joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400709c0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140070a02
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140070a49
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140070aa2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140070a60
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140070ae3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400845aa]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400845ab]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140070ab0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x140071a08
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140071a52
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140071a52
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140071a52
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140071a52
cmp dword [rcx + 0x84], 0xe
jbe 0x140071a52
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140071a54
xor al, al
add rsp, 0x28
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004044c0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x004044d0]
mov dword [rax], 1
mov rax, qword [0x004044e0]
mov dword [rax], 1
mov rax, qword [0x004044b0]
mov dword [rax], 1
mov rax, qword [0x00404380]
cmp word [rax], 0x5a4d
jne 0x401067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4010d0
mov rax, qword [0x004044a0]
mov dword [0x00407020], ecx
mov eax, dword [rax]
test eax, eax
je 0x4010c0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x00404460]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x00404440]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x00404330]
cmp dword [rax], 1
je 0x401108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x401120
cmp dx, 0x20b
jne 0x401067
cmp dword [rax + 0x84], 0xe
jbe 0x401067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x401067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x401067

Function at 0x401850
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x402180
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
mov r8, rdx
lea rdx, [rax + rcx]
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x4021cc
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov ecx, dword [rax + 0xc]
mov rdx, rcx
cmp rcx, r8
ja 0x4021c3
add edx, dword [rax + 8]
cmp rdx, r8
ja 0x4021ce
add rax, 0x28
cmp rax, r9
jne 0x4021b0
xor eax, eax
ret

Function at 0x4021d0
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x402260
mov rdx, qword [0x00404380]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x40224e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x40224e
cmp word [rax + 0x18], 0x20b
jne 0x40224e
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x402260
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x402239
add r12, 0x28
cmp r12, rsi
je 0x402260
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x402230
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x402270
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x00404380]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x402290
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x402298
ret
cmp word [r8 + 0x18], 0x20b
jne 0x402290
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x4022e5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x4022dc
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402290
add rax, 0x28
cmp rax, r9
jne 0x4022c8
xor eax, eax
ret

Function at 0x4022f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00404380]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x402310
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x402318
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x402310
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x402330
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x00404380]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x402350
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x402358
ret
cmp word [rdx + 0x18], 0x20b
jne 0x402350
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x402398
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x40238f
test rcx, rcx
je 0x402350
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x402380
xor eax, eax
ret

Function at 0x4023a0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00404380]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x4023c0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x4023c8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x4023e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x00404380]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x402400
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x402408
mov eax, r8d
ret
cmp word [rdx + 0x18], 0x20b
jne 0x402400
sub rcx, rax
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x402400
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x402444
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402458
add rax, 0x28
cmp r9, rax
jne 0x402430
xor r8d, r8d
mov eax, r8d
ret
mov r8d, dword [rax + 0x24]
not r8d
shr r8d, 0x1f
mov eax, r8d
ret

Function at 0x402470
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x00404380]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x402492
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x4024a0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x402492
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x402492
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x402492
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x4024ed
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x402500
add rdx, 0x28
cmp r10, rdx
jne 0x4024d8
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x40250f
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x40251f
mov edx, dword [rax + 0xc]
test edx, edx
je 0x4024f6
test ecx, ecx
jg 0x402508
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140002810
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x12d0]
mov eax, 0x13d0
call fcn.1400de700
sub rsp, rax
movaps xmmword [rsp + 0x13c0], xmm6
mov rax, qword [0x14016d8a0]
xor rax, rsp
mov qword [rbp + 0x12b0], rax
mov edi, ecx
lea ebx, [rdx + 1]
call fcn.1400dca2c
mov dword [rsp + 0x24], eax
mov r8d, 1
mov dword [rbp + 0x12a4], 0xffffffff
nop word [rax + rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x24], eax
inc r8
cmp r8, 0x270
jb 0x140002870
movsd xmm3, qword [0x140150140]
mov edx, 0x270
movsd xmm6, qword [0x1401501c8]
xorps xmm5, xmm5
movd xmm4, edi
xorps xmm2, xmm2
movd xmm1, ebx
mov r10d, 2
mov dword [rsp + 0x20], edx
cvtdq2pd xmm4, xmm4
cvtdq2pd xmm1, xmm1
cmp edx, 0x270
jne 0x140002922
lea r8, [rsp + 0x28]
mov r9d, edx
nop word [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1400028e0
mov edx, dword [rsp + 0x20]
jmp 0x140002a0f
cmp edx, 0x4e0
jb 0x140002a0f
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
mov edx, dword [rbp + r8*4 + 0x8e4]
xor edx, dword [rbp + r8*4 + 0x8e8]
btr edx, 0x1f
xor edx, dword [rbp + r8*4 + 0x8e4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [rbp + r8*4 + 0xf18]
xor ecx, edx
mov dword [rsp + r8*4 + 0x24], ecx
inc r8
cmp r8, 0xe3
jb 0x140002940
mov r8d, 0xe3
nop dword [rax]
mov edx, dword [rbp + r8*4 + 0x8e4]
xor edx, dword [rbp + r8*4 + 0x8e8]
btr edx, 0x1f
xor edx, dword [rbp + r8*4 + 0x8e4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [rbp + r8*4 - 0x468]
xor ecx, edx
mov dword [rsp + r8*4 + 0x24], ecx
inc r8
cmp r8, 0x26f
jb 0x140002990
mov edx, dword [rbp + 0x12a0]
xor edx, dword [rsp + 0x24]
btr edx, 0x1f
xor edx, dword [rbp + 0x12a0]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [rbp + 0x554]
xor edx, edx
mov dword [rbp + 0x8e0], ecx
mov dword [rsp + 0x20], edx
mov eax, edx
xorps xmm0, xmm0
inc edx
mov ecx, dword [rsp + rax*4 + 0x24]
mov eax, ecx
shr eax, 0xb
and eax, dword [rbp + 0x12a4]
xor ecx, eax
mov dword [rsp + 0x20], edx
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2sd xmm0, rax
subsd xmm0, xmm5
mulsd xmm0, xmm3
mulsd xmm3, xmm6
addsd xmm2, xmm0
sub r10, 1
jne 0x1400028c6
divsd xmm2, xmm3
subsd xmm1, xmm4
mulsd xmm1, xmm2
addsd xmm1, xmm4
cvttsd2si eax, xmm1
mov rcx, qword [rbp + 0x12b0]
xor rcx, rsp
call fcn.1400ddaa0
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
Function at 0x140002ab0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbp
lea rbp, [rsp - 0x12e0]
mov eax, 0x13e0
call fcn.1400de700
sub rsp, rax
movaps xmmword [rsp + 0x13d0], xmm6
movaps xmmword [rsp + 0x13c0], xmm7
mov rax, qword [0x14016d8a0]
xor rax, rsp
mov qword [rbp + 0x12b0], rax
movaps xmm6, xmm1
movaps xmm7, xmm0
addss xmm6, dword [0x140150124]
call fcn.1400dca2c
mov dword [rsp + 0x24], eax
mov edx, 1
mov dword [rbp + 0x12a4], 0xffffffff
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, 0x270
jb 0x140002b10
movsd xmm3, qword [0x140150140]
xorps xmm1, xmm1
mov edx, 0x270
xorps xmm4, xmm4
cvtss2sd xmm1, xmm6
mov dword [rsp + 0x20], edx
mov r10d, 2
movsd xmm6, qword [0x1401501c8]
xorps xmm5, xmm5
cvtss2sd xmm4, xmm7
xorps xmm2, xmm2
cmp edx, 0x270
jne 0x140002bc2
lea r8, [rsp + 0x28]
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140002b80
mov edx, dword [rsp + 0x20]
jmp 0x140002caf
cmp edx, 0x4e0
jb 0x140002caf
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
mov edx, dword [rbp + r8*4 + 0x8e4]
xor edx, dword [rbp + r8*4 + 0x8e8]
btr edx, 0x1f
xor edx, dword [rbp + r8*4 + 0x8e4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [rbp + r8*4 + 0xf18]
xor ecx, edx
mov dword [rsp + r8*4 + 0x24], ecx
inc r8
cmp r8, 0xe3
jb 0x140002be0
mov r8d, 0xe3
nop dword [rax]
mov edx, dword [rbp + r8*4 + 0x8e4]
xor edx, dword [rbp + r8*4 + 0x8e8]
btr edx, 0x1f
xor edx, dword [rbp + r8*4 + 0x8e4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [rbp + r8*4 - 0x468]
xor ecx, edx
mov dword [rsp + r8*4 + 0x24], ecx
inc r8
cmp r8, 0x26f
jb 0x140002c30
mov edx, dword [rbp + 0x12a0]
xor edx, dword [rsp + 0x24]
btr edx, 0x1f
xor edx, dword [rbp + 0x12a0]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [rbp + 0x554]
xor edx, edx
mov dword [rbp + 0x8e0], ecx
mov dword [rsp + 0x20], edx
mov eax, edx
xorps xmm0, xmm0
inc edx
mov ecx, dword [rsp + rax*4 + 0x24]
mov eax, ecx
shr eax, 0xb
and eax, dword [rbp + 0x12a4]
xor ecx, eax
mov dword [rsp + 0x20], edx
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2sd xmm0, rax
subsd xmm0, xmm5
mulsd xmm0, xmm3
mulsd xmm3, xmm6
addsd xmm2, xmm0
sub r10, 1
jne 0x140002b62
divsd xmm2, xmm3
subsd xmm1, xmm4
xorps xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm4
cvtsd2ss xmm0, xmm1
mov rcx, qword [rbp + 0x12b0]
xor rcx, rsp
call fcn.1400ddaa0
movaps xmm6, xmmword [rsp + 0x13d0]
movaps xmm7, xmmword [rsp + 0x13c0]
add rsp, 0x13e0
pop rbp
ret
Function at 0x1400042a0
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14016d8a0]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rbx, [0x140175e90]
mov dword [rsp + 0x20], 0x400
mov rcx, rbx
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x28], xmm0
mov r8, 0xffffffffffffffff
movdqu xmmword [rsp + 0x38], xmm1
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x1400042f0
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140004740
mov r9, qword [rsp + 0x28]
lea r8, [rsp + 0x28]
mov r10, qword [rsp + 0x40]
lea rax, [rsp + 0x28]
xor ebx, ebx
cmp r10, 0x10
cmovae r8, r9
cmovae rax, r9
add r8, qword [rsp + 0x38]
mov rcx, r8
sub rcx, rax
cmp rax, r8
cmova rcx, rbx
test rcx, rcx
je 0x1400043b3
cmp rcx, 0x10
jb 0x1400043b3
and rcx, 0xfffffffffffffff0
xorps xmm1, xmm1
xorps xmm2, xmm2
movq xmm0, qword [rax]
add rbx, 0x10
punpcklbw xmm0, xmm0
psraw xmm0, 8
paddw xmm1, xmm0
movq xmm0, qword [rax + 8]
punpcklbw xmm0, xmm0
add rax, 0x10
psraw xmm0, 8
paddw xmm0, xmm2
movdqa xmm2, xmm0
cmp rbx, rcx
jne 0x140004350
paddw xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
paddw xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
paddw xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 2
paddw xmm1, xmm0
movd ebx, xmm1
cmp rax, r8
je 0x1400043ce
nop dword [rax + rax]
movsx ecx, byte [rax]
inc rax
add bx, cx
cmp rax, r8
jne 0x1400043c0
cmp r10, 0x10
jb 0x140004401
lea rdx, [r10 + 1]
mov rax, r9
cmp rdx, 0x1000
jb 0x1400043f9
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004417
mov rcx, r9
call fcn.1400ddd4c
movzx eax, bx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ddaa0
add rsp, 0x50
pop rbx
ret
call fcn.1400ed164
int3
Function at 0x14000acc0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x470
mov rax, qword [0x14016d8a0]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea rcx, [0x1401759b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [0x1401759c0]
lea rdx, [rsp + 0x50]
mov qword [0x1401759f0], rax
mov r8d, 0x400
mov rax, qword [0x1401759c8]
xor ecx, ecx
mov qword [0x1401759e8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
xorps xmm1, xmm1
mov rbx, 0xffffffffffffffff
movups xmmword [rsp + 0x20], xmm0
mov r8, rbx
movdqu xmmword [rsp + 0x30], xmm1
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000ad40
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.140004740
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x14000ad9a
mov rcx, qword [0x14016e610]
inc rdx
cmp rdx, 0x1000
jb 0x14000ad95
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000ae89
mov rcx, r8
call fcn.1400ddd4c
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x460], xmm6
movups xmm6, xmmword [rsp + 0x30]
movups xmmword [0x14016e610], xmm0
movups xmmword [0x14016e620], xmm6
call fcn.1400138f0
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x20], xmm0
lea rcx, [rax + 1]
movq rax, xmm6
movaps xmm6, xmmword [rsp + 0x460]
movdqu xmmword [rsp + 0x30], xmm1
cmp rax, rcx
jb 0x14000ae95
sub rax, rcx
lea rdx, [0x14016e610]
cmp rax, rbx
cmovb rbx, rax
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov r8, rbx
cmovae rdx, qword [0x14016e610]
add rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140004740
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x14000ae58
mov rcx, qword [0x14016e5f0]
inc rdx
cmp rdx, 0x1000
jb 0x14000ae53
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000ae8f
mov rcx, r8
call fcn.1400ddd4c
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [0x14016e5f0], xmm0
movups xmmword [0x14016e600], xmm1
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400ddaa0
add rsp, 0x470
pop rbx
ret
call fcn.1400ed164
int3
call fcn.1400ed164
int3
call fcn.140008eb0
int3
Function at 0x1400110e0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [0x14016d8a0]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r13d, r13d
mov r12d, r13d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
xor edx, edx
mov r8d, 0x12c
lea rcx, [rsp + 0x54]
call fcn.1400e0700
mov dword [rsp + 0x50], 0x130
lea rdx, [rsp + 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14001122f
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x7c]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x140011180
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x20]
call fcn.140004740
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400111a5
mov rdx, qword [rdi]
lea rcx, [rsp + 0x20]
mov rbp, qword [rsp + 0x38]
cmp rbp, 0x10
setae r14b
mov rbx, qword [rsp + 0x20]
cmovae rcx, rbx
mov r8, qword [rsp + 0x30]
cmp r8, qword [rdi + 0x10]
jne 0x1400111d9
call fcn.1400e0c80
test eax, eax
jne 0x1400111d9
mov sil, 1
jmp 0x1400111dc
xor sil, sil
test r14b, r14b
je 0x140011212
lea rdx, [rbp + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14001120a
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400112b2
mov rcx, rbx
call fcn.1400ddd4c
test sil, sil
jne 0x14001122a
lea rdx, [rsp + 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x140011155
mov r12d, dword [rsp + 0x58]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14001126f
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14001126a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400112b8
mov rcx, r8
call fcn.1400ddd4c
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov eax, r12d
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400ddaa0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1400ed164
nop
call fcn.1400ed164
int3
Function at 0x1400112c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x20
xor sil, sil
movsx ebp, cx
xor ebx, ebx
mov qword [rsp + 0x50], rdi
movabs r15, 0x7ffffffffeced2fe
movabs r14, 0x7fffffffffffffff
mov ecx, ebp
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x14001136c
mov sil, 1
call fcn.1400dc8ac
mov rdi, rax
call fcn.1400dc890
cmp rdi, 0x989680
jne 0x140011320
imul rax, rax, 0x64
jmp 0x14001133e
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
cmp rax, r15
jg 0x140011350
add rax, 0x1312d00
mov qword [rsp + 0x58], rax
jmp 0x140011355
mov qword [rsp + 0x58], r14
lea rcx, [rsp + 0x58]
call fcn.1400129e0
inc ebx
cmp ebx, 0x28
jl 0x1400112f2
movzx eax, sil
jmp 0x140011372
test sil, sil
setne al
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret