joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009a640
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400d71d4]
test esi, esi
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
jle 0x14009a7d0
mov rax, qword [0x1400d71d8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rdi, rdx
jb 0x14009a68c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rdi, rdx
jb 0x14009a715
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x14009a670
mov rcx, rdi
call fcn.14009b1a0
test rax, rax
mov r12, rax
je 0x14009a822
mov rax, qword [0x1400d71d8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.14009b2e0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1400d71d8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14009a805
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14009a70e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x14009a780
add dword [0x1400d71d4], 1
cmp ebx, 8
jae 0x14009a741
test bl, 4
jne 0x14009a7e0
test ebx, ebx
je 0x14009a736
movzx eax, byte [rbp]
test bl, 2
mov byte [rdi], al
jne 0x14009a7f4
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
sub ebx, 1
mov rdx, qword [rbp + rax - 8]
cmp ebx, 8
mov qword [rdi + rax - 8], rdx
jb 0x14009a736
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, ebx
mov qword [rdi + rdx], rcx
jb 0x14009a75a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov r8d, 4
mov eax, 0x40
mov rcx, qword [rsp + 0x20]
cmovne r8d, eax
mov rdx, qword [rsp + 0x38]
add rsi, qword [0x1400d71d8]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14009a70e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14009a5d0
xor esi, esi
jmp 0x14009a697
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rdi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rdi + rbx - 4], eax
jmp 0x14009a736
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rdi + rbx - 2], ax
jmp 0x14009a736
mov rax, qword [0x1400d71d8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.14009a5d0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rdi
call fcn.14009a5d0
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x14009adf0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1400d7240]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400d7220]
test rbx, rbx
je 0x14009ae44
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x14009ae3b
test rsi, rsi
je 0x14009ae3b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14009ae20
lea rcx, [0x1400d7240]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x14009b1a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1400c5080]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x14009b20f
mov rcx, r9
call fcn.14009b070
test eax, eax
je 0x14009b20f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x14009b20d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x14009b204
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x14009b20f
add rdx, 0x28
cmp rdx, r9
jne 0x14009b1f0
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x140003a00
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140003a5d
lea rbx, [0x1400c9390]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003a44
cmp r10, 2
jb 0x140003a44
cmp byte [r9], r8b
jne 0x140003a44
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003a20
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140003a9f
lea rbx, [0x1400c9390]
cmp r8b, 0x23
jne 0x140003a83
cmp byte [r9], r8b
jne 0x140003a83
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003a70
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003c60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x140003c7e
mov qword [r8], r14
lea rdx, [0x1400c8e80]
call fcn.140003ab0
mov rbx, rax
test rax, rax
jne 0x140003ca3
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140003dcf
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003dcf
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140003dcf
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003dcf
cmp rdi, 0xffffffffffffffff
je 0x140003dcf
mov rcx, rdi
call fcn.140008b40
mov rbp, rax
test rax, rax
je 0x140003dcf
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140003dbc
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x140108f30]
test r8, r8
je 0x140003db1
movsx rdx, word [r8 + 0x54a8]
lea rcx, [r8 + 0x54ac]
mov r9d, dword [r8 + 0x4008]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x140003da6
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x54a8], cx
movsx rax, cx
lea rcx, [r8 + 0x54ac]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x54a4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140003dd8
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140003dca
mov qword [rsi], rdi
mov rax, rbp
jmp 0x140003dda
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140012ae0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov r11, rcx
lea rdi, [0x1400c9390]
movsxd rcx, dword [rcx + 0x108]
mov r10d, edx
shr r10d, 0x18
mov r8d, edx
shr r8d, 8
mov r9d, edx
mov rax, qword [r11 + 0x110]
shr r9d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r8b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, r10
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
mov rcx, qword [r11]
not ebx
cmp dword [rcx + 0x4118], ebx
jne 0x140012b74
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.14001e8e0
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400165d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rbx, qword [0x140108f30]
lea r8, [0x1400c8a41]
mov r10d, 0xffffffff
lea r11, [0x1400c9390]
mov ecx, r10d
mov r9b, reloc.WLDAP32.dll_Ordinal_35
cmp r9b, 0x23
jne 0x140016613
cmp byte [r8], r9b
jne 0x140016613
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140016600
not ecx
call fcn.14000c4e0
cmp byte [rbx + 0x104], 0
je 0x140016653
test rax, rax
je 0x140016653
cmp byte [rax + 0xcb], 0
je 0x140016653
mov dil, 1
jmp 0x140016656
xor dil, dil
movss xmm3, dword [0x1400cf190]
lea rcx, [rbx + 0x4b58]
movss xmm1, dword [rbx + 0x3a68]
lea rdx, [rsp + 0x30]
movss xmm4, dword [0x1400cf1fc]
xorps xmm2, xmm2
movaps xmm0, xmm4
mov dword [rsp + 0x30], 4
subss xmm0, xmm1
mulss xmm0, xmm3
addss xmm0, xmm1
movss xmm1, dword [rbx + 0x3a6c]
movss dword [rsp + 0x20], xmm0
xorps xmm0, xmm0
subss xmm0, xmm1
mulss xmm0, xmm3
addss xmm0, xmm1
movss xmm1, dword [rbx + 0x3a70]
subss xmm2, xmm1
movss dword [rsp + 0x24], xmm0
movss xmm0, dword [rbx + 0x3a74]
subss xmm4, xmm0
mulss xmm2, xmm3
addss xmm2, xmm1
mulss xmm4, xmm3
addss xmm4, xmm0
movss dword [rsp + 0x28], xmm2
movups xmm0, xmmword [rbx + 0x3a68]
movups xmmword [rsp + 0x34], xmm0
movss dword [rsp + 0x2c], xmm4
call fcn.14001f420
cmp dword [rbx + 0x4b54], 4
je 0x140016711
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbx + 0x3a68], xmm0
test dil, dil
je 0x140016747
mov rax, qword [0x140108f30]
or dword [rax + 0x4ae0], 1
movsd xmm0, qword [rbx + 0x53d0]
xor edx, edx
mov qword [rax + 0x4af8], rdx
movsd qword [rax + 0x4af0], xmm0
mov dword [rax + 0x4ae4], 1
xor edx, edx
lea rcx, str.Tooltip_Error
mov r8d, 0x200016f
call fcn.14000f3e0
mov ecx, 1
movzx esi, al
call fcn.1400044d0
test sil, sil
je 0x14001683a
mov rcx, qword [rbx + 0x40c0]
cmp word [rcx + 0xd8], 1
jne 0x14001683f
mov rdi, qword [0x140108f30]
mov rcx, qword [rdi + 0x40c0]
mov byte [rcx + 0xcc], 1
mov rax, qword [rdi + 0x40c0]
cmp byte [rax + 0xcf], 0
jne 0x1400167ed
lea rdx, str.MESSAGE_FROM_DEAR_IMGUI
mov r8, rdx
cmp rdx, 0xffffffffffffffff
jae 0x1400167de
nop dword [rax + rax]
movzx ecx, byte [r8]
test cl, cl
je 0x1400167de
lea rax, [r8 + 1]
cmp cl, 0x23
jne 0x1400167d5
cmp byte [rax], cl
je 0x1400167de
mov r8, rax
cmp rax, 0xffffffffffffffff
jb 0x1400167c0
xorps xmm3, xmm3
call fcn.14003baf0
mov rdi, qword [0x140108f30]
mov rcx, qword [rbx + 0x40c0]
call fcn.140011ea0
mov rcx, qword [rbx + 0x40c0]
call fcn.140011e00
mov rdx, qword [rdi + 0x40c0]
movzx eax, sil
movss xmm0, dword [rdx + 0x28]
movss xmm1, dword [rdx + 0x2c]
movss dword [rbx + 0x53d0], xmm0
movss dword [rbx + 0x53d4], xmm1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call fcn.140011a80
mov rbx, qword [rsp + 0x60]
movzx eax, sil
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14001d120
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5380], 0
lea rbx, [rcx + 0x5388]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001d1c7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001d17a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001fb80
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400043a0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5380]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5390]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140108f40]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001d1cf
mov rcx, rbx
call fcn.1400043a0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001d4f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x140108f30]
xor ebp, ebp
cmp byte [rbx + 0x52c8], bpl
jne 0x14001d5cf
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14001d5c8
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.140003c60
mov rsi, rax
test rax, rax
je 0x14001d5c8
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x14001d554
mov rcx, rax
call fcn.14001d720
mov r8, qword [0x140108f30]
test r8, r8
je 0x14001d5bf
movsx rdx, word [r8 + 0x54a8]
lea rcx, [r8 + 0x54ac]
mov r9d, dword [r8 + 0x4008]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x14001d5b4
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x54a8], cx
movsx rax, cx
lea rcx, [r8 + 0x54ac]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x54a4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x52c8], 1
movss xmm0, dword [rbx + 0x52cc]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14001d65e
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x52cc], xmm0
jb 0x14001d65e
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x14001d651
mov rax, qword [0x140108f30]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x52cc], ebp
call fcn.14001d980
lea rdx, [0x1400c8e84]
mov rcx, rdi
mov rsi, rax
call fcn.140003ab0
mov rdi, rax
test rax, rax
je 0x14001d658
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14001d658
mov byte [rbx + 0xbc], 1
mov dword [rbx + 0x52cc], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14001d680
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140108f30]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001d6e3
mov qword [rsp], rbx
lea rbx, [0x1400c9390]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001d6c3
cmp byte [r8], r9b
jne 0x14001d6c3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001d6b0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x52e0]
not eax
mov r8, qword [r10 + 0x52e8]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x14001d70f
cmp dword [r8 + 8], eax
je 0x14001d716
add r8, 0x48
cmp r8, rcx
jne 0x14001d700
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x140031c70
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x1400e06c0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x140108f30]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x140031e8f
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140031e8f
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x140108f30]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x140031d44
movsx rdx, word [r8 + 0x54a8]
lea rax, [r8 + 0x54ac]
mov r9d, dword [r8 + 0x4008]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x140031d39
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x54a8], cx
movsx rax, cx
lea rax, [rax*8 + 0x54ac]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x54a0]
test rdi, rdi
je 0x140031d61
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x140031d64
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, [0x1400ce0e8]
mov qword [rsi + 0x90], rax
mov qword [rsi + 0xa0], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x140031da7
mov rsi, qword [r8 + 0xa0]
jmp 0x140031daa
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140031dd5
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x140108f30]
mov rcx, qword [rax + 0x4bf0]
mov rax, qword [rdi]
mov rdx, qword [rcx]
mov qword [rdx + 0x30], rax
mov qword [rdx + 0x28], rax
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x140031e4f
inc rbx
cmp rbx, 5
jl 0x140031e31
jmp 0x140031e7b
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x140031e91
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400b5570
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x140036b00
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [0x140108f30]
mov rdx, qword [rax + 0x4ee8]
cmp ecx, 0xffffffff
jne 0x140036b1a
cmp dword [rdx + 0x74], ecx
cmovne ecx, dword [rdx + 0x74]
cmp ecx, dword [rdx + 0x6c]
mov eax, 0xffffffff
cmove ecx, eax
test byte [rdx + 4], 7
je 0x140036b97
mov r10d, dword [rdx]
lea r8, [0x1400ce1e1]
movzx eax, word [rdx + 0x78]
lea r11, [0x1400c9390]
not r10d
mov word [rdx + 0x224], cx
mov ecx, r10d
mov byte [rdx + 0x23b], 1
mov word [rdx + 0x7a], ax
mov r9b, reloc.WLDAP32.dll_Ordinal_35
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x140036b73
cmp byte [r8], r9b
jne 0x140036b73
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140036b60
not ecx
jmp fcn.140017c30
ret
Function at 0x14004be20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edx, 0x1000
mov ebx, ecx
mov r8d, edx
xor ecx, ecx
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x14004be55
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movups xmm0, xmmword [0x1401090a8]
mov ecx, ebx
movups xmmword [rax], xmm0
movsd xmm1, qword [0x1401090b8]
movsd qword [rax + 0x10], xmm1
mov eax, dword [0x1401090c0]
mov dword [rdi + 0x18], eax
movzx eax, word [0x1401090c4]
mov word [rdi + 0x1c], ax
call rdi
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14004d030
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x90
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
mov rax, qword [0x1400e06c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
movss xmm7, dword [0x1400cf290]
xor edi, edi
movss xmm6, dword [0x1400cf2f0]
movss xmm8, dword [0x1400cf1fc]
nop word [rax + rax]
cmp byte [reloc.WS2_32.dll_accept], dil
je 0x14004d1c5
cmp byte [0x140108f41], dil
je 0x14004d1c5
movss xmm1, dword [0x1400e0764]
movaps xmm2, xmm8
movd xmm0, dword [0x140108f90]
addss xmm1, xmm7
mov eax, dword [0x140108f98]
mov r9d, 0x40
cvtdq2ps xmm0, xmm0
cdq
mov dword [rsp + 0x28], edi
sub eax, edx
mov dword [rsp + 0x38], edi
sar eax, 1
mov qword [rsp + 0x3c], 1
divss xmm1, xmm6
mulss xmm1, xmm0
cvttss2si ecx, xmm1
movss xmm1, dword [0x1400e0760]
sub ecx, eax
add ecx, dword [0x140108f88]
divss xmm1, xmm6
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
subss xmm2, xmm1
divss xmm0, dword [0x1400e075c]
cvttss2si eax, xmm0
movd xmm0, dword [0x140108f94]
mov dword [rsp + 0x30], eax
mov eax, dword [0x140108f9c]
cvtdq2ps xmm0, xmm0
cdq
sub eax, edx
mov edx, 0x1000
sar eax, 1
mov r8d, edx
mulss xmm2, xmm0
cvttss2si ecx, xmm2
sub ecx, eax
add ecx, dword [0x140108f8c]
movd xmm0, ecx
xor ecx, ecx
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x1400e075c]
cvttss2si eax, xmm0
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x14004d1c5
movups xmm0, xmmword [0x140109088]
mov r8d, Ordinal_45
lea rdx, [rsp + 0x28]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x140109098]
movsd qword [rax + 0x10], xmm1
mov ecx, dword [0x1401090a0]
mov dword [rax + 0x18], ecx
movzx ecx, word [0x1401090a4]
mov word [rax + 0x1c], cx
mov ecx, 1
call rbx
xor edx, edx
mov r8d, 0x1000
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], 1
call fcn.1400500e0
jmp 0x14004d080