joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff2f954ae8
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x7ff2f962100]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebx, 1
lea rdx, [rsp + 0x20]
xor r9d, r9d
lea r8d, [rbx + 0x13]
lea ecx, [rbx + 0x59]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x7ff2f954b27
xor ebx, ebx
cmp dword [rsp + 0x30], 3
cmovl ebx, dword [rsp + 0x30]
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.7ff2f958660
add rsp, 0x40
pop rbx
ret

Function at 0x7ff2f956f58
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
movzx eax, byte [rcx + 3]
xor edi, edi
mov r14, rdx
shl eax, 8
mov r13, r8
mov r8b, 0x7f
movsxd r9, eax
movzx eax, byte [rcx + 2]
mov rbx, rcx
or r9, rax
mov esi, edi
add r9, rcx
mov dl, byte [r9]
mov al, dl
and al, r8b
cmp al, r8b
je 0x7ff2f9570a6
cmp dl, 4
jne 0x7ff2f956fce
cmp byte [r9 + 1], dl
jne 0x7ff2f956fce
movzx ecx, byte [r9 + 3]
movzx eax, byte [r9 + 2]
shl ecx, 8
or ecx, eax
cmp ecx, 4
jb 0x7ff2f95702a
lea eax, [rcx - 4]
add esi, eax
movzx eax, byte [r9 + 3]
shl eax, 8
movsxd rcx, eax
movzx eax, byte [r9 + 2]
or rcx, rax
add r9, rcx
mov dl, byte [r9]
mov al, dl
and al, r8b
cmp al, r8b
jne 0x7ff2f956faa
cmp esi, edi
je 0x7ff2f9570a6
mov rax, qword gs:[0x30]
add esi, 2
xor edx, edx
mov rcx, qword [rax + 0x60]
mov r8d, esi
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbp, rax
cmp rax, rdi
jne 0x7ff2f957031
mov eax, 0xc000009a
jmp 0x7ff2f9570ab
mov eax, 0xc0000095
jmp 0x7ff2f9570ab
mov r12, rax
movzx eax, byte [rbx + 3]
shl eax, 8
movsxd rdi, eax
movzx eax, byte [rbx + 2]
or rdi, rax
add rdi, rbx
jmp 0x7ff2f95708c
cmp cl, 4
jne 0x7ff2f957078
cmp byte [rdi + 1], cl
jne 0x7ff2f957078
movzx ecx, byte [rdi + 3]
movzx eax, byte [rdi + 2]
lea rdx, [rdi + 4]
shl ecx, 8
or ecx, eax
sub ecx, 4
mov ebx, ecx
mov r8d, ecx
mov rcx, r12
call sub.msvcrt.dll_memcpy
add r12, rbx
movzx eax, byte [rdi + 3]
shl eax, 8
movsxd rcx, eax
movzx eax, byte [rdi + 2]
or rcx, rax
add rdi, rcx
mov cl, byte [rdi]
mov al, cl
and al, 0x7f
cmp al, 0x7f
jne 0x7ff2f95704a
xor eax, eax
mov qword [r14], rbp
mov dword [r13], esi
mov word [r12], ax
jmp 0x7ff2f9570ab
mov eax, 0xc0000225
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x7ff2f95b494
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov rsi, rcx
cmp rcx, rdi
jne 0x7ff2f95b4d2
call qword [sym.imp.msvcrt.dll__errno]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
mov dword [rax], 0x16
call fcn.7ff2f958760
jmp 0x7ff2f95b5d8
mov eax, dword [rcx + 0x18]
test al, 0x83
je 0x7ff2f95b5d8
test al, 0x40
jne 0x7ff2f95b5d8
test al, 2
je 0x7ff2f95b4f4
or eax, 0x20
mov dword [rcx + 0x18], eax
jmp 0x7ff2f95b5d8
or eax, 1
mov dword [rcx + 0x18], eax
test eax, 0x10c
je 0x7ff2f95b4ad
mov rbx, qword [rcx + 0x10]
mov qword [rcx], rbx
call qword [sym.imp.msvcrt.dll__fileno]
mov r8d, dword [rsi + 0x24]
mov ecx, eax
mov rdx, rbx
call qword [sym.imp.msvcrt.dll__read]
mov dword [rsi + 8], eax
cmp eax, edi
je 0x7ff2f95b5c8
cmp eax, 0xffffffff
je 0x7ff2f95b5c8
test byte [rsi + 0x18], 0x82
jne 0x7ff2f95b59a
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__fileno]
cmp eax, 0xffffffff
je 0x7ff2f95b584
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__fileno]
cmp eax, 0xfffffffe
je 0x7ff2f95b584
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__fileno]
mov rbx, qword [sym.imp.msvcrt.dll___pioinfo]
mov rcx, rsi
movsxd rdi, eax
sar rdi, 5
call qword [sym.imp.msvcrt.dll__fileno]
mov r11d, eax
and r11d, 0x1f
imul r11, r11, 0x38
add r11, qword [rbx + rdi*8]
jmp 0x7ff2f95b58b
mov r11, qword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [r11 + 8]
and al, 0x82
cmp al, 0x82
jne 0x7ff2f95b59a
bts dword [rsi + 0x18], 0xd
cmp dword [rsi + 0x24], 0x200
jne 0x7ff2f95b5b7
test byte [rsi + 0x18], 8
je 0x7ff2f95b5b7
bt dword [rsi + 0x18], 0xa
jb 0x7ff2f95b5b7
mov dword [rsi + 0x24], 0x1000
mov rcx, qword [rsi]
dec dword [rsi + 8]
movzx eax, byte [rcx]
inc rcx
mov qword [rsi], rcx
jmp 0x7ff2f95b5db
neg eax
mov dword [rsi + 8], edi
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [rsi + 0x18], eax
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x7ff2f95d314
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov rsi, rcx
cmp rcx, rdi
jne 0x7ff2f95d352
call qword [sym.imp.msvcrt.dll__errno]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
mov dword [rax], 0x16
call fcn.7ff2f958760
jmp 0x7ff2f95d463
mov eax, dword [rcx + 0x18]
test al, 0x83
je 0x7ff2f95d463
test al, 0x40
jne 0x7ff2f95d463
test al, 2
je 0x7ff2f95d374
or eax, 0x20
mov dword [rcx + 0x18], eax
jmp 0x7ff2f95d463
or eax, 1
mov dword [rcx + 0x18], eax
test eax, 0x10c
je 0x7ff2f95d32d
mov rbx, qword [rcx + 0x10]
mov qword [rcx], rbx
call qword [sym.imp.msvcrt.dll__fileno]
mov r8d, dword [rsi + 0x24]
mov ecx, eax
mov rdx, rbx
call qword [sym.imp.msvcrt.dll__read]
mov dword [rsi + 8], eax
cmp eax, edi
je 0x7ff2f95d453
cmp eax, 1
je 0x7ff2f95d453
cmp eax, 0xffffffff
je 0x7ff2f95d453
test byte [rsi + 0x18], 0x82
jne 0x7ff2f95d423
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__fileno]
cmp eax, 0xffffffff
je 0x7ff2f95d40d
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__fileno]
cmp eax, 0xfffffffe
je 0x7ff2f95d40d
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__fileno]
mov rbx, qword [sym.imp.msvcrt.dll___pioinfo]
mov rcx, rsi
movsxd rdi, eax
sar rdi, 5
call qword [sym.imp.msvcrt.dll__fileno]
mov r11d, eax
and r11d, 0x1f
imul r11, r11, 0x38
add r11, qword [rbx + rdi*8]
jmp 0x7ff2f95d414
mov r11, qword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [r11 + 8]
and al, 0x82
cmp al, 0x82
jne 0x7ff2f95d423
bts dword [rsi + 0x18], 0xd
cmp dword [rsi + 0x24], 0x200
jne 0x7ff2f95d440
test byte [rsi + 0x18], 8
je 0x7ff2f95d440
bt dword [rsi + 0x18], 0xa
jb 0x7ff2f95d440
mov dword [rsi + 0x24], 0x1000
mov rcx, qword [rsi]
add dword [rsi + 8], 0xfffffffe
movzx eax, word [rcx]
add rcx, 2
mov qword [rsi], rcx
jmp 0x7ff2f95d468
neg eax
mov dword [rsi + 8], edi
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [rsi + 0x18], eax
mov eax, 0xffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400028e0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov r8, rcx
mov dword [rsp + 0x28], 1
xor ecx, ecx
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
add rsp, 0x38
ret
Function at 0x140004720
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14007d040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, 8
call fcn.140061de0
lea rcx, [0x1400555c0]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140004a50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14000479d
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140061dc0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400047b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14007d040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rcx
mov ecx, 0x28
call fcn.140061de0
mov rbx, rax
mov qword [rsp + 0x30], rax
lea rdx, [0x1400cb620]
mov rcx, rax
call fcn.140004590
lea rax, [0x1400563a0]
mov qword [rbx + 0x20], rax
mov qword [rsp + 0x30], rbx
lea rsi, [rdi + 8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x140004a80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x14000484f
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140061dc0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov dword [rsi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140006d60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140006dbd
lea rbx, [0x140069330]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140006da4
cmp r10, 2
jb 0x140006da4
cmp byte [r9], r8b
jne 0x140006da4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140006d80
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140006dff
lea rbx, [0x140069330]
cmp r8b, 0x23
jne 0x140006de3
cmp byte [r9], r8b
jne 0x140006de3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140006dd0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x140006f00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x140006f1e
mov qword [r8], r14
lea rdx, [0x140068e60]
call fcn.140006e10
mov rbx, rax
test rax, rax
jne 0x140006f43
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x14000706d
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000706d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000706d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000706d
cmp rdi, 0xffffffffffffffff
je 0x14000706d
mov rcx, rdi
call fcn.14000a560
mov rbp, rax
test rax, rax
je 0x14000706d
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000705a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x1400cc520]
test r8, r8
je 0x14000704f
movsx rdx, word [r8 + 0x6090]
lea rcx, [r8 + 0x6094]
mov r9d, dword [r8 + 0x3f60]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x140007044
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6090], cx
movsx rax, cx
lea rcx, [r8 + 0x6094]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x608c]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140007076
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140007068
mov qword [rsi], rdi
mov rax, rbp
jmp 0x140007078
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000a060
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x100]
lea r11, [0x140069330]
mov rax, qword [rcx + 0x108]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x4054], ebx
jne 0x14000a0f6
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.14001de00
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14000d780
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x14007d040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1400cc520]
mov ebp, edx
mov r10, rcx
mov r9d, dword [rdi + 0x49e0]
mov rbx, qword [rdi + 0x4008]
bts r9d, 8
mov dword [rdi + 0x49e0], r9d
mov dword [rdi + 0x4a18], 1
cmp qword [rbx + 0x1b8], 0
jne 0x14000d7f7
cmp qword [rdi + 0x4de0], 0
mov eax, 0x260
je 0x14000d7fc
mov eax, 0x230
movss xmm2, dword [rbx + rax]
lea rcx, [rsp + 0x30]
movss xmm3, dword [rbx + rax + 4]
subss xmm3, dword [rbx + 0x114]
subss xmm2, dword [rbx + 0x110]
mov rdx, qword [r8]
call fcn.140016640
movsd xmm0, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
or r9d, 2
movsd qword [rdi + 0x4a00], xmm0
xor edx, edx
mov dword [rdi + 0x49e0], r9d
mov dword [rdi + 0x49e8], 1
mov r9, qword [rbx + 8]
test r10, r10
je 0x14000d86e
mov dword [rsp + 0x28], ebp
lea r8, str._s__s__08X
mov qword [rsp + 0x20], r10
call fcn.140006bc0
jmp 0x14000d87e
lea r8, str._s__08X
mov dword [rsp + 0x20], ebp
call fcn.140006bc0
mov rcx, qword [rsp + 0x30]
xor edx, edx
movss xmm6, dword [rdi + 0x3920]
mov r8d, 0x1000107
call fcn.140010950
mov rsi, qword [rdi + 0x4008]
movzx r14d, al
movss dword [rdi + 0x3920], xmm6
cmp word [rsi + 0xcc], 1
mov dword [rsi + 0x88], ebp
jne 0x14000d8c8
movsd xmm0, qword [rsi + 0x28]
movsd qword [rbx + 0x110], xmm0
mov r9d, ebp
lea rdx, [0x140068311]
not r9d
lea r10, [0x140069330]
mov ebx, r9d
mov r8b, 0x23
cmp r8b, 0x23
jne 0x14000d8f5
cmp byte [rdx], r8b
jne 0x14000d8f5
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14000d8e2
not ebx
cmp dword [rdi + 0x406c], ebx
jne 0x14000d925
xor edx, edx
xor ecx, ecx
call fcn.14000a100
cmp dword [rdi + 0x4b10], ebp
jne 0x14000d96a
cmp word [rsi + 0x16c], 0
jne 0x14000d940
cmp byte [rsi + 0x172], 0
je 0x14000d96a
xor edx, edx
mov rcx, rsi
call fcn.140012ed0
xor edx, edx
mov rcx, rsi
call fcn.1400190f0
mov rdx, rsi
mov ecx, ebx
call fcn.14000a100
mov eax, dword [rdi + 0x4b34]
mov dword [rdi + 0x4090], eax
movzx eax, r14b
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140061dc0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r14
ret
Function at 0x140017360
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14007d040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400cc520]
mov edi, ecx
cmp byte [rbx + 0x4d19], 0
jne 0x1400173c1
cmp byte [rbx + 0x4d1a], 0
jne 0x1400173c1
movsx r9d, word [rbx + 0x5e70]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140006b40
test dil, 2
je 0x1400174ef
jmp 0x14001744a
movss xmm1, dword [rbx + 0x39c4]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5e70]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140070390]
mulss xmm1, dword [0x140070384]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe48]
addss xmm1, dword [rbx + 0xe4c]
mov qword [rbx + 0x49f8], rax
mov dword [rbx + 0x49e4], 1
movss dword [rbx + 0x49f0], xmm0
movss dword [rbx + 0x49f4], xmm1
movss xmm0, dword [rbx + 0x3a20]
mulss xmm0, dword [0x140070248]
or dword [rbx + 0x49e0], 0x41
movss dword [rbx + 0x4a40], xmm0
call fcn.140006b40
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400174a0
lea r11, [0x140069330]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140017483
cmp byte [r8], r9b
jne 0x140017483
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140017470
not ecx
call fcn.14000dc80
test rax, rax
je 0x1400174ef
cmp byte [rax + 0xbe], 0
je 0x1400174ef
mov byte [rax + 0xc3], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xc5], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xe4], 1
mov edx, 0x10
inc word [rbx + 0x5e70]
movsx r9d, word [rbx + 0x5e70]
call fcn.140006b40
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.140010950
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140061dc0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14001c630
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5fc8], 0
lea rbx, [rcx + 0x5fd0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001c6d7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001c68a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001ed40
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400076e0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5fc8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5fd8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400cc511]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001c6df
mov rcx, rbx
call fcn.1400076e0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001ca00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x1400cc520]
xor ebp, ebp
cmp byte [rbx + 0x5f20], bpl
jne 0x14001cadf
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14001cad8
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.140006f00
mov rsi, rax
test rax, rax
je 0x14001cad8
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x14001ca64
mov rcx, rax
call fcn.14001cc30
mov r8, qword [0x1400cc520]
test r8, r8
je 0x14001cacf
movsx rdx, word [r8 + 0x6090]
lea rcx, [r8 + 0x6094]
mov r9d, dword [r8 + 0x3f60]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x14001cac4
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6090], cx
movsx rax, cx
lea rcx, [r8 + 0x6094]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x608c]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x5f20], 1
movss xmm0, dword [rbx + 0x5f24]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14001cb6e
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5f24], xmm0
jb 0x14001cb6e
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x14001cb61
mov rax, qword [0x1400cc520]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5f24], ebp
call fcn.14001ce90
lea rdx, [0x140068e64]
mov rcx, rdi
mov rsi, rax
call fcn.140006e10
mov rdi, rax
test rax, rax
je 0x14001cb68
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14001cb68
mov byte [rbx + 0xce], 1
mov dword [rbx + 0x5f24], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14001cb90
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1400cc520]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001cbf3
mov qword [rsp], rbx
lea rbx, [0x140069330]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001cbd3
cmp byte [r8], r9b
jne 0x14001cbd3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001cbc0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f38]
not eax
mov r8, qword [r10 + 0x5f40]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x14001cc1f
cmp dword [r8 + 8], eax
je 0x14001cc26
add r8, 0x48
cmp r8, rcx
jne 0x14001cc10
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x140031330
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x14007d040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x1400cc520]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14003154e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14003154e
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x1400cc520]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x140031404
movsx rdx, word [r8 + 0x6090]
lea rax, [r8 + 0x6094]
mov r9d, dword [r8 + 0x3f60]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x1400313f9
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6090], cx
movsx rax, cx
lea rax, [rax*8 + 0x6094]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x6088]
test rdi, rdi
je 0x140031421
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x140031424
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, [0x14006dfb8]
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x140031467
mov rsi, qword [r8 + 0x90]
jmp 0x14003146a
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140031495
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x1400cc520]
mov rcx, qword [rax + 0x4af8]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x14003150e
inc rbx
cmp rbx, 5
jl 0x1400314f0
jmp 0x14003153a
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x140031550
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140061dc0
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
jmp 0x140031330