joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002bf0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400048e0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400048e0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002c60
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000a0a4]
mov rbx, rcx
test esi, esi
jle 0x140002d90
mov rax, qword [0x14000a0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002cab
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002d35
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002c90
mov rcx, rbx
call fcn.1400036b0
mov rdi, rax
test rax, rax
je 0x140002db2
mov rax, qword [0x14000a0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400037f0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000a0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002d97
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002d2e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002d40
add dword [0x14000a0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000a0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002d2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002bf0
nop dword [rax]
xor esi, esi
jmp 0x140002cb8
mov rax, qword [0x14000a0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002bf0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002bf0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003320
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000a100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000a0e0]
test rbx, rbx
je 0x14000337c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003373
test rsi, rsi
je 0x140003373
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003358
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400036b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140006b50]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400036d0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400036d8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400036d0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000372d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003724
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400036d0
add rax, 0x28
cmp rax, r9
jne 0x140003710
xor eax, eax
ret

Function at 0x140003730
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006b50]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000374f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003758
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000374f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400037f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006b50]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000380f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003818
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140006490
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14000649d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400064ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140006495
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x1400064c5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400064b2
sub eax, 3
jb 0x1400064df
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140006516
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140006506
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140006504
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400064f3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140006452
jmp 0x14000649d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2000
mov dl, 0
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140006562
cmp rsi, rcx
jae 0x14000656a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140006549
cmp al, 0x8f
ja 0x140006549
cmp byte [rsi - 2], 0xf
je 0x14000654f
sub al, 0xe8
cmp al, 1
ja 0x140006533
cmp rsi, rcx
jae 0x14000656a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140006539
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14000656a
lodsb al, byte [rsi]
jmp 0x140006549
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x4000]
mov eax, dword [rdi]
or eax, eax
je 0x1400065c7
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x6c58]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140006577
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400065c1
mov qword [rbx], rax
add rbx, 8
jmp 0x140006597
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x217]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14000661f
sub rsp, 0xffffffffffffff80
jmp 0x140002800
Function at 0x14000b344
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
test r8, r8
je 0x14000b36b
and qword [r8], 0
call fcn.14000b450
mov rbx, rax
test rax, rax
je 0x14000b433
mov rcx, rax
call fcn.14000b2cc
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000b42a
mov rax, qword [0x1400fd050]
test rax, rax
je 0x14000b3a3
inc dword [rax + 0xf4]
mov rdx, qword [0x1400fd060]
lea rcx, [rdi + rbp]
call qword [0x1400f6018]
mov rsi, rax
test rax, rax
je 0x14000b42a
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rdi
je 0x14000b402
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400fd050]
test rax, rax
je 0x14000b3f0
dec dword [rax + 0xf4]
mov rdx, qword [0x1400fd060]
mov rcx, rsi
call qword [0x1400f6020]
jmp 0x14000b433
test ebp, ebp
jle 0x14000b414
lea rcx, [rsi + rdi]
mov r8, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000b425
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000b435
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x14000b7a8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
not r8d
test rdx, rdx
je 0x14000b7d6
movzx eax, byte [r9]
inc r9
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x1400c70e0]
xor r8d, dword [rax + rcx*4]
sub rdx, 1
jne 0x14000b7b3
not r8d
mov eax, r8d
ret

Function at 0x14000b7e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x14000b83a
mov r11b, reloc.WLDAP32.dll_Ordinal_35
lea rdi, [0x1400c70e0]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x14000b824
cmp rdx, 2
jb 0x14000b824
cmp byte [r10], r11b
jne 0x14000b824
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x14000b802
jmp 0x14000b87b
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x14000b87b
mov r11b, reloc.WLDAP32.dll_Ordinal_35
lea rdi, [0x1400c70e0]
cmp dl, r11b
jne 0x14000b85f
cmp byte [r10], r11b
jne 0x14000b85f
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x14000b84d
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x14000d70c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c80], 0
lea rbx, [rcx + 0x5c88]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14000d7a5
mov r9d, dword [rbx + 4]
test r9d, r9d
jns 0x14000d75d
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140019c30
and dword [rbx], 0
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.14001932c
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c80]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x1400fd058]
movsxd r8, eax
mov rax, qword [rdi + 0x5c90]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14000d7ad
mov rcx, rbx
call fcn.14001932c
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140014820
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1400fd050]
mov rbx, rcx
and dword [rax + 0x5be4], 0
test rcx, rcx
je 0x140014889
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.140014894
lea rdx, [0x1400c8a9c]
mov rcx, rbx
mov rdi, rax
call fcn.14000b450
mov rbx, rax
test rax, rax
je 0x140014889
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140044328
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400fc800]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.140028cc8
call fcn.140029b1c
call fcn.140010fb0
call fcn.140056894
test al, al
je 0x1400443c1
call fcn.140044cfc
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140044378
mov ecx, reloc.WLDAP32.dll_Ordinal_46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400443b3
mov al, byte [0x1400fd715]
test al, al
jne 0x140044394
call fcn.14000a7ec
mov byte [0x1400fd715], 1
mov byte [rax + 0x70], 1
jmp 0x1400443a8
cmp al, 1
jne 0x1400443a8
mov byte [0x1400fd715], 0
call fcn.14000a7ec
mov byte [rax + 0x70], 0
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1400fd715], 0
je 0x1400443c1
call fcn.140053448
call fcn.140012514
mov rcx, qword [0x1400fd0e8]
lea r8, [0x1400fd0f8]
xorps xmm0, xmm0
xor r9d, r9d
movups xmmword [rsp + 0x20], xmm0
mov rax, qword [rcx]
lea edx, [r9 + 1]
call qword [rax + 0x108]
mov rcx, qword [0x1400fd0e8]
lea r8, [rsp + 0x20]
mov rdx, qword [0x1400fd0f8]
mov rax, qword [rcx]
call qword [rax + 0x190]
call fcn.14000a600
mov rcx, rax
call fcn.140028cf8
mov rcx, qword [0x1400fd0f0]
xor r8d, r8d
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400c20d0
add rsp, 0x48
ret
Function at 0x140049754
Capabilities:
Read .ini file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400fc800]
xor rax, rsp
mov qword [rsp + 0x78], rax
xorps xmm1, xmm1
mov rdi, rcx
cvtss2sd xmm1, xmm2
lea rcx, [rsp + 0x38]
mov rbx, r9
mov rsi, rdx
call fcn.140057700
cmp qword [rsp + 0x50], 0xf
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x58]
cmova r8, qword [rsp + 0x38]
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + reloc.WLDAP32.dll_Ordinal_32], 0x20
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x1400497f7
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400497f2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400497f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c1df4
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
cvtsd2ss xmm0, xmm0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400c20d0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400499cc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400fc800]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov dword [rbp - 0x40], 0x23252572
mov ecx, ebx
mov dword [rbp - 0x3c], 0x23330b2f
mov dword [rbp - 0x38], 0x33282435
mov word [rbp - 0x34], 0x100
lea eax, [rcx + 0x3f]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x140049a09
movdqa xmm0, xmmword [0x1400cf5d0]
mov rcx, rbx
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x33], bl
mov word [rbp - 0x20], reloc.WLDAP32.dll_Ordinal_60
mov byte [rbp - 0x1e], 1
lea eax, [rcx + 0x3f]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x11
jb 0x140049a36
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x1e], bl
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1400fd0d8], rax
test rax, rax
je 0x140049ad8
movdqa xmm0, xmmword [0x1400cf2a0]
lea rdx, [rbp - 0x18]
mov rcx, rax
movdqu xmmword [rbp - 0x18], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov rcx, qword [0x1400fd0d8]
xor r9d, r9d
mov dword [rsp + 0x30], 0x40
xor r8d, r8d
mov dword [rsp + 0x28], ebx
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x1400fd0d8]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400fd0d8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov al, 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c20d0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x140049af8
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400fc800]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ebx, r8d
mov rdi, rdx
xor edx, edx
cmp ecx, 0x7b
ja 0x140049b33
movsxd rax, ecx
lea rdx, [0x1400fc350]
mov rdx, qword [rdx + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x1400cf2c0]
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0x30], 0
test rdx, rdx
jne 0x140049b7f
mov dword [rbp - 0x40], 0x272d256c
mov dword [rbp - 0x3c], 0xd653020
mov dword [rbp - 0x38], 0x1003122
xor ecx, ecx
lea eax, [rcx + 0x3f]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x140049b67
mov byte [rbp - 0x35], 0
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x30]
call fcn.1400530c0
cmp ebx, 1
jne 0x140049bce
mov dword [rbp - 0x40], 0x3124326f
mov dword [rbp - 0x3c], 0x2e316430
mov dword [rbp - 0x38], 0x2f026822
mov word [rbp - 0x34], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp - 0x32], bl
xor ecx, ecx
lea eax, [rcx + 0x3f]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xd
jb 0x140049bad
mov byte [rbp - 0x32], 0
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x30]
call fcn.1400530c0
mov dword [rbp - 0x40], 0x42f00000
mov dword [rbp - 0x3c], 0x41980000
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rcx, qword [rbp - 0x30]
lea rdx, [rbp - 0x40]
call fcn.140032d18
test al, al
je 0x140049c16
test ebx, ebx
jne 0x140049c16
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140049c54
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049c4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049c4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c1df4
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c20d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140049c74
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x1400fc800]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rax, qword [0x1400fd0d8]
xor r9d, r9d
and qword [rbp - 0x15], 0
xor r8d, r8d
and dword [rbp + 3], 0
xor ecx, ecx
and dword [rbp + 0x1b], 0
and dword [rbp - 0x29], 0
lea edx, [r9 + 1]
and dword [rbp - 0x25], 0
and dword [rbp - 9], 0
and dword [rbp + 0x13], 0
mov qword [rbp + 7], rax
lea rax, [0x1400fd0e8]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x50], rax
lea rax, [0x1400fd0e0]
mov qword [rsp + 0x48], rax
lea rax, [0x1400fd0f0]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x49]
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rax
mov dword [rbp - 1], 2
mov dword [rbp - 0x19], Ordinal_32
mov dword [rbp - 0x21], reloc.WLDAP32.dll_Ordinal_60
mov dword [rbp - 0x1d], 1
mov dword [rbp + 0x17], 2
mov dword [rbp - 5], reloc.WLDAP32.dll_Ordinal_32
mov dword [rbp - 0xd], 1
mov dword [rbp + 0xf], 1
mov dword [rbp - 0x49], 0xb000
mov dword [rbp - 0x45], 0xa000
call sub.d3d11.dll_D3D11CreateDeviceAndSwapChain
mov rcx, qword [0x1400fd0f0]
lea r9, [rbp - 0x41]
lea r8, [0x1400cde58]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [0x1400fd0e0]
lea r9, [0x1400fd0f8]
mov rdx, qword [rbp - 0x41]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rbp - 0x41]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rsp + 0x30], 2
lea rcx, str.1.89.7_WIP
mov qword [rsp + 0x28], reloc.WS2_32.dll_sendto
mov edx, 0x37c8
mov r9d, 8
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r8d, 0x42c
call fcn.1400080d8
xor ecx, ecx
call fcn.140007ea0
call fcn.14000a7ec
movdqa xmm0, xmmword [0x1400cf5e0]
xor edx, edx
movdqu xmmword [rbp + 0x27], xmm0
mov dword [rbp + 0x37], 0x20340613
mov rcx, qword [rax + 0x50]
mov dword [rbp + 0x3b], 0x373b3537
mov dword [rbp + 0x3f], 0x3c2d2c79
mov word [rbp + 0x43], 0x100
lea eax, [rdx + 0x3f]
xor byte [rbp + rdx + 0x27], al
inc rdx
cmp rdx, 0x1c
jb 0x140049e0f
movss xmm2, dword [0x1400c8e8c]
lea rdx, [rbp + 0x27]
and qword [rsp + 0x20], 0
xor r9d, r9d
mov byte [rbp + 0x44], 0
call fcn.14001b3a8
mov rcx, qword [0x1400fd0d8]
mov qword [0x1400fd718], rax
call fcn.1400299ac
mov rdx, qword [0x1400fd0e8]
mov rcx, qword [0x1400fd0e0]
call fcn.140028a9c
mov rcx, qword [0x1400fd0e0]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov al, 1
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c20d0
add rsp, 0x100
pop rbp
ret
Function at 0x14004d160
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1400fc800]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
call fcn.1400516d0
xor r8d, r8d
mov dword [rsp + 0x20], 0x617e01
mov byte [rsp + 0x24], 1
lea eax, [r8 + 0x3f]
xor byte [rsp + r8 + 0x20], al
inc r8
cmp r8, 3
jb 0x14004d18d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x24], 0
call fcn.14003fc60
call fcn.140051718
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdx, rbx
call fcn.14003fc60
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400c20d0
add rsp, 0x30
pop rbx
ret

Function at 0x14004d1dc
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1400fc800]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
call fcn.140051674
xor r8d, r8d
mov dword [rsp + 0x20], 0x617e01
mov byte [rsp + 0x24], 1
lea eax, [r8 + 0x3f]
xor byte [rsp + r8 + 0x20], al
inc r8
cmp r8, 3
jb 0x14004d209
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x24], 0
call fcn.14003fc60
call fcn.140051718
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdx, rbx
call fcn.14003fc60
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400c20d0
add rsp, 0x30
pop rbx
ret

Function at 0x14004d258
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1400fc800]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
call fcn.1400516f4
xor r8d, r8d
mov dword [rsp + 0x20], 0x617e01
mov byte [rsp + 0x24], 1
lea eax, [r8 + 0x3f]
xor byte [rsp + r8 + 0x20], al
inc r8
cmp r8, 3
jb 0x14004d285
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x24], 0
call fcn.14003fc60
call fcn.140051718
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdx, rbx
call fcn.14003fc60
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400c20d0
add rsp, 0x30
pop rbx
ret
Function at 0x14004e670
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rsi
sub rsp, 0x60
xorps xmm0, xmm0
xor esi, esi
movups xmmword [rax - 0x38], xmm0
movups xmmword [rax - 0x28], xmm0
movups xmmword [rax - 0x18], xmm0
mov rcx, qword [0x1400fd0d8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [0x1400fd0d8]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, qword [0x1400fd0d8]
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14004e6e6
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageA]
call fcn.14000a7ec
mov rcx, qword [0x1400fd0d8]
mov rbx, rax
mov qword [rax + 0xc8], rcx
lea rcx, [rsp + 0x70]
mov dword [rax + 0x10], 0x3c888889
call qword [sym.imp.USER32.dll_GetCursorPos]
movd xmm0, dword [rsp + 0x70]
mov ecx, 1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0xe00], xmm0
movd xmm0, dword [rsp + 0x74]
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0xe04], xmm0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14004e75c
mov byte [rbx + 0xe08], 1
mov eax, dword [rbx + 0xe04]
mov dword [rbx + 0x36f0], eax
mov byte [rbx + 0x3740], 1
jmp 0x14004e763
mov byte [rbx + 0xe08], sil
call fcn.140044328
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x38], 0x12
jne 0x14004e68d
call fcn.1400298c0
call fcn.140029db0
xor ecx, ecx
call fcn.14000878c
mov rcx, qword [0x1400fd0d8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rbx, qword [rsp + 0x78]
mov al, 1
add rsp, 0x60
pop rsi
ret