joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14098421d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], 0xffffffffcfa6ed39
dec dl
not word [rsp + 0x11]
not dl
jmp 0x1409bee4a
dec dl
jmp 0x14098ff8e

Function at 0x140988b6b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and al, dil
push 0xffffffff842cde1d
not al
push 0x5012e739
mov word [r10], ax
call fcn.1409b7ebf
mov r10d, 0x8a0da8a2
mov r10w, word [rbx]
add rbx, 2
mov esi, 0x79bff9a2
jmp 0x1409b3520
xor sil, r11b
rol sil, 1
inc sil
call fcn.14099e895
add edi, edi
mov dil, byte [r10 + 2]
mov qword [rsp], 0x4ab8dd05
or word [rsp + 6], 0xb58e
adc r10, 2
jmp 0x140988b53
ror rsi, 0xb8
movzx esi, byte [r8]
jae 0x1409be02f
push 0xffffffffd322c198
adc r8, 1
jmp 0x1409a4ab1

Function at 0x14098afd8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor r11b, r10b
jmp 0x14098b043
sub r9, 2
mov word [r9], r10w
lea rsp, [rsp + 0x18]
jmp fcn.140999a63

Function at 0x14098dacb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp], 0xffffffffdba80384
dec r10
xor r11, r10
sub r9, 8
mov qword [r9], r10
jmp 0x140995136
lea rsp, [rsp + 0x10]
jmp fcn.140999a63

Function at 0x14098e1c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor si, 0xef0a
rol si, 1
xor r9w, si
lea rsi, [rsp + rsi + 0x28]
mov dword [rsi], edi
lea rsp, [rsp + 0x28]
jmp fcn.1409a4f2c

Function at 0x14098e97f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ebx, 0xe4230da0
movzx ebx, byte [rcx]
xor ebx, edi
call fcn.14099c339
lea rsp, [rsp + 0x10]
jne 0x14098b9e7
mov ebx, 0xc10bb08
pop rbx
not edi
mov dword [r10], edi
push 0x559fc18d
call fcn.1409b3a2c

Function at 0x14098f102
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor bp, 0x5933
not bp
xor r9w, bp
lea rbp, [rsp + rbp + 0x10]
mov word [rbp + riz], di
lea rsp, [rsp + 0x10]
jmp fcn.1409a4f2c

Function at 0x14098fb87
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor r9, rdi
sub rbx, 8
mov qword [rbx], rdi
lea rsp, [rsp + 0x20]
jmp fcn.1409aef51

Function at 0x14099057d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
or rdx, 0xffffffff962e3b14
inc dl
xor r9w, cx
inc rdx
sal dx, 0x8c
lea rcx, [rsp + rcx + 8]
shl edx, 0x44
mov qword [rsp + rdx - 0x73ee0000], rdx
shr edx, 0xcc
movzx dx, byte [rcx + rdx*2 - 0xe7dc0]
sbb rbx, 2
push 0xffffffffed0e4499
mov word [rbx], dx
lea rsp, [rsp + 0x10]
jmp fcn.1409aef51

Function at 0x1409980a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor r9b, bpl
mov qword [rsp], 0xffffffffe30ce23f
lea rbp, [rsp + rbp + 0x28]
not byte [rsp + 0x17]
jmp 0x1409bf0c2
mov dword [rbp + riz], eax
push 0x8b1b186
lea rsp, [rsp + 0x30]
jmp fcn.1409a4f2c

Function at 0x140998f11
Capabilities:
Encrypt data using rc4 prga

Disassembly:
neg r9b
sub r9b, 0xad
rol r9b, 1
xor bl, r9b
mov qword [rsp], 0xffffffff8b081609
sub rbp, 2
mov word [rbp + riz], r9w
lea rsp, [rsp + 0x18]
jmp fcn.1409a25a2

Function at 0x14099c334
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1409b19eb
push 0xffffffffba801138
sub rsi, 0x44053238
not rsi
bswap rsi
ror byte [rsp + 5], 0x87
xor r9, rsi
mov qword [rsp + 8], 0x5983a409
sub rbx, 8
mov qword [rbx], rsi
jmp 0x1409989a1
Function at 0x14099d127
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rdi], rax
lea rsp, [rsp + 0x18]
jmp fcn.1409b96b9
xor r11b, dil
lea rdi, [rsp + rdi + 0x18]
jmp 0x140984842

Function at 0x14099d85a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
not qword [rsp + 8]
sar qword [rsp + 8], 0x27
xor r9b, bpl
mov qword [rsp], rsi
and byte [rsp + 0xf], 0x3b
lea rbp, [rsp + rbp + 0x10]
ror dword [rsp + 0xb], 0xf5
xadd word [rsp + 9], si
rol rsi, 0x3b
mov rsi, qword [rbp + riz]
sub rbx, 8
mov qword [rbx], rsi
not dword [rsp + 8]
lea rsp, [rsp + 0x10]
jmp fcn.1409aef51

Function at 0x14099dee2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rbx], rsi
not dword [rsp + 0xd]
lea rsp, [rsp + 0x18]
jmp fcn.1409aef51
ror qword [rsp + 0x10], 0xf5
ror rsi, 5
sub rsi, 0x44053238
not rsi
bswap rsi
xor r9, rsi
jmp 0x1409b3de9
sub rbx, 8
jmp 0x14098420c

Function at 0x1409a0a1d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.1409937a2
call fcn.140998374
jne 0x14098fdad
call fcn.1409b23c1
mov ecx, 0xdf31102c
shr cl, 0x64
movzx r8d, cl
mov r8, qword [rbp + r8*2 - 4]
sbb ecx, 0x103a62b9
mov rax, qword [rbp + 8]
xor cl, ch
or rcx, rcx
mov cl, byte [rbp + 0x10]
jge 0x1409be3b4
adc r9, 2
add al, bpl
jmp 0x1409a0a18
adc rbp, 0xa
shld r8, rax, cl
push 0x7235c98e
mov qword [rbp + riz], r8
jmp 0x140992716

Function at 0x1409a2894
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor cl, 0x81
mov cl, byte [rbx + 8]
adc rbx, 6
shrd edx, esi, cl
mov dword [rbx], edx
lea rsp, [rsp + 8]
jmp fcn.1409a4f2c

Function at 0x1409a63f6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rdi, [rsp + rdi + 0x10]
mov qword [rdi], rbp
lea rsp, [rsp + 0x10]
jmp fcn.1409b96b9
ror di, 1
dec di
ror di, 1
sub di, 0x66bc
xor r11w, di
jmp 0x1409a28bd

Function at 0x1409aa052
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [rax], bpl
lea rsp, [rsp + 0x10]
jmp fcn.1409a4f2c
lea rsp, [rsp + 0x10]
jp fcn.14098b228
xor r9w, ax
lea rax, [rsp + rax + 8]
push 0xffffffffa597282a
jmp 0x14099b451

Function at 0x1409ac5f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [r9], edx
lea rsp, [rsp + 0x10]
jmp fcn.140999a63
push 0xffffffffa51c1099
sal byte [rsp + 6], 1
xor dword [rsp + 0x10], edx
pop r11
mov r11, qword [rsp + 8]
mov qword [rsp + 8], 0xffffffffb8a1a380
sub r9, 4
jmp 0x14098df0c

Function at 0x1409ac860
Capabilities:
Encode data using xor

Disassembly:
push 0x742d1cb0
mov dword [rbp + riz], r9d
lea rsp, [rsp + 0x10]
jmp fcn.14099616a
lea rsi, [0x1409ac9b8]
movzx eax, byte [r8]
push 0xffffffffb3a7c421
push 0xffffffffe6944330
xor eax, r9d
and eax, 0xff
mov eax, dword [rsi + rax*4]
shr r9d, 8
xor r9d, eax
inc r8
xor r9d, 0xd11ccd8f
dec rcx
lea rsp, [rsp + 0x10]
jne 0x1409a9a81
not r9d
push 0xffffffffaa9d5307
jmp 0x140987eef
adc rbp, 0xc
mov qword [rsp], 0x45846027
xor r9d, r9d
test rcx, rcx
push 0xffffffffa9b6f938
lea rsp, [rsp + 0x10]
je 0x1409a9ab9
mov eax, 0x2ca374a7
jmp 0x1409a9a7a
Function at 0x1409ada51
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [r9], di
lea rsp, [rsp + 0x18]
jmp fcn.140999a63
dec rdi
xor r11w, bx
push rdi
push rdi
neg di
lea rbx, [rsp + rbx + 0x18]
mov di, word [rbx + rdi + 0x442cc57c]
not qword [rsp + 6]
sub r9, 2
jmp 0x140986735

Function at 0x1409adbcf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor r9w, cx
lea rcx, [rsp + rcx + 0x18]
mov dword [rcx], edx
push 0xffffffff8790123f
push 0xffffffffdf3fb3b7
lea rsp, [rsp + 0x28]
jmp fcn.1409a4f2c

Function at 0x1409b1db4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x28]
jmp fcn.1409a25a2
neg rdi
not rdi
xor rbx, rdi
push 0x242accba
sub rbp, 8
mov qword [rbp + riz], rdi
jmp 0x1409a3302

Function at 0x1409b20ba
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor r9b, r8b
lea r8, [rsp + r8 + 0x10]
mov qword [r8], rbp
lea rsp, [rsp + 0x10]
jmp fcn.1409a4f2c

Function at 0x1409b5586
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub bpl, 0x2f
xor r9b, bpl
push 0xffffffffc4b4af19
lea rbp, [rsp + rbp + 0x20]
mov qword [rbp + riz], rsi
mov qword [rsp + 8], 0x11bcfebc
lea rsp, [rsp + 0x20]
jmp fcn.1409a4f2c

Function at 0x1409b865d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor r9w, di
lea rdi, [rsp + rdi + 0x20]
push 0xffffffffc7bb773c
mov qword [rdi], rcx
lea rsp, [rsp + 0x28]
jmp fcn.1409a4f2c

Function at 0x1409be099
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc dl
xor bl, dl
lea rdx, [rsp + rdx + 0x18]
push rcx
not rcx
bswap ecx
mov ecx, dword [rdx + rcx - 0x30990f57]
sub rbp, 4
mov dword [rbp + riz], ecx
lea rsp, [rsp + 0x20]
jmp fcn.1409a25a2

Function at 0x1409c355d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub dil, 0x14
ror dil, 1
mov qword [rsp], 0x13bcd4a7
xor r11b, dil
sub r9, 2
mov word [r9], di
lea rsp, [rsp + 0x18]
jmp fcn.140999a63
Function at 0x140003690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss xmm0, dword [r8]
xorps xmm1, xmm1
ucomiss xmm0, xmm1
jp 0x1400036ac
jne 0x1400036ac
movss xmm0, dword [r8 + 4]
ucomiss xmm0, xmm1
jp 0x1400036ac
je 0x1400036ca
mov rax, qword [0x14010de40]
movsd xmm0, qword [r8]
movsd qword [rax + 0x1af4], xmm0
mov dword [rax + 0x1acc], 4
comiss xmm3, xmm1
jb 0x1400036e8
mov rax, qword [0x14010de40]
movss dword [rax + 0x1b28], xmm3
mov dword [rax + 0x1ae0], 1
mov r8d, dword [rsp + 0x28]
jmp fcn.1400036f4
Function at 0x140009350
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0x1e8]
mov r10, r8
movsxd r9, dword [rcx + 0x1e0]
mov r11, rdx
mov rcx, r11
mov r8d, dword [rax + r9*4 - 4]
mov eax, r10d
sub eax, edx
neg r10
sbb edx, edx
and edx, eax
jmp fcn.140009d78

Function at 0x140009a08
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r15, r9d
mov rsi, r8
test r8, r8
je 0x140009a2f
and qword [r8], 0
call fcn.140009b44
mov rbx, rax
test rax, rax
je 0x140009b28
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140009b1f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140009b1f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140009b1f
mov rax, qword [0x14010de40]
mov rbp, rdi
test rax, rax
je 0x140009a97
inc dword [rax + 0x3c8]
mov rdx, qword [0x14010de50]
lea rcx, [r15 + rdi]
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x140009b1f
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rbp
je 0x140009af6
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14010de40]
test rax, rax
je 0x140009ae4
dec dword [rax + 0x3c8]
mov rdx, qword [0x14010de50]
mov rcx, rdi
call qword [0x14004a008]
jmp 0x140009b28
test r15d, r15d
jle 0x140009b09
lea rcx, [rdi + rbp]
mov r8, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140009b1a
mov qword [rsi], rbp
mov rax, rdi
jmp 0x140009b2a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140009d78
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
cmp dword [0x14010de74], 0
lea rsi, [0x14010de70]
mov ebx, r8d
mov edi, edx
mov r10, rcx
jne 0x140009ddf
xor r9d, r9d
mov r11, rsi
mov r8d, r9d
mov edx, 8
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov r8d, ecx
xor r8d, eax
sub rdx, 1
jne 0x140009dad
mov dword [r11], r8d
inc r9d
add r11, 4
cmp r9d, 0x100
jb 0x140009da5
not ebx
mov edx, ebx
test edi, edi
jle 0x140009e01
movzx eax, byte [r10]
inc r10
movzx ecx, dl
xor rcx, rax
shr edx, 8
xor edx, dword [rsi + rcx*4]
sub edi, 1
jne 0x140009de7
jmp 0x140009e3b
mov r8b, byte [r10]
inc r10
test r8b, r8b
je 0x140009e3b
mov r9b, 0x23
cmp r8b, r9b
jne 0x140009e20
cmp byte [r10], r9b
jne 0x140009e20
cmp byte [r10 + 1], r9b
cmove edx, ebx
movzx ecx, dl
movzx eax, r8b
mov r8b, byte [r10]
xor rcx, rax
shr edx, 8
inc r10
xor edx, dword [rsi + rcx*4]
test r8b, r8b
jne 0x140009e0f
mov rbx, qword [rsp + 8]
not edx
mov rsi, qword [rsp + 0x10]
mov eax, edx
mov rdi, qword [rsp + 0x18]
ret
Function at 0x14000f058
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x14010de40]
mov rbx, rcx
and dword [rax + 0x2d9c], 0
test rcx, rcx
je 0x14000f0c1
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.14000f0cc
lea rdx, [0x14003fa44]
mov rcx, rbx
mov rdi, rax
call fcn.140009b44
mov rbx, rax
test rax, rax
je 0x14000f0c1
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001d3a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r14d, r14d
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rsi, rdx
movsxd rdi, r9d
mov rbp, rcx
test r9d, r9d
jle 0x14001d599
lea rbx, [r8 + 0x20]
xor r13d, r13d
lea r8d, [r14 + 1]
mov r11d, 0x100
xorps xmm7, xmm7
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x14001d44a
movsxd r10, dword [rsi + 0x24]
mov r9, qword [rsi + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
mov r8d, 1
movd xmm0, eax
jmp 0x14001d46c
movsxd rdx, dword [rsi + 0x1c]
mov rax, qword [rsi + 8]
xorps xmm6, xmmword [0x14003fbd0]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
mov al, byte [rbp + 0x20]
xor r15d, r15d
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
mov al, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], r15d
jle 0x14001d58c
mov rcx, qword [rsp + 0xe0]
mov rax, r13
shl rax, 4
add rcx, 6
xor r12d, r12d
add rcx, rax
mov qword [rsp + 0x60], rcx
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x14001d4ba
mov edx, dword [rbx - 0x1c]
add edx, r15d
jmp 0x14001d4be
mov edx, dword [rax + r12]
mov rcx, rsi
call fcn.14001cadc
mov edx, eax
xorps xmm3, xmm3
mov eax, dword [rbp + 0x24]
xorps xmm2, xmm2
mov rcx, rsi
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
mulss xmm3, xmm6
mulss xmm2, xmm6
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.14001cf28
mov rcx, qword [rsp + 0x60]
mov r8d, 1
movzx eax, word [rbp + 0x20]
add r14d, r8d
sub ax, word [rsp + 0xd8]
add r13, r8
add ax, word [rbp + 0x1c]
add r15d, r8d
add ax, word [rsp + 0x50]
add r12, 4
sub ax, r8w
mov word [rcx - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x54]
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x58]
sub ax, r8w
mov word [rcx], ax
add rcx, 0x10
mov qword [rsp + 0x60], rcx
cmp r15d, dword [rbx - 0x10]
jl 0x14001d4a9
mov r11d, 0x100
add rbx, 0x28
sub rdi, r8
jne 0x14001d3f8
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov eax, r14d
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001e6fc
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14010dd58]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.140009380
mov rcx, qword [0x14010e2c8]
lea rdx, [rbp - 0x18]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp - 0x10]
sub ecx, dword [rbp - 0x18]
movd xmm1, ecx
mov ecx, dword [rbp - 0xc]
sub ecx, dword [rbp - 0x14]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rbp - 0x20]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x20]
xorps xmm1, xmm1
sub rax, qword [0x14010e2d0]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x14010e2d8]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rbp - 0x20]
mov qword [0x14010e2d0], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov ecx, 0x10
mov byte [rdi + 0x128], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, bl
mov byte [rdi + 0x129], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
mov byte [rdi + 0x12b], 0
mov byte [rdi + 0x12a], al
call fcn.140009380
mov rbx, rax
cmp byte [rax + 0x3a7], 0
je 0x14001e825
cvttss2si ecx, dword [rax + 0x110]
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x30], ecx
cvttss2si ecx, dword [rax + 0x114]
mov dword [rbp - 0x2c], ecx
mov rcx, qword [0x14010e2c8]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x2c]
mov ecx, dword [rbp - 0x30]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, 0xff7fffff
mov dword [rbx + 0x110], eax
mov dword [rbx + 0x114], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x14010e2c8]
jne 0x14001e888
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14001e888
mov rcx, qword [0x14010e2c8]
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x14001e888
movd xmm0, dword [rbp - 0x28]
movd xmm1, dword [rbp - 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0x110], xmm0
movss dword [rbx + 0x114], xmm1
cmp byte [rdi + 0xc8], 0
je 0x14001e896
or eax, 0xffffffff
jmp 0x14001e89b
call fcn.1400093bc
cmp dword [0x14004a138], eax
je 0x14001e8ae
mov dword [0x14004a138], eax
call fcn.14001e8d8
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003c5c0
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x1400296cc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov dword [rsp + 0x34], 0xc0000001
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0x240
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwOpenKey]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x14002981c
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call fcn.140035758
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140029770
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
xor eax, eax
jmp 0x14002981e
mov eax, dword [rsp + 0x30]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x30]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x40]
mov r8d, 1
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwQueryValueKey]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x1400297d9
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x30], eax
je 0x1400297f3
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
jmp 0x14002981e
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + rax]
jmp 0x14002981e
xor eax, eax
add rsp, 0x88
ret
Function at 0x14002e2b8
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x48
mov eax, 4
imul rax, rax, 2
lea rcx, [0x14010efa8]
add rcx, rax
mov rax, rcx
mov ecx, 4
imul rcx, rcx, 1
lea rdx, [0x14010efa8]
add rdx, rcx
mov rcx, rdx
mov edx, 4
imul rdx, rdx, 0
lea r8, [0x14010efa8]
add r8, rdx
mov rdx, r8
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9, rdx
movss xmm2, dword [0x14010e380]
movss xmm1, dword [0x14010e37c]
movss xmm0, dword [0x1400596bc]
call fcn.1400073b8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x14010efb4]
cmp eax, 1
jb 0x14002e3a0
mov eax, dword [0x14010efb4]
cmp dword [0x14010efb8], eax
je 0x14002e394
movss xmm0, dword [0x140044f40]
mulss xmm0, dword [0x14004a164]
mov eax, 4
imul rax, rax, 0
lea rcx, [0x14010efa8]
movss xmm1, dword [rcx + rax]
addss xmm1, xmm0
movaps xmm0, xmm1
mov eax, 4
imul rax, rax, 0
lea rcx, [0x14010efa8]
movss dword [rcx + rax], xmm0
mov eax, dword [0x14010efb4]
mov dword [0x14010efb8], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14010efb4], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x14010efa8]
xorps xmm0, xmm0
comiss xmm0, dword [rcx + rax]
jbe 0x14002e3eb
mov eax, 4
imul rax, rax, 0
lea rcx, [0x14010efa8]
movss xmm0, dword [rcx + rax]
addss xmm0, dword [0x14003fb24]
mov eax, 4
imul rax, rax, 0
lea rcx, [0x14010efa8]
movss dword [rcx + rax], xmm0
mov eax, 4
imul rax, rax, 2
lea rcx, [0x14010efa8]
mov edx, 4
imul rdx, rdx, 1
lea r8, [0x14010efa8]
mov r9d, 4
imul r9, r9, 0
mov qword [rsp + 0x30], r9
lea r10, [0x14010efa8]
lea r11, [0x14010e380]
mov qword [rsp + 0x28], r11
lea r11, [0x14010e37c]
mov qword [rsp + 0x20], r11
lea r9, [0x1400596bc]
movss xmm2, dword [rcx + rax]
movss xmm1, dword [r8 + rdx]
mov rax, qword [rsp + 0x30]
movss xmm0, dword [r10 + rax]
call fcn.14000726c
add rsp, 0x48
ret
Function at 0x140035758
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_ZwQueryValueKey]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xc0000023
je 0x1400357a9
cmp dword [rsp + 0x30], 0x80000005
jne 0x1400357af
mov eax, dword [rsp + 0x34]
jmp 0x1400357b1
xor eax, eax
add rsp, 0x48
ret

Function at 0x1400358c0
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov rax, qword [0x14010dd58]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], 0
cmp dword [rsp + 0x90], 0
jl 0x140035919
cmp dword [rsp + 0x90], 0x7c
jge 0x140035919
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x90]
lea rcx, [0x14010c9e0]
call fcn.140035e34
lea rcx, [rsp + 0x50]
call fcn.14002cf68
nop
cmp qword [rsp + 0x30], 0
jne 0x14003593f
lea rdx, [0x140044900]
lea rcx, [rsp + 0x50]
call fcn.14002ddd0
jmp 0x14003594e
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14002ddd0
cmp dword [rsp + 0xa0], 1
jne 0x140035969
lea rdx, [0x140044910]
lea rcx, [rsp + 0x50]
call fcn.14002ddd0
movss xmm2, dword [0x140043b80]
movss xmm1, dword [0x1400450bc]
lea rcx, [rsp + 0x48]
call fcn.14002d344
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x50]
call fcn.140039b08
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.1400222b0
movzx eax, al
test eax, eax
je 0x1400359de
cmp dword [rsp + 0xa0], 0
jne 0x1400359de
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rcx, [rsp + 0x50]
call fcn.14002d978
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14003c5c0
add rsp, 0x88
ret