joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021ac0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x1411bed4b], 0
jne 0x140021baf
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x140021ba5
lea rbx, [0x141191170]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x11440]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x140021b87
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.140069a40
lea rax, [0x1409e7f62]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.1400399c0
nop
int3

Function at 0x140023100
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400231b7
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
lea rax, [0x1409ca9ba]
mov ebx, 0xa
call fcn.1400094a0
test rbx, rbx
je 0x140023142
cmp rbx, 3
jne 0x140023156
cmp word [rax], 0x666f
jne 0x140023156
cmp byte [rax + 2], 0x66
nop
jne 0x140023156
movabs rax, 0x7fffffffffffffff
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x10], rbx
call fcn.140052700
test bl, bl
je 0x140023173
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.14003b300
lea rax, [0x1409cb6c8]
mov ebx, 0xb
call fcn.14003bc00
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
call fcn.14003bc00
call fcn.14003b560
nop dword [rax]
call fcn.14003b380
lea rax, [0x1409f105c]
mov ebx, 0x3f
call fcn.1400399c0
nop
call fcn.1400673a0
nop dword [rax]
jmp fcn.140023100
Function at 0x140023fa0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14002409e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x140023fe0
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x14002408f
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.140024b60
nop dword [rax]
test rax, rax
je 0x14002408f
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x1400240e0]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.140067260
xorps xmm15, xmm15
mov r14, qword [0x1411bf260]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x14002407d
xor eax, eax
jmp 0x140024087
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x140023fd2
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.1400673a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.140023fa0
Function at 0x1400328e0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x140032b86
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1270]
mov rcx, qword [rax + 0x1260]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x140032b7a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1260], 0
cmp byte [0x1411bed4b], 0
jne 0x140032942
xor edx, edx
xor ebx, ebx
nop
jmp 0x14003298a
xor edx, edx
jmp 0x14003296d
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1270]
mov rax, rcx
call fcn.1400212e0
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x140032946
add rax, 0x1260
call fcn.1400327a0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x140032b14
mov rsi, qword [rax + rdx*8 + 0x1270]
nop dword [rax + rax]
cmp rsi, 0x1000
jb 0x140032987
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.140016180
test rax, rax
jne 0x1400329e2
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x140032987
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
nop
mov r8, rcx
shr rcx, 3
movzx r9d, byte [rsi + rcx]
and r8d, 7
mov rdx, rcx
mov rcx, r8
mov r10d, 1
shl r10d, cl
add rsi, rdx
test r10b, r9b
je 0x140032a29
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x140032987
nop
lock or byte [rsi], r10b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x140032b6d
lea r10, [0x141191170]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x11440]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x11440]
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x140032aaf
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x140032ae5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1248]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1248], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x140032987
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x140032b65
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1270], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x140032987
cmp rbx, 0x200
ja 0x140032b58
lea rdx, [rax + 0x1270]
lea rsi, [rax + 0x1238]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.140027460
mov rax, qword [rsp + 0x48]
add rax, 0x1260
call fcn.1400327a0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
call fcn.140069aa0
mov rax, r8
call fcn.140069a20
mov rax, r8
mov ecx, 0x40
call fcn.140069a40
mov edx, 0x200
nop
call fcn.140069a80
nop
mov qword [rsp + 8], rax
call fcn.14006bf80
mov rax, qword [rsp + 8]
jmp fcn.1400328e0
Function at 0x1400349a0
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140034c26
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x54], 0
mov rax, qword [0x141165cb0]
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x4c]
lea rbx, [rsp + 0x54]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rbx
call fcn.1400368a0
xorps xmm15, xmm15
mov r14, qword [0x1411bf260]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x50]
cmp eax, 0xa
jb 0x140034a9f
jne 0x140034a33
cmp dword [rsp + 0x4c], 0
jne 0x140034a33
movzx ecx, word [rsp + 0x54]
cmp ecx, 0x3ad7
jb 0x140034a9f
mov rax, qword [0x141165ca8]
call fcn.140036740
lea rcx, [rax + 3]
mov qword [rsp + 0x60], rcx
movzx edx, byte [rcx]
mov byte [rsp + 0x4b], dl
or edx, 0xffffff80
mov byte [rcx], dl
lea rax, [0x1411c0f4a]
mov ebx, 0x20
mov ecx, 0x21
call fcn.140035200
mov rcx, qword [0x1411bf248]
cmp rcx, 0x105
ja 0x140034c17
mov qword [rsp + 0x58], rcx
lea rax, [0x1411c0d60]
lea rbx, [0x1411c0700]
call fcn.14006a3e0
mov rcx, qword [rsp + 0x58]
xor eax, eax
jmp 0x140034ab1
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [rdx + rbx + 1], dil
inc rax
cmp rax, 0x20
jge 0x140034b19
lea rdx, [rcx + rax*2]
lea rbx, [0x1411c0d60]
movzx esi, byte [rax + rbx + 0x1ea]
shr sil, 4
movzx esi, sil
lea rdi, [0x1409cf1ad]
movzx esi, byte [rdi + rsi]
nop dword [rax]
cmp rdx, 0x20b
jae 0x140034c0a
mov byte [rbx + rdx], sil
lea rsi, [rcx + rax*2]
lea rsi, [rsi + 1]
movzx r8d, byte [rax + rbx + 0x1ea]
and r8d, 0xf
movzx edi, byte [r8 + rdi]
cmp rsi, 0x20b
jb 0x140034aa9
jmp 0x140034bfd
lea rdx, [rcx + 0x40]
jmp 0x140034b2d
lea rbx, [0x1411c0d60]
mov byte [rbx + rdx], 0x41
inc rdx
cmp rdx, 0x20a
jge 0x140034b45
cmp rdx, 0x20b
jb 0x140034b1f
nop
jmp 0x140034bf0
mov rax, qword [0x1408421f0]
lea rcx, [0x1411c0d60]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 3
movups xmmword [rsp + 0x30], xmm15
call fcn.140036aa0
xorps xmm15, xmm15
mov r14, qword [0x1411bf260]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.14006af80
xorps xmm15, xmm15
mov r14, qword [0x1411bf260]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp dword [rsp], 3
jne 0x140034bdf
movzx eax, byte [rsp + 0x4b]
mov rcx, qword [rsp + 0x60]
mov byte [rcx], al
call fcn.14003b300
lea rax, [0x1409f516c]
mov ebx, 0x5f
call fcn.14003bc00
call fcn.14003b380
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [0x1411bed36], 1
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rdx
mov ecx, 0x20b
call fcn.140069a20
mov rax, rsi
mov ecx, 0x20b
call fcn.140069a20
mov rax, rdx
mov ecx, 0x20b
call fcn.140069a20
mov edx, 0x105
nop dword [rax]
call fcn.140069a80
nop
call fcn.1400673a0
jmp fcn.1400349a0
Function at 0x140034f40
Capabilities:
Reference sql statements

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x1400351e9
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x30], rax
movabs rdx, 0x6574737953746547
mov qword [rsp + 0x56], rdx
movabs rdx, 0x467341656d69546d
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x656d6954656c69
mov qword [rsp + 0x66], rdx
lea rbx, [rsp + 0x56]
mov ecx, 0x18
mov rdi, rcx
call fcn.140033b80
cmp dword [0x1411bf520], 0
jne 0x140034fbc
mov qword [0x141165c70], rax
jmp 0x140034fc8
lea rdi, [0x141165c70]
call fcn.140069580
test rax, rax
je 0x1400351d7
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x3e], rdx
movabs rsi, 0x65636e616d726f66
mov qword [rsp + 0x46], rsi
movabs r8, 0x7265746e756f43
mov qword [rsp + 0x4e], r8
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x3e]
mov ecx, 0x18
mov rdi, rcx
call fcn.140033b80
cmp dword [0x1411bf520], 0
jne 0x140035027
mov qword [0x141165c90], rax
jmp 0x140035033
lea rdi, [0x141165c90]
call fcn.140069580
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x6e], rdx
movabs rdx, 0x65636e616d726f66
mov qword [rsp + 0x76], rdx
movabs rdx, 0x724665636e616d72
mov qword [rsp + 0x78], rdx
movabs rdx, 0x79636e65757165
mov qword [rsp + 0x80], rdx
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x6e]
mov ecx, 0x1a
mov rdi, rcx
call fcn.140033b80
cmp dword [0x1411bf520], 0
jne 0x14003509b
mov qword [0x141165c98], rax
jmp 0x1400350a7
lea rdi, [0x141165c98]
call fcn.140069580
cmp qword [0x141165c90], 0
je 0x1400351c6
test rax, rax
je 0x1400351c6
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.1400367a0
xorps xmm15, xmm15
mov r14, qword [0x1411bf260]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x1400351b5
nop word [rax + rax]
cmp rax, 0x7fffffff
jg 0x1400351a4
mov qword [rsp + 0x28], rax
mov rax, qword [0x141165c90]
lea rcx, [0x1411bf220]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.1400367a0
xorps xmm15, xmm15
mov r14, qword [0x1411bf260]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
xor ecx, ecx
mov edx, 0x1e
mov ebx, 0x3b9aca00
jmp 0x140035158
lea rdx, [rcx - 1]
mov ecx, edi
test rdx, rdx
jl 0x140035175
movsxd rsi, eax
mov edi, ecx
mov rcx, rdx
shl rsi, cl
cmp rbx, rsi
jl 0x140035152
sub rbx, rsi
bts edi, ecx
jmp 0x140035152
movsxd rax, eax
cmp rbx, rax
mov eax, 0x7fffffff
cmovge ecx, eax
movsxd rax, ecx
mov qword [0x1411bf218], rax
mov byte [0x1411bed4d], 1
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x1409f4b32]
mov ebx, 0x56
call fcn.1400399c0
lea rax, [0x1409f432e]
mov ebx, 0x50
call fcn.1400399c0
lea rax, [0x1409d9856]
mov ebx, 0x1b
call fcn.1400399c0
lea rax, [0x1409ea599]
mov ebx, 0x30
call fcn.1400399c0
nop
mov qword [rsp + 8], rax
call fcn.1400673a0
mov rax, qword [rsp + 8]
jmp fcn.140034f40
Function at 0x140048200
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14004836a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x140048218
cmp edx, ecx
jne 0x140048358
nop dword [rax]
test rsi, rsi
jne 0x140048358
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x140048274
nop
call fcn.14006b3e0
xorps xmm15, xmm15
mov r14, qword [0x1411bf260]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.140048100
mov rcx, qword [0x141168988]
mov rdx, qword [0x141168980]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
mov r8d, esi
and esi, 0xffffffe0
sub edi, esi
test edi, edi
jl 0x140048353
cmp edi, 0x20
sbb esi, esi
sar r8d, 5
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x140048348
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x14116b0d0]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x14116b0d0], rbx
nop
mov edx, 1
lea rsi, [0x14116b0d8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1220]
shr rdx, 0x3d
test dl, dl
jne 0x140048337
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1220], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x1409e5953]
mov ebx, 0x28
call fcn.1400399c0
mov rcx, rax
mov rax, rsi
call fcn.140069a20
call fcn.140037c00
lea rax, [0x1409e1656]
mov ebx, 0x23
call fcn.1400399c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.1400673a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140048200
Function at 0x1400555e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x140055758
movzx edx, byte [rax]
nop
test edx, edx
jne 0x14005561c
test r8b, r8b
jne 0x14005561c
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x14005562f
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x140055718
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x140055706
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x1400556fc
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x140055683
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x1400556c6
mov eax, 1
cmp rax, rbx
ja 0x1400556b5
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.140069ae0
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x1400556f4
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x1400556bd
mov r8d, eax
mov eax, r10d
jmp 0x140055688
mov rcx, rbx
call fcn.140069a20
xor eax, eax
mov rcx, rax
call fcn.140069a20
mov eax, r8d
mov rcx, rbx
call fcn.140069ae0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x14005574e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x140055711
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x140055635
mov eax, edx
mov rcx, rbx
call fcn.140069a20
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.140069a20
nop
int3
Function at 0x14005d300
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14005d3b9
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x14005d400]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.140067260
xorps xmm15, xmm15
mov r14, qword [0x1411bf260]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.1400673a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.14005d300
Function at 0x1400694a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x1411bf740]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x1411bed4a], 0
je 0x1400694d6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x1411bfbc0]
aesenc xmm0, xmmword [0x1411bfbd0]
aesenc xmm0, xmmword [0x1411bfbe0]
movq rax, xmm0
ret
jmp 0x14000b760

Function at 0x1407f6340
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x141154dc0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1407f6360
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1407f6368
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1407f6360
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1407f63b5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1407f63ac
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1407f6360
add rax, 0x28
cmp rax, r9
jne 0x1407f6398
xor eax, eax
ret

Function at 0x1407f63c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x141154dc0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1407f63e0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1407f63e8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1407f63e0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x1407f6470
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x141154dc0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1407f6490
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1407f6498
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x140002980
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
movaps xmmword [rax - 0x28], xmm6
mov rbp, r8
movsxd r8, dword [0x1400b7ca4]
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm7
lea rdx, [rax - 0x78]
movaps xmmword [rax - 0x48], xmm8
mov rdi, rcx
shl r8, 5
lea rcx, [0x1400b7cc0]
add r8, qword [0x1400b7ca8]
mov rbx, r9
movaps xmmword [rax - 0x58], xmm9
movaps xmmword [rax - 0x68], xmm10
call fcn.140004220
mov rcx, qword [0x1400b7b30]
lea r8, [rsp + 0x30]
xorps xmm9, xmm9
mov rax, qword [rax]
mov eax, dword [rax + 0x40]
shl eax, 5
movsxd rdx, eax
add rdx, rbx
mov qword [rsp + 0x30], 0
xor ebx, ebx
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 0xc]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm8, dword [rsp + 0x34]
movss xmm7, dword [rsp + 0x30]
subss xmm8, dword [rdi + 0x34]
subss xmm7, dword [rdi + 0x30]
movss xmm6, dword [rsp + 0x38]
subss xmm6, dword [rdi + 0x38]
movaps xmm1, xmm8
movaps xmm0, xmm7
xorps xmm6, xmmword [0x1400a36d0]
call fcn.140087ef4
movaps xmm1, xmm0
movaps xmm0, xmm6
call fcn.140088244
movaps xmm10, xmm0
movaps xmm1, xmm7
mulss xmm10, dword [0x1400a3420]
movaps xmm0, xmm8
subss xmm10, dword [rdi + 0x48]
call fcn.140088244
movaps xmm7, xmm0
xorps xmm8, xmm8
mulss xmm7, dword [0x1400a3420]
movaps xmm0, xmm10
xorps xmm6, xmm6
subss xmm7, dword [rdi + 0x4c]
movaps xmm1, xmm7
call fcn.140087ef4
movss xmm1, dword [0x1400b7c98]
comiss xmm1, xmm0
jbe 0x140002aae
movaps xmm8, xmm10
movaps xmm6, xmm7
movss xmm7, dword [0x1400a342c]
comiss xmm8, xmm7
movss xmm1, dword [0x1400a3450]
movss xmm0, dword [0x1400a3440]
jbe 0x140002ad2
comiss xmm0, xmm8
jae 0x140002af0
comiss xmm8, xmm0
movaps xmm7, xmm8
jbe 0x140002ae0
subss xmm7, xmm1
movss xmm2, dword [0x1400a34c8]
comiss xmm2, xmm7
jbe 0x140002af0
movaps xmm7, xmm2
comiss xmm6, xmm0
jbe 0x140002af9
subss xmm6, xmm1
movss xmm0, dword [0x1400a34d0]
comiss xmm0, xmm6
jbe 0x140002b0a
addss xmm6, xmm1
divss xmm7, dword [0x1400b7c94]
divss xmm6, dword [0x1400b7c94]
ucomiss xmm7, xmm9
jp 0x140002b2e
jne 0x140002b2e
ucomiss xmm6, xmm9
jp 0x140002b2e
je 0x140002baf
cmp byte [0x1400b7cd0], bl
je 0x140002b6a
movsxd r8, dword [0x1400b7cd4]
lea rdx, [rsp + 0x40]
shl r8, 5
lea rcx, [0x1400b7cf8]
add r8, qword [0x1400b7ce0]
call fcn.140004220
mov rcx, qword [rax]
mov ecx, dword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140002baf
addss xmm7, dword [rsi]
addss xmm6, dword [rsi + 4]
movss xmm1, dword [rsi + 8]
lea r8, [rsp + 0x30]
mov rcx, qword [0x1400b7b30]
addss xmm1, xmm9
mov r9d, 0xc
mov qword [rsp + 0x20], rbx
movaps xmm0, xmm7
mov rdx, rbp
unpcklps xmm0, xmm6
movsd qword [rsp + 0x30], xmm0
movss dword [rsp + 0x38], xmm1
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop rdi
pop rsi
pop rbp
ret