joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140068450
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xc8
movups xmmword [rsp + 0x20], xmm6
movups xmmword [rsp + 0x30], xmm7
movups xmmword [rsp + 0x40], xmm8
movups xmmword [rsp + 0x50], xmm9
movups xmmword [rsp + 0x60], xmm10
movups xmmword [rsp + 0x70], xmm11
movups xmmword [rsp + 0x80], xmm12
movups xmmword [rsp + 0x90], xmm13
movups xmmword [rsp + 0xa0], xmm14
movups xmmword [rsp + 0xb0], xmm15
movups xmm13, xmmword [0x140230e40]
movups xmm12, xmmword [0x140230e20]
movups xmm10, xmmword [0x140230e00]
movups xmm9, xmmword [0x140230c70]
movdqu xmm8, xmmword [0x140230e50]
movups xmm14, xmm13
xorps xmm14, xmm12
mov rax, rdx
mov rdx, qword [rdx + 0x30]
movss xmm1, dword [rax + 0x4c]
movss xmm4, dword [rax + 8]
movss xmm15, dword [rax + 0x28]
xor eax, eax
shufps xmm1, xmm1, 0
shufps xmm4, xmm4, 0
movups xmmword [rsp], xmm1
movups xmmword [rsp + 0x10], xmm4
shufps xmm15, xmm15, 0
nop dword [rax]
movups xmm4, xmmword [rdx + rax*4]
movups xmm6, xmmword [0x140230dd0]
pxor xmm11, xmm11
movups xmm2, xmmword [0x140230de0]
movups xmm5, xmmword [0x140230df0]
mulps xmm4, xmm15
minps xmm6, xmm4
movups xmm1, xmm4
cmpltps xmm1, xmmword [0x140230dc0]
mulps xmm2, xmm6
addps xmm2, xmmword [0x140230db0]
andps xmm5, xmm2
movups xmm7, xmm2
movups xmm3, xmm5
cmpltps xmm7, xmm11
addps xmm3, xmm10
cmpltps xmm5, xmm10
addps xmm3, xmmword [0x140230e10]
movups xmm11, xmm7
movups xmm0, xmm3
andnps xmm11, xmm3
movups xmm3, xmm5
xorps xmm0, xmm12
andnps xmm3, xmm2
andps xmm0, xmm7
orps xmm0, xmm11
andps xmm0, xmm5
orps xmm0, xmm3
cmpltps xmm2, xmm0
andps xmm2, xmm9
subps xmm0, xmm2
movups xmm2, xmmword [0x140230e30]
mulps xmm2, xmm0
maxps xmm0, xmm14
minps xmm0, xmm13
addps xmm6, xmm2
cvttps2dq xmm0, xmm0
movdqu xmm5, xmm0
paddd xmm0, xmm8
psrad xmm5, 2
movups xmm3, xmm6
movdqu xmm7, xmm5
movdqu xmm2, xmm5
mulps xmm3, xmm6
paddd xmm7, xmm5
paddd xmm2, xmm8
psubd xmm0, xmm7
movups xmm7, xmmword [0x140230e80]
pslld xmm2, 0x17
psubd xmm0, xmm5
movups xmm5, xmmword [0x140230e60]
pslld xmm0, 0x17
mulps xmm5, xmm3
mulps xmm7, xmm3
addps xmm5, xmmword [0x140230e70]
addps xmm7, xmmword [0x140230e90]
mulps xmm5, xmm3
mulps xmm7, xmm6
addps xmm6, xmm9
addps xmm5, xmm7
addps xmm5, xmmword [0x140230ea0]
mulps xmm3, xmm5
addps xmm6, xmm3
movups xmm3, xmm2
mulps xmm3, xmm2
mulps xmm2, xmm0
mulps xmm2, xmm3
mulps xmm6, xmm2
maxps xmm4, xmm6
andnps xmm1, xmm4
addps xmm1, xmmword [rsp]
rcpps xmm0, xmm1
mulps xmm1, xmm0
mulps xmm1, xmm0
addps xmm0, xmm0
subps xmm0, xmm1
mulps xmm0, xmmword [rsp + 0x10]
movups xmmword [rcx + rax*4], xmm0
add rax, 4
cmp rax, 0x20
jne 0x140068500
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
movups xmm8, xmmword [rsp + 0x40]
movups xmm9, xmmword [rsp + 0x50]
movups xmm10, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x70]
movups xmm12, xmmword [rsp + 0x80]
movups xmm13, xmmword [rsp + 0x90]
movups xmm14, xmmword [rsp + 0xa0]
movups xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
ret
Function at 0x140068b80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xc8
movups xmmword [rsp + 0x20], xmm6
movups xmmword [rsp + 0x30], xmm7
movups xmmword [rsp + 0x40], xmm8
movups xmmword [rsp + 0x50], xmm9
movups xmmword [rsp + 0x60], xmm10
movups xmmword [rsp + 0x70], xmm11
movups xmmword [rsp + 0x80], xmm12
movups xmmword [rsp + 0x90], xmm13
movups xmmword [rsp + 0xa0], xmm14
movups xmmword [rsp + 0xb0], xmm15
movups xmm13, xmmword [0x140230e40]
movups xmm12, xmmword [0x140230e20]
movups xmm10, xmmword [0x140230e00]
movups xmm9, xmmword [0x140230c70]
movdqu xmm8, xmmword [0x140230e50]
movups xmm14, xmm13
xorps xmm14, xmm12
mov rax, rdx
mov rdx, qword [rdx + 0x30]
movss xmm1, dword [rax + 0x4c]
movss xmm4, dword [rax + 8]
movss xmm15, dword [rax + 0x28]
xor eax, eax
shufps xmm1, xmm1, 0
shufps xmm4, xmm4, 0
movups xmmword [rsp], xmm1
movups xmmword [rsp + 0x10], xmm4
shufps xmm15, xmm15, 0
nop dword [rax]
movups xmm4, xmmword [rdx + rax*4]
movups xmm6, xmmword [0x140230dd0]
pxor xmm11, xmm11
movups xmm2, xmmword [0x140230de0]
movups xmm5, xmmword [0x140230df0]
mulps xmm4, xmm15
minps xmm6, xmm4
movups xmm1, xmm4
cmpltps xmm1, xmmword [0x140230dc0]
mulps xmm2, xmm6
addps xmm2, xmmword [0x140230db0]
andps xmm5, xmm2
movups xmm7, xmm2
movups xmm3, xmm5
cmpltps xmm7, xmm11
addps xmm3, xmm10
cmpltps xmm5, xmm10
addps xmm3, xmmword [0x140230e10]
movups xmm11, xmm7
movups xmm0, xmm3
andnps xmm11, xmm3
movups xmm3, xmm5
xorps xmm0, xmm12
andnps xmm3, xmm2
andps xmm0, xmm7
orps xmm0, xmm11
andps xmm0, xmm5
orps xmm0, xmm3
cmpltps xmm2, xmm0
andps xmm2, xmm9
subps xmm0, xmm2
movups xmm2, xmmword [0x140230e30]
mulps xmm2, xmm0
maxps xmm0, xmm14
minps xmm0, xmm13
addps xmm6, xmm2
cvttps2dq xmm0, xmm0
movdqu xmm5, xmm0
paddd xmm0, xmm8
psrad xmm5, 2
movups xmm3, xmm6
movdqu xmm7, xmm5
movdqu xmm2, xmm5
mulps xmm3, xmm6
paddd xmm7, xmm5
paddd xmm2, xmm8
psubd xmm0, xmm7
movups xmm7, xmmword [0x140230e80]
pslld xmm2, 0x17
psubd xmm0, xmm5
movups xmm5, xmmword [0x140230e60]
pslld xmm0, 0x17
mulps xmm5, xmm3
mulps xmm7, xmm3
addps xmm5, xmmword [0x140230e70]
addps xmm7, xmmword [0x140230e90]
mulps xmm5, xmm3
mulps xmm7, xmm6
addps xmm6, xmm9
addps xmm5, xmm7
addps xmm5, xmmword [0x140230ea0]
mulps xmm3, xmm5
addps xmm6, xmm3
movups xmm3, xmm2
mulps xmm3, xmm2
mulps xmm2, xmm0
mulps xmm2, xmm3
mulps xmm6, xmm2
maxps xmm4, xmm6
andnps xmm1, xmm4
addps xmm1, xmmword [rsp]
rcpps xmm0, xmm1
mulps xmm1, xmm0
mulps xmm1, xmm0
addps xmm0, xmm0
subps xmm0, xmm1
mulps xmm0, xmmword [rsp + 0x10]
movups xmmword [rcx + rax*4], xmm0
add rax, 4
cmp rax, 0x28
jne 0x140068c30
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
movups xmm8, xmmword [rsp + 0x40]
movups xmm9, xmmword [rsp + 0x50]
movups xmm10, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x70]
movups xmm12, xmmword [rsp + 0x80]
movups xmm13, xmmword [rsp + 0x90]
movups xmm14, xmmword [rsp + 0xa0]
movups xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
ret
Function at 0x140069270
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xc8
movups xmmword [rsp + 0x20], xmm6
movups xmmword [rsp + 0x30], xmm7
movups xmmword [rsp + 0x40], xmm8
movups xmmword [rsp + 0x50], xmm9
movups xmmword [rsp + 0x60], xmm10
movups xmmword [rsp + 0x70], xmm11
movups xmmword [rsp + 0x80], xmm12
movups xmmword [rsp + 0x90], xmm13
movups xmmword [rsp + 0xa0], xmm14
movups xmmword [rsp + 0xb0], xmm15
movups xmm13, xmmword [0x140230e40]
movups xmm12, xmmword [0x140230e20]
movups xmm10, xmmword [0x140230e00]
movups xmm9, xmmword [0x140230c70]
movdqu xmm8, xmmword [0x140230e50]
movups xmm14, xmm13
xorps xmm14, xmm12
mov rax, rdx
mov rdx, qword [rdx + 0x30]
movss xmm1, dword [rax + 0x4c]
movss xmm4, dword [rax + 8]
movss xmm15, dword [rax + 0x28]
xor eax, eax
shufps xmm1, xmm1, 0
shufps xmm4, xmm4, 0
movups xmmword [rsp], xmm1
movups xmmword [rsp + 0x10], xmm4
shufps xmm15, xmm15, 0
nop dword [rax]
movups xmm4, xmmword [rdx + rax*4]
movups xmm6, xmmword [0x140230dd0]
pxor xmm11, xmm11
movups xmm2, xmmword [0x140230de0]
movups xmm5, xmmword [0x140230df0]
mulps xmm4, xmm15
minps xmm6, xmm4
movups xmm1, xmm4
cmpltps xmm1, xmmword [0x140230dc0]
mulps xmm2, xmm6
addps xmm2, xmmword [0x140230db0]
andps xmm5, xmm2
movups xmm7, xmm2
movups xmm3, xmm5
cmpltps xmm7, xmm11
addps xmm3, xmm10
cmpltps xmm5, xmm10
addps xmm3, xmmword [0x140230e10]
movups xmm11, xmm7
movups xmm0, xmm3
andnps xmm11, xmm3
movups xmm3, xmm5
xorps xmm0, xmm12
andnps xmm3, xmm2
andps xmm0, xmm7
orps xmm0, xmm11
andps xmm0, xmm5
orps xmm0, xmm3
cmpltps xmm2, xmm0
andps xmm2, xmm9
subps xmm0, xmm2
movups xmm2, xmmword [0x140230e30]
mulps xmm2, xmm0
maxps xmm0, xmm14
minps xmm0, xmm13
addps xmm6, xmm2
cvttps2dq xmm0, xmm0
movdqu xmm5, xmm0
paddd xmm0, xmm8
psrad xmm5, 2
movups xmm3, xmm6
movdqu xmm7, xmm5
movdqu xmm2, xmm5
mulps xmm3, xmm6
paddd xmm7, xmm5
paddd xmm2, xmm8
psubd xmm0, xmm7
movups xmm7, xmmword [0x140230e80]
pslld xmm2, 0x17
psubd xmm0, xmm5
movups xmm5, xmmword [0x140230e60]
pslld xmm0, 0x17
mulps xmm5, xmm3
mulps xmm7, xmm3
addps xmm5, xmmword [0x140230e70]
addps xmm7, xmmword [0x140230e90]
mulps xmm5, xmm3
mulps xmm7, xmm6
addps xmm6, xmm9
addps xmm5, xmm7
addps xmm5, xmmword [0x140230ea0]
mulps xmm3, xmm5
addps xmm6, xmm3
movups xmm3, xmm2
mulps xmm3, xmm2
mulps xmm2, xmm0
mulps xmm2, xmm3
mulps xmm6, xmm2
maxps xmm4, xmm6
andnps xmm1, xmm4
addps xmm1, xmmword [rsp]
rcpps xmm0, xmm1
mulps xmm1, xmm0
mulps xmm1, xmm0
addps xmm0, xmm0
subps xmm0, xmm1
mulps xmm0, xmmword [rsp + 0x10]
movups xmmword [rcx + rax*4], xmm0
add rax, 4
cmp rax, 0x40
jne 0x140069320
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
movups xmm8, xmmword [rsp + 0x40]
movups xmm9, xmmword [rsp + 0x50]
movups xmm10, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x70]
movups xmm12, xmmword [rsp + 0x80]
movups xmm13, xmmword [rsp + 0x90]
movups xmm14, xmmword [rsp + 0xa0]
movups xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
ret
Function at 0x1400694c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xc8
movups xmmword [rsp + 0x20], xmm6
movups xmmword [rsp + 0x30], xmm7
movups xmmword [rsp + 0x40], xmm8
movups xmmword [rsp + 0x50], xmm9
movups xmmword [rsp + 0x60], xmm10
movups xmmword [rsp + 0x70], xmm11
movups xmmword [rsp + 0x80], xmm12
movups xmmword [rsp + 0x90], xmm13
movups xmmword [rsp + 0xa0], xmm14
movups xmmword [rsp + 0xb0], xmm15
movups xmm13, xmmword [0x140230e40]
movups xmm12, xmmword [0x140230e20]
movups xmm10, xmmword [0x140230e00]
movups xmm9, xmmword [0x140230c70]
movdqu xmm8, xmmword [0x140230e50]
movups xmm14, xmm13
xorps xmm14, xmm12
mov rax, rdx
mov rdx, qword [rdx + 0x30]
movss xmm1, dword [rax + 0x4c]
movss xmm4, dword [rax + 8]
movss xmm15, dword [rax + 0x28]
xor eax, eax
shufps xmm1, xmm1, 0
shufps xmm4, xmm4, 0
movups xmmword [rsp], xmm1
movups xmmword [rsp + 0x10], xmm4
shufps xmm15, xmm15, 0
nop dword [rax]
movups xmm4, xmmword [rdx + rax*4]
movups xmm6, xmmword [0x140230dd0]
pxor xmm11, xmm11
movups xmm2, xmmword [0x140230de0]
movups xmm5, xmmword [0x140230df0]
mulps xmm4, xmm15
minps xmm6, xmm4
movups xmm1, xmm4
cmpltps xmm1, xmmword [0x140230dc0]
mulps xmm2, xmm6
addps xmm2, xmmword [0x140230db0]
andps xmm5, xmm2
movups xmm7, xmm2
movups xmm3, xmm5
cmpltps xmm7, xmm11
addps xmm3, xmm10
cmpltps xmm5, xmm10
addps xmm3, xmmword [0x140230e10]
movups xmm11, xmm7
movups xmm0, xmm3
andnps xmm11, xmm3
movups xmm3, xmm5
xorps xmm0, xmm12
andnps xmm3, xmm2
andps xmm0, xmm7
orps xmm0, xmm11
andps xmm0, xmm5
orps xmm0, xmm3
cmpltps xmm2, xmm0
andps xmm2, xmm9
subps xmm0, xmm2
movups xmm2, xmmword [0x140230e30]
mulps xmm2, xmm0
maxps xmm0, xmm14
minps xmm0, xmm13
addps xmm6, xmm2
cvttps2dq xmm0, xmm0
movdqu xmm5, xmm0
paddd xmm0, xmm8
psrad xmm5, 2
movups xmm3, xmm6
movdqu xmm7, xmm5
movdqu xmm2, xmm5
mulps xmm3, xmm6
paddd xmm7, xmm5
paddd xmm2, xmm8
psubd xmm0, xmm7
movups xmm7, xmmword [0x140230e80]
pslld xmm2, 0x17
psubd xmm0, xmm5
movups xmm5, xmmword [0x140230e60]
pslld xmm0, 0x17
mulps xmm5, xmm3
mulps xmm7, xmm3
addps xmm5, xmmword [0x140230e70]
addps xmm7, xmmword [0x140230e90]
mulps xmm5, xmm3
mulps xmm7, xmm6
addps xmm6, xmm9
addps xmm5, xmm7
addps xmm5, xmmword [0x140230ea0]
mulps xmm3, xmm5
addps xmm6, xmm3
movups xmm3, xmm2
mulps xmm3, xmm2
mulps xmm2, xmm0
mulps xmm2, xmm3
mulps xmm6, xmm2
maxps xmm4, xmm6
andnps xmm1, xmm4
addps xmm1, xmmword [rsp]
rcpps xmm0, xmm1
mulps xmm1, xmm0
mulps xmm1, xmm0
addps xmm0, xmm0
subps xmm0, xmm1
mulps xmm0, xmmword [rsp + 0x10]
movups xmmword [rcx + rax*4], xmm0
add rax, 4
cmp rax, 0x50
jne 0x140069570
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
movups xmm8, xmmword [rsp + 0x40]
movups xmm9, xmmword [rsp + 0x50]
movups xmm10, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x70]
movups xmm12, xmmword [rsp + 0x80]
movups xmm13, xmmword [rsp + 0x90]
movups xmm14, xmmword [rsp + 0xa0]
movups xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
ret
Function at 0x140077830
Capabilities:
Hide graphical window

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x49], 0
mov byte [rcx + 0x48], 1
mov rbx, rcx
je 0x14007793e
cmp byte [rcx + 0x98], 0
jne 0x140077968
mov r12, qword [rbx + 0x80]
test r12, r12
je 0x140077926
mov rcx, qword [r12 + 0xa8]
mov byte [r12 + 0xa0], 1
test rcx, rcx
je 0x1400779fb
cmp byte [r12 + 0xf9], 0
mov r8, qword [r12 + 0x10]
jne 0x1400779b8
lea rax, [r8 - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x1400779ce
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0xa8], 0
mov rcx, qword [r12 + 0xe0]
test rcx, rcx
je 0x1400778d4
mov rdx, qword [r12 + 0xf0]
sub rdx, rcx
call fcn.1401eb750
mov rcx, qword [r12 + 0xc8]
test rcx, rcx
je 0x1400778f1
mov rdx, qword [r12 + 0xd8]
sub rdx, rcx
call fcn.1401eb750
mov rcx, qword [r12 + 0xb0]
test rcx, rcx
je 0x14007790e
mov rdx, qword [r12 + 0xc0]
sub rdx, rcx
call fcn.1401eb750
mov edx, 0x100
mov rcx, r12
call fcn.1401eb750
mov qword [rbx + 0x80], 0
mov rax, qword [rbx + 0x20]
xor edx, edx
mov rax, qword [rax + 0x10]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.USER32.dll_ShowWindow]
mov byte [rbx + 0x49], 0
mov rdx, qword [rbx + 0x10]
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x140077a38
sub eax, 1
mov dword [rdx + 0xc], eax
jne 0x140077959
mov byte [rdx + 9], 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov rax, qword [rcx + 0x88]
mov byte [rcx + 0x98], 0
test rax, rax
je 0x140077859
cmp rcx, qword [rax + 0x90]
jne 0x140077859
mov qword [rax + 0x90], 0
mov rax, qword [rcx + 0x88]
cmp byte [rax + 0x48], 0
jne 0x140077859
call fcn.140077bc0
jmp 0x140077859
mov rcx, r8
call qword [sym.imp.USER32.dll_GetParent]
mov r8, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400779ea
xor edx, edx
mov rcx, r8
call qword [sym.imp.USER32.dll_GetWindow]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x140077a78
mov rcx, qword [r12 + 0xa8]
test rcx, rcx
jne 0x1400778a5
mov r8, qword [r12]
test r8, r8
je 0x1400778b7
lea rdi, [0x14022ead0]
cmp r8, rdi
je 0x140077a27
mov ecx, 0x12
mov rsi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x140077a68
mov qword [r12], 0
jmp 0x1400778b7
mov r9d, 0x66
lea r8, str._home_runner_work_AIDA_X_AIDA_X_modules_dpf_dgl_src_ApplicationPrivateData.cpp
lea rdx, str.visibleWindows___0
lea rcx, [0x14022fa50]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.14003c590
mov rcx, r8
call sub.msvcrt.dll_free
jmp 0x140077a27
mov rsi, qword [sym.imp.USER32.dll_SendMessageA]
xor r9d, r9d
mov rcx, r13
mov r8d, 0xf060
mov edx, 0x112
call rsi
mov rcx, r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
call rsi
mov rcx, qword [r12 + 0xa8]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1400779ea
Function at 0x140079350
Capabilities:
Log keystrokes via polling

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x10
call rsi
mov ecx, 0x11
movsx r12d, ax
call rsi
mov ebx, r12d
mov ecx, 0x12
shr ebx, 0x1f
mov r12d, ebx
or r12d, 2
test ax, ax
cmovns r12d, ebx
call rsi
mov ecx, 0x5b
mov r8d, eax
mov eax, r12d
or eax, 4
test r8w, r8w
cmovs r12d, eax
call rsi
mov ecx, 0x5c
mov r8d, eax
mov eax, r12d
or eax, 8
test r8w, r8w
cmovs r12d, eax
call rsi
mov r8d, eax
mov eax, r12d
or eax, 8
test r8w, r8w
cmovs r12d, eax
mov eax, r12d
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
Function at 0x14007a800
Capabilities:
Log keystrokes via polling

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0xd8
movups xmmword [rsp + 0x80], xmm6
movups xmmword [rsp + 0x90], xmm7
movups xmmword [rsp + 0xa0], xmm8
movups xmmword [rsp + 0xb0], xmm9
movups xmmword [rsp + 0xc0], xmm10
pxor xmm10, xmm10
pxor xmm9, xmm9
pxor xmm8, xmm8
pxor xmm7, xmm7
pxor xmm6, xmm6
mov rax, qword [rcx + 0x10]
mov rbx, r8
mov qword [rsp + 0x28], r8
mov r12, rcx
mov esi, edx
mov rcx, qword [rax + 0x30]
cvtsi2sd xmm9, ebx
lea rdx, [rsp + 0x28]
sar rbx, 0x20
call qword [sym.imp.USER32.dll_ClientToScreen]
cvtsi2sd xmm6, ebx
call qword [sym.imp.USER32.dll_GetMessageTime]
cvtsi2sd xmm7, dword [rsp + 0x2c]
mov ecx, 0x10
mov rdi, qword [sym.imp.USER32.dll_GetKeyState]
cvtsi2sd xmm8, dword [rsp + 0x28]
cvtsi2sd xmm10, eax
mulsd xmm10, qword [0x140230c50]
call rdi
mov ecx, 0x11
movsx ebx, ax
call rdi
shr ebx, 0x1f
mov ecx, 0x12
mov r8d, eax
mov eax, ebx
or eax, 2
test r8w, r8w
cmovs ebx, eax
call rdi
mov ecx, 0x5b
mov r8d, eax
mov eax, ebx
or eax, 4
test r8w, r8w
cmovs ebx, eax
call rdi
mov ecx, 0x5c
mov r8d, eax
mov eax, ebx
or eax, 8
test r8w, r8w
cmovs ebx, eax
call rdi
movupd xmm0, xmm10
lea rdx, [rsp + 0x30]
mov rcx, r12
mov r8d, eax
mov eax, ebx
unpcklpd xmm0, xmm9
mov qword [rsp + 0x30], 0
or eax, 8
test r8w, r8w
movups xmmword [rsp + 0x38], xmm0
movupd xmm0, xmm6
cmovs ebx, eax
unpcklpd xmm0, xmm8
movsd qword [rsp + 0x58], xmm7
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x60], ebx
movups xmmword [rsp + 0x48], xmm0
call fcn.140071ee0
nop
movups xmm6, xmmword [rsp + 0x80]
movups xmm7, xmmword [rsp + 0x90]
movups xmm8, xmmword [rsp + 0xa0]
movups xmm9, xmmword [rsp + 0xb0]
movups xmm10, xmmword [rsp + 0xc0]
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop r12
ret
Function at 0x14007a9a0
Capabilities:
Log keystrokes via polling

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [rsp + 0x90]
movsx r13d, bx
shr rbx, 0x10
movsx ebx, bx
mov rdi, rdx
mov r12d, r9d
mov rsi, rcx
mov dword [rsp + 0x28], r13d
mov rax, qword [rdi + 0x10]
mov dword [rsp + 0x2c], ebx
mov ebp, r8d
lea rdx, [rsp + 0x28]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.USER32.dll_ClientToScreen]
test r12b, r12b
je 0x14007aae0
mov rax, qword [rdi + 0x10]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.USER32.dll_SetCapture]
call qword [sym.imp.USER32.dll_GetMessageTime]
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
mulsd xmm0, qword [0x140230c50]
mov eax, 0xe
movsd qword [rsi + 8], xmm0
pxor xmm0, xmm0
mov r12, qword [sym.imp.USER32.dll_GetKeyState]
mov dword [rsi], eax
mov ecx, 0x10
cvtsi2sd xmm0, r13d
movsd qword [rsi + 0x10], xmm0
pxor xmm0, xmm0
cvtsi2sd xmm0, ebx
movsd qword [rsi + 0x18], xmm0
pxor xmm0, xmm0
cvtsi2sd xmm0, dword [rsp + 0x28]
movsd qword [rsi + 0x20], xmm0
pxor xmm0, xmm0
cvtsi2sd xmm0, dword [rsp + 0x2c]
movsd qword [rsi + 0x28], xmm0
call r12
mov ecx, 0x11
movsx ebx, ax
call r12
mov edi, ebx
mov ecx, 0x12
shr edi, 0x1f
mov ebx, edi
or ebx, 2
test ax, ax
cmovns ebx, edi
call r12
mov ecx, 0x5b
mov r8d, eax
mov eax, ebx
or eax, 4
test r8w, r8w
cmovs ebx, eax
call r12
mov ecx, 0x5c
mov r8d, eax
mov eax, ebx
or eax, 8
test r8w, r8w
cmovs ebx, eax
call r12
mov dword [rsi + 0x34], ebp
mov r8d, eax
mov eax, ebx
or eax, 8
test r8w, r8w
cmovs ebx, eax
mov dword [rsi + 0x30], ebx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.USER32.dll_ReleaseCapture]
call qword [sym.imp.USER32.dll_GetMessageTime]
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
mulsd xmm0, qword [0x140230c50]
mov eax, 0xf
movsd qword [rsi + 8], xmm0
jmp 0x14007aa1e
Function at 0x140113ba0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x140113bc7
call rbp
cmp dword [rax], 4
jne 0x140113be4
mov rcx, rdi
call fcn.1401139c0
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sub.msvcrt.dll__read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x140113bc0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1400076d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x60
mov ecx, dword [0x140be03f0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [str.0Ne_]
mov rbx, rax
call qword [rcx + pe_nt_image_headers64]
mov ecx, dword [0x140be03f0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test rbx, rbx
je 0x1400077f6
cmp byte [rbx + 0xac], 0
je 0x1400077f6
mov rcx, rbx
mov qword [rsp + 0x70], rdi
call fcn.140007480
mov rdx, qword [0x140be0368]
test rdx, rdx
je 0x14000777c
mov rax, qword [str.0Ne_]
lea r9, str.D:winx64_packages_build_srcmysysmy_thr_init.c
xor r8d, r8d
mov dword [rsp + 0x20], 0x17c
lea rcx, [rsp + 0x30]
call qword [rax + 0x178]
lea rcx, [0x140be0340]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test rdi, rdi
je 0x140007789
mov rax, qword [str.0Ne_]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x180]
jmp 0x140007789
lea rcx, [0x140be0340]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [0x140b68bc0], 0xffffffff
mov rdi, qword [rsp + 0x70]
jne 0x1400077bc
mov rcx, qword [0x140be02f0]
test rcx, rcx
je 0x1400077b0
mov rax, qword [str.0Ne_]
call qword [rax + 0x158]
lea rcx, [0x140be02a0]
call fcn.14000d170
mov rcx, qword [0x140be0368]
test rcx, rcx
je 0x1400077d5
mov rax, qword [str.0Ne_]
call qword [rax + 0x148]
lea rcx, [0x140be0340]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rbx
mov byte [rbx + 0xac], 2
add rsp, 0x60
pop rbx
jmp fcn.140035ce0
add rsp, 0x60
pop rbx
ret

Function at 0x140007a10
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
cmp byte [0x140b68bc5], 0
je 0x140007a24
xor al, al
add rsp, 0x28
ret
cmp byte [0x140b68bc4], 0
mov qword [rsp + 0x20], rbx
mov byte [0x140b68bc5], 1
jne 0x140007a77
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ebx, ebx
mov dword [0x140be03f0], eax
cmp eax, 0xffffffff
sete bl
jne 0x140007a77
mov ecx, 2
call fcn.140033de0
mov rcx, rax
lea rdx, str.Cant_initialize_threads:_error__d_n
mov r8d, ebx
call fcn.140001020
mov rbx, qword [rsp + 0x20]
mov al, 1
add rsp, 0x28
ret
mov byte [0x140b68bc4], 1
call fcn.140007d60
call fcn.140007ab0
test al, al
jne 0x140007a6b
call fcn.140007430
mov dword [0x140b71898], eax
call fcn.140007c20
mov rbx, qword [rsp + 0x20]
xor al, al
add rsp, 0x28
ret
Function at 0x140007ab0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x60
xor bl, bl
cmp byte [0x140b68bc5], bl
jne 0x140007ac8
mov al, 1
add rsp, 0x60
pop rbx
ret
mov ecx, dword [0x140be03f0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140007c0f
call fcn.140007440
mov edx, 0xe0
mov ecx, 1
call fcn.14003678c
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x140007b06
mov bl, 1
movzx eax, bl
add rsp, 0x60
pop rbx
ret
mov ecx, dword [0x140be03f0]
mov rdx, rax
mov qword [rsp + 0x78], rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 0xa0], eax
mov rcx, qword [rsp + 0x70]
call fcn.140007df0
mov eax, dword [0x1401b4a60]
lea rcx, [rsp + 0x70]
neg eax
cdqe
add rcx, rax
mov rax, qword [rsp + 0x70]
mov qword [rax + 0xd0], rcx
mov rdx, qword [0x140be0368]
test rdx, rdx
je 0x140007bac
mov rax, qword [str.0Ne_]
lea r9, str.D:winx64_packages_build_srcmysysmy_thr_init.c
xor r8d, r8d
mov dword [rsp + 0x20], 0x133
lea rcx, [rsp + 0x30]
call qword [rax + 0x178]
lea rcx, [0x140be0340]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test rdi, rdi
je 0x140007bb9
mov rax, qword [str.0Ne_]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x180]
jmp 0x140007bb9
lea rcx, [0x140be0340]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x140b68bc8]
mov rax, qword [rsp + 0x70]
inc edx
mov rdi, qword [rsp + 0x78]
mov dword [0x140b68bc8], edx
mov dword [rax + 0xa4], edx
inc dword [0x140b68bc0]
mov rcx, qword [0x140be0368]
test rcx, rcx
je 0x140007bf6
mov rdx, qword [str.0Ne_]
call qword [rdx + 0x148]
lea rcx, [0x140be0340]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x70]
mov byte [rcx + 0xac], 1
movzx eax, bl
add rsp, 0x60
pop rbx
ret