dword [rsp - 0x3c], 0x654bcb
xchg rbx, r10
mov r10, rax
xchg rbx, r10
lea rdi, [rbp - 0x34]
mov dword [rsp - 0x30], ebx
xor eax, eax
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
test rbx, rbx
mov dword [rsp - 0x3c], 0x685a0dfd
je 0x140136897
lea rdx, [rbp - 0x28]
lea rcx, [rbx + 0xc]
call fcn.140090280
xchg rbx, rbx
test dword [rbp - 7], 0x1000
jne 0x140136897
cmp byte [rbp - 0x1d], 0xe8
jne 0x140136897
mov dword [rsp - 0x40], esi
lea rdx, [rbx + 0xc]
xchg rcx, r9
mov r9, r14
xchg r9, rcx
call fcn.140085b40
movzx edx, byte [rbp - 0x28]
xchg r12, r12
add edx, dword [rbp - 0x13]
add edx, eax
mov rax, qword [rsi + 8]
xor rax, r12
mov dword [rsp - 0xc], ebp
add rdx, rax
xor rdx, r12
mov qword [rsi + 0x20], rdx
mov rbp, rbp
cmp qword [rsi + 0x20], r12
setne al
lea r11, [rsp + 0x70]
mov rcx, rcx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
xchg r13, rdi
mov r13, qword [r11 + 0x30]
xchg rdi, r13
mov rsp, r11
xchg r12, r12
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
xor al, al
xchg r8, r8
jmp 0x14013685a
Function at 0x1401368a4
Capabilities:
Hash data using murmur3

Disassembly:
mov r11, rsp
push rbx
mov dword [rsp - 0x2c], esi
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
mov r9, qword [0x140142438]
lea r8, [r11 + 0x18]
mov r14, r14
and qword [r11 + 0x10], 0
lea rdx, [r11 + 0x10]
and qword [r11 + 0x18], 0
xchg rdx, rbx
mov rdx, rcx
xchg rdx, rbx
movabs rcx, 0x87236446e4a20ad
sub rcx, 0x39ae8416
add rcx, 0x44cbfd08
xor rcx, 0x8839e58
xor rcx, 0x6216897a
movabs rax, 0x3371d3f4761cc338
sub rax, 0x587a2d7
add rax, 0x3051cd1
sub rax, 0x2575ee29
sub rax, 0x2b55da37
add r9, rcx
mov dword [rsp - 0x40], 0x1635b107
or rcx, 0xffffffffffffffff
xor r9, rax
movabs rax, 0x4143fd0179627a81
sub rax, 0x7f27b8d
xor rax, 0x7f5a77de
add rax, 0x7fffffff
add rax, 0x4108e05
rol r9, 0x20
rol r9, 9
rol r9, 1
sub r9, rax
xchg rsp, rsp
rol r9, 0x27
rol r9, 8
rol r9, 6
rol r9, 4
rol r9, 1
call r9
mov dword [rsp - 0x10], esp
test eax, eax
je 0x140136aba
xchg r10, r8
mov r10, qword [rsp + 0x38]
xchg r8, r10
xor edx, edx
mov dword [rsp - 0x30], esp
xor ecx, ecx
mov eax, 0xca81bf3
add eax, 0x5f1af804
sub eax, 0x880cbd6
sub eax, 0x63424820
shl rax, cl
mov dword [rsp - 0x20], 0x246dbbdf
test r8, rax
jne 0x1401369da
inc rcx
cmp rcx, 0x40
mov rbp, rbp
jb 0x14013699d
jmp 0x1401369e1
xchg rdi, rax
mov rdx, rdi
xchg rdi, rax
mov r8, qword [0x140142448]
mov rdx, rdx
movabs rcx, 0xf7efdcbb4edf41a2
xor rcx, 0x2b043218
add rcx, 0x1a209f87
sub rcx, 0x728718fe
xor rcx, 0x41d096e7
add r8, rcx
movabs rax, 0x7feceb2c2c67d47a
xor rax, 0x4a686dda
xor rax, 0x693149ef
add rax, 0x7fffffff
add rax, 0x1861379c
not r8
mov r13, r13
nop
movabs rcx, 0xffffffff58016a07
xor rcx, 0x5cac4c75
add rcx, 0x2c1fa349
add rcx, 0x7fffffff
add rcx, 0x4f333644
add r8, rax
movabs rax, 0x35277d077cd89be9
sub rax, 0x537af741
add rax, 0xa57ca77
sub rax, 0xa39b027
rol r8, 0xd
rol r8, 4
sub r8, rax
rol r8, 1
rol r8, 0xf
rol r8, 1
rol r8, 2
rol r8, 1
rol r8, 2
rol r8, 2
rol r8, 2
call r8
test rax, rax
mov dword [rsp - 0x2c], esi
mov qword [rbx], rax
setne al
add rsp, 0x20
xchg r8, r8
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
Function at 0x1407200b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140720237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407200e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407200c7
add dl, dl
jne 0x1407200ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14072014e
xor eax, eax
add dl, dl
jne 0x1407200fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140720205
add dl, dl
jne 0x14072010e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14072011b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140720128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140720135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140720142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407200d6
mov eax, 1
add dl, dl
jne 0x14072015e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14072016b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140720153
sub eax, ebx
mov ebx, 1
jne 0x1407201a4
mov ecx, 1
add dl, dl
jne 0x140720186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140720193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14072017b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407200d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407201c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407201cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407201b5
cmp eax, 0x7d00
jae 0x1407201f3
cmp eax, 0x500
jb 0x1407201ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407200d6
cmp eax, 0x7f
ja 0x1407201f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407200d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14072022a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407200d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001070
Capabilities:
Execute command
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x20
lea rdx, str.Minecraft_1.20.2___Singleplayer
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
test rax, rax
jne 0x1400010a2
lea rcx, str.Failed_to_find_window
call fcn.140001010
lea eax, [rdi - 2]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Press_F12_to_start_stop_mining_
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
call fcn.1400011d0
mov rcx, rax
lea rdx, [0x1400013a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
lea rbp, str.mining
nop dword [rax]
mov ecx, 0x7b
movzx esi, bl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140001151
test bl, bl
lea rcx, [0x140003380]
sete bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Press_F12_to_start_stop_mining_
call fcn.1400011d0
mov rcx, rax
lea rdx, [0x1400013a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.not_mining
test sil, sil
cmove rdx, rbp
call fcn.1400011d0
mov rcx, rax
lea rdx, [0x1400013a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x1400011ac
test bl, bl
je 0x1400010e0
mov edx, 0x201
mov r9d, 0x6400c8
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x202
mov r9d, 0x6400c8
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400010e0
mov rsi, qword [rsp + 0x40]
mov eax, 0xffffffff
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140001d34
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d7e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d7e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d7e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d7e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d7e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d80
xor al, al
add rsp, 0x28
ret
Function at 0x140017228
Capabilities:
Move file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
call fcn.140023b70
mov rdi, rax
mov rbx, rdx
mov rcx, rsi
call fcn.140023b70
mov r9, rdx
mov rcx, rdi
mov rdx, rbx
mov r8, rax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400aae90

Function at 0x140017b11
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140017b47
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x140017b4f
mov esi, dword [rdx]
mov r9d, 4
jmp 0x140017b54
xor r10d, r10d
jmp 0x140017c02
xor r9d, r9d
xor esi, esi
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140017b77
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140017b8e
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140017bae
add r11, r8
jmp 0x140017cd2
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140017c76
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140017c24
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x140017c88
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x140017c8e
xor r8d, r8d
xor r9d, r9d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140017cb4
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140017cce
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret