joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a2580
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4a2650
jb 0x4a26af
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004a2460
aeskeygenassist xmm1, xmm0, 1
call fcn.004a2480
aeskeygenassist xmm1, xmm2, 2
call fcn.004a2460
aeskeygenassist xmm1, xmm0, 2
call fcn.004a2480
aeskeygenassist xmm1, xmm2, 4
call fcn.004a2460
aeskeygenassist xmm1, xmm0, 4
call fcn.004a2480
aeskeygenassist xmm1, xmm2, 8
call fcn.004a2460
aeskeygenassist xmm1, xmm0, 8
call fcn.004a2480
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004a2460
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004a2480
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004a2460
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004a2480
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004a2460
jmp 0x4a271d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004a23c0
aeskeygenassist xmm1, xmm2, 2
call fcn.004a2420
aeskeygenassist xmm1, xmm2, 4
call fcn.004a23c0
aeskeygenassist xmm1, xmm2, 8
call fcn.004a2420
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004a23c0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004a2420
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004a23c0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004a2420
jmp 0x4a271d
aeskeygenassist xmm1, xmm0, 1
call fcn.004a2380
aeskeygenassist xmm1, xmm0, 2
call fcn.004a2380
aeskeygenassist xmm1, xmm0, 4
call fcn.004a2380
aeskeygenassist xmm1, xmm0, 8
call fcn.004a2380
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004a2380
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004a2380
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004a2380
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004a2380
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004a2380
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004a2380
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4a272a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x1817fc058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1817fc1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1817fc089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1817fc06f
add dl, dl
jne 0x1817fc096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1817fc0f6
xor eax, eax
add dl, dl
jne 0x1817fc0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1817fc1ad
add dl, dl
jne 0x1817fc0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1817fc0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1817fc0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1817fc0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1817fc0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1817fc07e
mov eax, 1
add dl, dl
jne 0x1817fc106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1817fc113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1817fc0fb
sub eax, ebx
mov ebx, 1
jne 0x1817fc14c
mov ecx, 1
add dl, dl
jne 0x1817fc12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1817fc13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1817fc123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1817fc07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1817fc168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1817fc175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1817fc15d
cmp eax, 0x7d00
jae 0x1817fc19b
cmp eax, 0x500
jb 0x1817fc196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1817fc07e
cmp eax, 0x7f
ja 0x1817fc19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1817fc07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1817fc1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1817fc07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14001a840
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x1401e8080]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, byte [0x1402e6c2c]
test eax, eax
jne 0x14001a868
jmp 0x14001a93a
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14001a87f
mov byte [rsp + 0x21], 1
jmp 0x14001a884
mov byte [rsp + 0x21], 0
movzx eax, byte [rsp + 0x21]
mov byte [rsp + 0x20], al
mov rcx, qword [rsp + 0x50]
call fcn.14001a800
mov byte [rsp + 0x22], al
lea rdx, [rsp + 0x30]
lea rcx, [0x1402e6d50]
call fcn.14001b0f0
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14001a8f0
movzx eax, byte [rsp + 0x22]
test eax, eax
je 0x14001a8f0
mov dword [rsp + 0x24], 0xa
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x28]
call fcn.1400138c0
mov rcx, rax
call fcn.1400138e0
mov edx, 0x10001
lea rcx, [0x1402e6d50]
call fcn.14001b0b0
jmp 0x14001a93a
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14001a915
movzx eax, byte [rsp + 0x22]
test eax, eax
jne 0x14001a915
mov edx, 0x100
lea rcx, [0x1402e6d50]
call fcn.14001b0b0
jmp 0x14001a93a
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001a93a
cmp dword [rsp + 0x30], 0x10001
jne 0x14001a93a
mov edx, 0x100
lea rcx, [0x1402e6d50]
call fcn.14001b0b0
nop
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140114d60
add rsp, 0x48
ret
Function at 0x14001ac10
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x4d0
lea rbp, [rsp + 0x20]
mov rax, qword [0x1401e8080]
xor rax, rbp
mov qword [rbp + 0x4a0], rax
mov dword [rbp + 0x60], 0x438
mov rax, qword [rbp + 0x4c0]
mov edx, dword [rax + 0x10]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
call fcn.14001ab70
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x90]
mov qword [rbp + 0x20], rax
cmp qword [rbp + 0x20], 0
jne 0x14001ac8d
mov qword [rbp + 0x30], 0
jmp 0x14001ad2b
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 8]
cmp word [rax + rcx*2], 0
jne 0x14001ac9d
mov rax, qword [rbp + 8]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x14001accc
mov qword [rbp + 0x28], 0
jmp 0x14001ad23
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x40], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x14001acf4
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.140115940
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x40]
mov r8d, ecx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call fcn.14001ab80
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x30], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.140012a30
mov rcx, qword [rbp + 0x30]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x14001ad51
inc rcx
test dl, dl
jne 0x14001ad3e
xor eax, eax
jmp 0x14001ad56
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14001ad81
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.140004b90
mov rax, qword [rbp + 0x48]
jmp 0x14001adb9
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x14001ac6e
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x50], 0
mov rcx, qword [rbp + 0x4c8]
call fcn.140004b90
mov rax, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x4a0]
xor rcx, rbp
call fcn.140114d60
lea rsp, [rbp + 0x4b0]
pop rbp
ret
Function at 0x14001c370
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x2c0
lea rbp, [rsp + 0x20]
mov rax, qword [0x1401e8080]
xor rax, rbp
mov qword [rbp + 0x290], rax
mov dword [rbp + 0x50], 0x238
xor edx, edx
mov ecx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
call fcn.14001ab70
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x7c]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14001c3e2
mov qword [rbp + 0x38], 0
jmp 0x14001c480
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x40], rax
mov qword [rbp + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 8]
cmp word [rax + rcx*2], 0
jne 0x14001c3f2
mov rax, qword [rbp + 8]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x14001c421
mov qword [rbp + 0x30], 0
jmp 0x14001c478
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x48], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x14001c449
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.140115940
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x48]
mov r8d, ecx
mov rdx, qword [rbp + 0x28]
mov rcx, rax
call fcn.14001ab80
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x38], rax
mov rcx, qword [rbp + 0x2b8]
call fcn.140012a30
mov rcx, qword [rbp + 0x38]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x14001c4a6
inc rcx
test dl, dl
jne 0x14001c493
xor eax, eax
jmp 0x14001c4ab
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14001c4d0
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x58]
mov dword [rbp + 0x1c], eax
mov rcx, qword [rbp + 0x2b8]
call fcn.140004b90
mov eax, dword [rbp + 0x1c]
jmp 0x14001c506
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14001c3c6
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x20], 0
mov rcx, qword [rbp + 0x2b8]
call fcn.140004b90
mov eax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x290]
xor rcx, rbp
call fcn.140114d60
lea rsp, [rbp + 0x2a0]
pop rbp
ret
Function at 0x14001dcd0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x288
mov rax, qword [0x1401e8080]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov dword [rsp + 0x30], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14001dd6e
lea rax, [rsp + 0x5c]
mov rcx, qword [rsp + 0x290]
sub rcx, rax
movzx edx, word [rax]
cmp dx, word [rax + rcx]
jne 0x14001dd42
add rax, 2
test dx, dx
jne 0x14001dd2c
xor eax, eax
jmp 0x14001dd47
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14001dd5a
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14001dd7b
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14001dd1c
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140114d60
add rsp, 0x288
ret
Function at 0x14001fb90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x14001fbc9
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001fcb7
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x14001fc5f
cmp qword [rsp + 0x20], 0
jle 0x14001fc5f
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x14001fc09
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140005460
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x14001fca7
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x14001fca7
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x14001fcc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1401e8080]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x14001fcf4
xor eax, eax
jmp 0x14001fef0
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x14001fd26
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x14001fef0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x14001fdd7
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.140005d40
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.140005460
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x14001fee0
mov rcx, qword [rsp + 0x80]
call fcn.140021740
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x14001fe8d
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x14001fe88
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x14001fef0
jmp 0x14001fe03
cmp qword [rsp + 0x50], 0
jbe 0x14001fee0
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140114d60
add rsp, 0x78
ret
Function at 0x140021800
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x1401e8080]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14002183d
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140021844
mov al, 1
jmp 0x14002199c
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.1400131c0
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.1400131c0
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.1400131d0
movzx eax, al
test eax, eax
je 0x140021899
xor al, al
jmp 0x14002199c
mov qword [rsp + 0x60], reloc.WLDAP32.dll_Ordinal_32
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140021909
cmp dword [rsp + 0x30], 1
je 0x140021915
cmp dword [rsp + 0x30], 3
je 0x14002198a
jmp 0x14002199a
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x140021961
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x140021961
xor al, al
jmp 0x14002199c
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14002197b
mov dword [rsp + 0x34], 1
jmp 0x140021983
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x14002199c
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14002199c
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140114d60
add rsp, 0xa8
ret
Function at 0x14002f750
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1401b5980]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x14002f7de
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x14002f782
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x14002f7f0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1401b5980]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x14002f8f4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x14002f8ef
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x14002f8c4
cmp qword [rsp + 0x38], 2
jb 0x14002f8c4
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14002f8c4
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14002f8c4
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x14002f837
jmp 0x14002f986
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x14002f986
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x14002f95c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14002f95c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14002f95c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x14002f8f4
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x140075d70
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140075d96
mov dword [rsp + 0x20], 1
jmp 0x140075d9e
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret