joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002d50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0x90]
sub eax, 0x26d3
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x80]
sub eax, 0x26d3
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x80]
xor eax, 0x26d3
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x26d3
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x98]
sub eax, 0xbbd
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x70]
xor eax, 0x3246
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x90]
add eax, 0x708
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x88]
sub eax, 0x6c1
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x88]
xor eax, 0x1c5f
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x80]
sub eax, 0x26d3
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x2c]
xor eax, 0x159e
cmp dword [rsp + 0x28], eax
je 0x180002e49
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x9c]
sub eax, 0x962ff
mov rcx, qword [rsp + 0x78]
mov ecx, dword [rcx + 0x28]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x78]
mov dword [rcx + 0x28], eax
mov eax, dword [rsp + 0x24]
add eax, 0x2ddb
mov dword [rsp + 0x24], eax
jmp 0x180002ee7
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x90]
mov dword [rsp + 0x20], eax
jmp 0x180002e64
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
cmp dword [rsp + 0x20], eax
jge 0x180002ee7
mov eax, dword [rsp + 0x38]
sub eax, 0x297d
sub eax, dword [rsp + 0x28]
mov dword [rsp + 0x44], eax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov eax, dword [rdx + rax + 0x3c]
mov ecx, dword [rcx + 0x38]
sub ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x78]
and eax, dword [rdx + rcx + 0xa4]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x48]
sub eax, 0x28d2
mov dword [rsp + 0x3c], eax
mov r8d, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x180002e5a
mov eax, dword [rsp + 0x2c]
add eax, 0x28d2
add rsp, 0x68
ret
Function at 0x180004660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0x98]
sub eax, 0x19a5
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0xa0]
sub eax, 0xc20
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x70]
sub eax, 0x441
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x70]
sub eax, 0xa78
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x80]
xor eax, 0x21d2
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xa0]
xor eax, 0x3863
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x19a5
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x88]
sub eax, 0xa28
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x98]
xor eax, 0xc17
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x24]
add eax, 0xdbe
cmp dword [rsp + 0x2c], eax
je 0x1800047f7
mov eax, dword [rsp + 0x24]
add eax, 0xe86
cmp dword [rsp + 0x2c], eax
jge 0x180004745
mov rax, qword [rsp + 0x78]
lea rcx, [0x1800af0b0]
mov qword [rax + 0x70], rcx
mov eax, dword [rsp + 0x20]
add eax, 0x1b76
mov dword [rsp + 0x20], eax
jmp 0x1800047f7
mov eax, dword [rsp + 0x30]
or eax, 0x1b16
mov rcx, qword [rsp + 0x78]
sub eax, dword [rcx + 0x2c]
cmp dword [rsp + 0x20], eax
jb 0x1800047f7
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x28], eax
jmp 0x180004775
mov eax, dword [rsp + 0x28]
add eax, 3
mov dword [rsp + 0x28], eax
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx + rax + 0xa4]
add eax, dword [rsp + 0x34]
and eax, dword [rsp + 0x24]
cmp dword [rsp + 0x28], eax
jbe 0x1800047f7
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov eax, dword [rdx + rax + 0xa4]
mov ecx, dword [rcx + 0x98]
xor ecx, eax
mov eax, ecx
mov eax, eax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x98]
mov ecx, dword [rsp + 0x38]
or ecx, eax
mov eax, ecx
sub eax, 0x2ddb
mov eax, eax
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x18000476a
mov eax, dword [rsp + 0x3c]
add eax, 0x1829
add rsp, 0x68
ret
Function at 0x180008250
Capabilities:
Get file attributes
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov eax, dword [rsp + 0x68]
sub eax, 0x1320
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x78]
xor eax, 0x21d2
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x80]
sub eax, 0x21d2
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x88]
sub eax, 0x28d2
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x68]
add eax, 0x441
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x68]
sub eax, 0xf21
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x68]
sub eax, 0xf21
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x2c]
xor eax, 0x14
cmp dword [rsp + 0x20], eax
jg 0x1800082eb
mov eax, dword [rsp + 0x20]
xor eax, 0x192e
mov dword [rsp + 0x20], eax
jmp 0x18000833e
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x24], eax
jmp 0x180008300
mov eax, dword [rsp + 0x24]
add eax, 3
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x34]
and eax, 0x2540
mov rcx, qword [rsp + 0x70]
or eax, dword [rcx + 0x90]
cmp dword [rsp + 0x24], eax
jb 0x18000833e
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x2c]
mov ecx, dword [rsp + 0x28]
sub ecx, eax
mov eax, ecx
mov eax, eax
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1800082f5
mov eax, dword [rsp + 0x28]
add eax, 0x5a4
add rsp, 0x58
ret
Function at 0x1800215a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0xa8]
sub eax, 0x1b76
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xb0]
xor eax, 0xe01
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xa8]
xor eax, 0x1b76
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x90]
sub eax, 0x26d3
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x1c5f
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x1c5f
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x80]
xor eax, 0x348d
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x90]
sub eax, 0x26d3
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x34]
xor eax, 0x21d2
cmp dword [rsp + 0x2c], eax
jg 0x1800217f2
mov eax, dword [rsp + 0x20]
xor eax, 0x900
cmp dword [rsp + 0x34], eax
jg 0x1800216c1
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x88]
mov eax, dword [rcx + rax + 0x88]
xor eax, 0x1663b7
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 0xa0]
imul ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x88]
mov dword [rcx + 0xa0], eax
mov eax, dword [rsp + 0x20]
sub eax, 0xc73
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 0xa0]
mov dword [rax + 0x64], ecx
jmp 0x1800217f2
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x88]
mov eax, dword [rax + 0x44]
imul eax, dword [rcx + 0x48]
add eax, dword [rsp + 0x20]
cmp dword [rsp + 0x30], eax
jb 0x1800217f2
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x24], eax
jmp 0x1800216fb
mov eax, dword [rsp + 0x24]
add eax, 2
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x2c]
add eax, 0x44f3
cmp dword [rsp + 0x24], eax
jae 0x1800217f2
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x88]
mov eax, dword [rcx + rax + 0xb8]
mov dword [rsp + 0x28], eax
jmp 0x18002173e
mov eax, dword [rsp + 0x28]
add eax, 2
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x90]
sub eax, 0x2540
cmp dword [rsp + 0x28], eax
jae 0x1800217ed
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x2c]
or ecx, eax
mov eax, ecx
cdqe
mov qword [rsp + 0x50], rax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x88]
mov edx, dword [rdx + 0x18]
mov eax, dword [rcx + rax + 0xb8]
xor eax, edx
mov eax, eax
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov eax, dword [rsp + 0x2c]
xor eax, 0x19b1
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x88]
add eax, dword [rdx + rcx + 8]
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 0xb4]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x88]
mov dword [rcx + 0xb4], eax
jmp 0x180021733
jmp 0x1800216f0
mov eax, dword [rsp + 0x30]
add eax, 0x1c5f
add rsp, 0x68
ret
Function at 0x140009550
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0x1e8]
mov r10, r8
movsxd r9, dword [rcx + 0x1e0]
mov r11, rdx
mov rcx, r11
mov r8d, dword [rax + r9*4 - 4]
mov eax, r10d
sub eax, edx
neg r10
sbb edx, edx
and edx, eax
jmp fcn.140009f54

Function at 0x140009be4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r15, r9d
mov rsi, r8
test r8, r8
je 0x140009c0b
and qword [r8], 0
call fcn.140009d20
mov rbx, rax
test rax, rax
je 0x140009d04
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140009cfb
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140009cfb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140009cfb
mov rax, qword [0x140066330]
mov rbp, rdi
test rax, rax
je 0x140009c73
inc dword [rax + 0x3c8]
mov rdx, qword [0x140066340]
lea rcx, [r15 + rdi]
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x140009cfb
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rbp
je 0x140009cd2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140066330]
test rax, rax
je 0x140009cc0
dec dword [rax + 0x3c8]
mov rdx, qword [0x140066340]
mov rcx, rdi
call qword [0x140049008]
jmp 0x140009d04
test r15d, r15d
jle 0x140009ce5
lea rcx, [rdi + rbp]
mov r8, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140009cf6
mov qword [rsi], rbp
mov rax, rdi
jmp 0x140009d06
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140009f54
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
cmp dword [0x140066364], 0
lea rsi, [0x140066360]
mov ebx, r8d
mov edi, edx
mov r10, rcx
jne 0x140009fbb
xor r9d, r9d
mov r11, rsi
mov r8d, r9d
mov edx, 8
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov r8d, ecx
xor r8d, eax
sub rdx, 1
jne 0x140009f89
mov dword [r11], r8d
inc r9d
add r11, 4
cmp r9d, 0x100
jb 0x140009f81
not ebx
mov edx, ebx
test edi, edi
jle 0x140009fdd
movzx eax, byte [r10]
inc r10
movzx ecx, dl
xor rcx, rax
shr edx, 8
xor edx, dword [rsi + rcx*4]
sub edi, 1
jne 0x140009fc3
jmp 0x14000a017
mov r8b, byte [r10]
inc r10
test r8b, r8b
je 0x14000a017
mov r9b, 0x23
cmp r8b, r9b
jne 0x140009ffc
cmp byte [r10], r9b
jne 0x140009ffc
cmp byte [r10 + 1], r9b
cmove edx, ebx
movzx ecx, dl
movzx eax, r8b
mov r8b, byte [r10]
xor rcx, rax
shr edx, 8
inc r10
xor edx, dword [rsi + rcx*4]
test r8b, r8b
jne 0x140009feb
mov rbx, qword [rsp + 8]
not edx
mov rsi, qword [rsp + 0x10]
mov eax, edx
mov rdi, qword [rsp + 0x18]
ret
Function at 0x14000fe8c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140066330]
mov rbx, rcx
and dword [rax + 0x2d9c], 0
test rcx, rcx
je 0x14000fef5
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.14000ff00
lea rdx, [0x14003db9c]
mov rcx, rbx
mov rdi, rax
call fcn.140009d20
mov rbx, rax
test rax, rax
je 0x14000fef5
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001e85c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r14d, r14d
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rsi, rdx
movsxd rdi, r9d
mov rbp, rcx
test r9d, r9d
jle 0x14001ea4d
lea rbx, [r8 + 0x20]
xor r13d, r13d
lea r8d, [r14 + 1]
mov r11d, 0x100
xorps xmm7, xmm7
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x14001e8fe
movsxd r10, dword [rsi + 0x24]
mov r9, qword [rsi + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
mov r8d, 1
movd xmm0, eax
jmp 0x14001e920
movsxd rdx, dword [rsi + 0x1c]
mov rax, qword [rsi + 8]
xorps xmm6, xmmword [0x14003dd30]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
mov al, byte [rbp + 0x20]
xor r15d, r15d
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
mov al, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], r15d
jle 0x14001ea40
mov rcx, qword [rsp + 0xe0]
mov rax, r13
shl rax, 4
add rcx, 6
xor r12d, r12d
add rcx, rax
mov qword [rsp + 0x60], rcx
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x14001e96e
mov edx, dword [rbx - 0x1c]
add edx, r15d
jmp 0x14001e972
mov edx, dword [rax + r12]
mov rcx, rsi
call fcn.14001dfc4
mov edx, eax
xorps xmm3, xmm3
mov eax, dword [rbp + 0x24]
xorps xmm2, xmm2
mov rcx, rsi
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
mulss xmm3, xmm6
mulss xmm2, xmm6
movss dword [rsp + 0x20], xmm7
call fcn.14001e3fc
mov rcx, qword [rsp + 0x60]
mov r8d, 1
movzx eax, word [rbp + 0x20]
add r14d, r8d
sub ax, word [rsp + 0xd8]
add r13, r8
add ax, word [rbp + 0x1c]
add r15d, r8d
add ax, word [rsp + 0x50]
add r12, 4
sub ax, r8w
mov word [rcx - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x54]
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x58]
sub ax, r8w
mov word [rcx], ax
add rcx, 0x10
mov qword [rsp + 0x60], rcx
cmp r15d, dword [rbx - 0x10]
jl 0x14001e95d
mov r11d, 0x100
add rbx, 0x28
sub rdi, r8
jne 0x14001e8ac
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov eax, r14d
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001fbb4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140065f98]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.1400095b0
mov rcx, qword [0x1400667b8]
lea rdx, [rbp - 0x18]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp - 0x10]
sub ecx, dword [rbp - 0x18]
movd xmm1, ecx
mov ecx, dword [rbp - 0xc]
sub ecx, dword [rbp - 0x14]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rbp - 0x20]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x20]
xorps xmm1, xmm1
sub rax, qword [0x1400667c0]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x1400667c8]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rbp - 0x20]
mov qword [0x1400667c0], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov ecx, 0x10
mov byte [rdi + 0x128], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, bl
mov byte [rdi + 0x129], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
mov byte [rdi + 0x12b], 0
mov byte [rdi + 0x12a], al
call fcn.1400095b0
cmp byte [rax + 0x3a7], 0
lea rbx, [rax + 0x110]
je 0x14001fcdd
cvttss2si ecx, dword [rbx]
lea rdx, [rbp - 0x30]
cvttss2si eax, dword [rax + 0x114]
mov dword [rbp - 0x30], ecx
mov rcx, qword [0x1400667b8]
mov dword [rbp - 0x2c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x2c]
mov ecx, dword [rbp - 0x30]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, 0xff7fffff
mov dword [rbx], eax
mov dword [rbx + 4], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x1400667b8]
jne 0x14001fd32
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14001fd32
mov rcx, qword [0x1400667b8]
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x14001fd32
movd xmm0, dword [rbp - 0x28]
movd xmm1, dword [rbp - 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x14001fd40
or eax, 0xffffffff
jmp 0x14001fd45
call fcn.1400095ec
cmp dword [0x140049138], eax
je 0x14001fd58
mov dword [0x140049138], eax
call fcn.14001fd80
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003ae30
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140032bd8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, 0x270
mov rbx, rcx
cmp dword [rcx], r9d
jne 0x140032c2b
lea r8, [rcx + 8]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140032bf0
jmp 0x140032c38
cmp dword [rcx], 0x4e0
jb 0x140032c38
call fcn.1400378e0
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret
Function at 0x140036e70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140065f98]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov edi, r8d
mov rsi, rdx
xor eax, eax
cmp ecx, 0x7b
ja 0x140036eb0
movsxd rax, ecx
lea rcx, [0x140064a60]
mov rax, qword [rcx + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
and qword [rbp - 0x20], 0
mov edx, 0xf
mov qword [rbp - 0x18], rdx
mov byte [rbp - 0x30], 0
test rax, rax
jne 0x140036ef4
mov qword [rbp - 0x20], 0xa
movsd xmm0, qword [str.Select_Key]
movsd qword [rbp - 0x30], xmm0
movzx eax, word [0x1400424d0]
mov word [rbp - 0x28], ax
mov byte [rbp - 0x26], 0
jmp 0x140036f04
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140037d7c
mov rdx, qword [rbp - 0x18]
cmp edi, 1
jne 0x140036f55
lea eax, [rdi + 0xc]
cmp rdx, rax
jb 0x140036f3a
lea rbx, [rbp - 0x30]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x30]
mov qword [rbp - 0x20], rax
mov r8d, eax
lea rdx, str.Press_the_key
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xd], 0
jmp 0x140036f51
lea r9, str.Press_the_key
mov r8b, byte [rbp - 0x40]
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140030de0
mov rdx, qword [rbp - 0x18]
mov dword [rbp - 0x3c], 0x42fa0000
mov dword [rbp - 0x38], 0x41a00000
lea rcx, [rbp - 0x30]
cmp rdx, 0x10
cmovae rcx, qword [rbp - 0x30]
lea rdx, [rbp - 0x3c]
call fcn.140025300
test al, al
je 0x140036f9c
test edi, edi
jne 0x140036f9c
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], edi
xor r9d, r9d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140036fda
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036fd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036fd5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003a8ac
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14003ae30
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140037024
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdi
push r14
sub rsp, 0x60
lea r14, [rsp + 0x68]
movabs rcx, 0x7a5db90d33787107
mov qword [r11 - 0x20], rcx
mov qword [r11 - 0x18], r14
mov rdi, qword [r14]
mov rax, rdi
xor rax, rcx
mov qword [r11 - 0x28], rax
and qword [r14], 0
lea rdx, [0x140066a78]
mov ecx, 0x20
call sub.d3d9.dll_Direct3DCreate9Ex
test eax, eax
js 0x1400371c6
xor edx, edx
lea r8d, [rdx + 0x40]
lea rbx, [0x1400669b0]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x1400667e4]
mov dword [0x1400669b0], eax
mov eax, dword [0x1400667f0]
mov dword [0x1400669b4], eax
mov dword [0x1400669b8], 0x15
and dword [0x1400669c0], 0
mov dword [0x1400669e0], 0x50
mov r8d, 1
mov dword [0x1400669c8], r8d
mov dword [0x1400669dc], r8d
mov r9, qword [0x140066f10]
mov qword [0x1400669d0], r9
mov dword [0x1400669d8], r8d
mov rcx, qword [0x140066a78]
mov rax, qword [rcx]
lea rdx, [0x140066f18]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x20
xor edx, edx
call qword [rax + 0x80]
test eax, eax
js 0x1400371c6
mov qword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], 0x10
mov edx, 0x1548
mov r9d, 8
mov r8d, 0x3a0
lea rcx, str.1.67_WIP
call fcn.140007880
xor ecx, ecx
call fcn.1400074dc
call fcn.1400095b0
mov rbx, rax
mov rcx, qword [0x140066f10]
call fcn.14001fab4
mov rcx, qword [0x140066f18]
call fcn.14001f17c
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
movss xmm3, dword [0x140042ae0]
mov r8d, 0x1b44c
lea rdx, [0x140049170]
mov rcx, qword [rbx + 0x98]
call fcn.140013c7c
mov qword [0x1400668e8], rax
mov rcx, qword [0x140066a78]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov qword [r14], rdi
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop r14
ret
mov ecx, 3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3