joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000af70
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14, rcx
mov ebp, 0xffffffff
mov al, 0x57
lea rcx, [0x1400b4508]
lea rdi, [0x1400aa520]
mov ebx, 0xffffffff
jmp 0x14000afb8
movzx eax, al
movzx esi, bl
shr ebx, 8
xor esi, eax
xor ebx, dword [rdi + rsi*4]
add rcx, 1
mov eax, edx
test dl, dl
je 0x14000afcf
movzx edx, byte [rcx - 1]
cmp al, 0x23
jne 0x14000afa0
cmp dl, 0x23
jne 0x14000afa0
cmp byte [rcx], 0x23
cmove ebx, ebp
mov dl, 0x23
jmp 0x14000afa0
mov eax, dword [r14 + 0x3020]
cmp eax, dword [r14 + 0x3024]
jne 0x14000b09b
lea ebp, [rax + 1]
test eax, eax
je 0x14000aff7
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x14000affc
mov ecx, 8
cmp ecx, ebp
cmovg ebp, ecx
cmp eax, ebp
jge 0x14000b09b
movsxd rax, ebp
shl rax, 4
lea rcx, [rax + rax*2]
mov rax, qword [0x1400d2160]
test rax, rax
je 0x14000b027
add dword [rax + 0x3b0], 1
mov rdx, qword [0x1400d2170]
call qword [0x1400d0178]
mov rdi, rax
mov rdx, qword [r14 + 0x3028]
test rdx, rdx
je 0x14000b086
movsxd rax, dword [r14 + 0x3020]
shl rax, 4
lea r8, [rax + rax*2]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [r14 + 0x3028]
test rcx, rcx
je 0x14000b079
mov rax, qword [0x1400d2160]
test rax, rax
je 0x14000b079
add dword [rax + 0x3b0], 0xffffffff
mov rdx, qword [0x1400d2170]
call qword [0x1400d0180]
mov qword [r14 + 0x3028], rdi
mov dword [r14 + 0x3024], ebp
mov eax, dword [r14 + 0x3020]
not ebx
mov rcx, qword [r14 + 0x3028]
cdqe
lea rax, [rax + rax*2]
shl rax, 4
lea rdx, str.Window
mov qword [rcx + rax], rdx
mov dword [rcx + rax + 8], ebx
mov dword [rcx + rax + 0xc], 0
lea rdx, [0x140015860]
mov qword [rcx + rax + 0x10], rdx
lea rdx, [0x140015900]
mov qword [rcx + rax + 0x18], rdx
lea rdx, [0x1400159f0]
mov qword [rcx + rax + 0x20], rdx
mov qword [rcx + rax + 0x28], 0
add dword [r14 + 0x3020], 1
mov byte [r14], 1
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140018080
Capabilities:
Hash data with crc32
Resolve function by parsing pe exports

Disassembly:
mov r9, r8
mov r8d, dword [rsp + 0x28]
movss xmm1, dword [r9]
xorps xmm0, xmm0
ucomiss xmm1, xmm0
jne 0x1400180a4
jp 0x1400180a4
movss xmm1, dword [r9 + 4]
ucomiss xmm1, xmm0
jne 0x1400180a4
jnp 0x1400180c8
mov r10, qword [0x1400d2160]
or dword [r10 + 0x1a98], 2
mov rax, qword [r9]
mov qword [r10 + 0x1ab8], rax
mov dword [r10 + 0x1aa0], 4
xorps xmm0, xmm0
ucomiss xmm3, xmm0
jb 0x1400180e6
mov rax, qword [0x1400d2160]
or dword [rax + 0x1a98], 0x40
movss dword [rax + 0x1af0], xmm3
jmp fcn.1400102c0

Function at 0x140018ac0
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r8, qword [0x1400d2160]
mov r15, qword [r8 + 0x1a18]
mov r14, qword [r15 + 0x1f8]
movsxd r9, dword [r15 + 0x1f0]
mov edi, dword [r14 + r9*4 - 4]
not edi
mov al, byte [rcx]
test al, al
je 0x140018b44
add rcx, 2
lea rsi, [0x1400aa520]
mov ebp, edi
jmp 0x140018b2d
movzx eax, al
mov ebx, ebp
shr ebx, 8
movzx ebp, bpl
xor ebp, eax
xor ebx, dword [rsi + rbp*4]
add rcx, 1
mov eax, edx
mov ebp, ebx
test dl, dl
je 0x140018b46
movzx edx, byte [rcx - 1]
cmp al, 0x23
jne 0x140018b10
cmp dl, 0x23
jne 0x140018b10
cmp byte [rcx], 0x23
cmove ebp, edi
mov dl, 0x23
jmp 0x140018b10
mov ebx, edi
cmp r9d, dword [r15 + 0x1f4]
jne 0x140018c03
lea ebp, [r9 + 1]
test r9d, r9d
je 0x140018b6c
mov eax, r9d
shr eax, 0x1f
add eax, r9d
sar eax, 1
add eax, r9d
jmp 0x140018b71
mov eax, 8
cmp eax, ebp
cmovg ebp, eax
cmp r9d, ebp
jge 0x140018c03
movsxd rcx, ebp
shl rcx, 2
test r8, r8
je 0x140018b93
add dword [r8 + 0x3b0], 1
mov rdx, qword [0x1400d2170]
call qword [0x1400d0178]
mov r14, rax
mov rdx, qword [r15 + 0x1f8]
test rdx, rdx
je 0x140018bee
movsxd r8, dword [r15 + 0x1f0]
shl r8, 2
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [r15 + 0x1f8]
test rcx, rcx
je 0x140018be1
mov rax, qword [0x1400d2160]
test rax, rax
je 0x140018be1
add dword [rax + 0x3b0], 0xffffffff
mov rdx, qword [0x1400d2170]
call qword [0x1400d0180]
mov qword [r15 + 0x1f8], r14
mov dword [r15 + 0x1f4], ebp
mov r9d, dword [r15 + 0x1f0]
not ebx
movsxd rax, r9d
mov dword [r14 + rax*4], ebx
add dword [r15 + 0x1f0], 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140018c30
Capabilities:
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x1400d20f0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [0x1400d2160]
cmp byte [rax + 0x1fc5], 0
je 0x140018ce3
movss xmm0, dword [rax + 0x15f8]
movss xmm1, dword [0x1400aaf8c]
mulss xmm1, xmm0
mulss xmm0, dword [0x1400aa060]
addss xmm1, dword [rax + 0x124]
movss xmm2, dword [rax + 0x1650]
addss xmm0, dword [rax + 0x120]
movss dword [rax + 0x1aa8], xmm0
movss dword [rax + 0x1aac], xmm1
mov qword [rax + 0x1ab0], 0
mulss xmm2, dword [0x1400aaf90]
mov dword [rax + 0x1a9c], 1
or byte [rax + 0x1a98], 0x41
movss dword [rax + 0x1af0], xmm2
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400a7f70
xor ecx, ecx
mov dl, 1
add rsp, 0x40
pop rsi
jmp fcn.140018d30
mov r9d, dword [rax + 0x2fd8]
lea r8, str.Tooltip__02d
lea rsi, [rsp + 0x20]
mov edx, 0x10
mov rcx, rsi
call fcn.1400068e0
mov rcx, rsi
xor edx, edx
mov r8d, 0x20c0347
call fcn.1400102c0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400a7f70
nop
add rsp, 0x40
pop rsi
ret

Function at 0x140018d30
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov ebx, edx
mov r15d, ecx
mov rax, qword [0x1400d20f0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [0x1400d2160]
mov r9d, dword [r14 + 0x2fd8]
lea r8, str.Tooltip__02d
lea rcx, [rsp + 0x20]
mov edx, 0x10
call fcn.1400068e0
test bl, bl
je 0x140018e83
mov dl, byte [rsp + 0x20]
test dl, dl
je 0x140018dd4
lea rcx, [rsp + 0x22]
mov edi, 0xffffffff
lea rsi, [0x1400aa520]
mov eax, 0xffffffff
jmp 0x140018db8
movzx edx, dl
movzx ebp, al
shr eax, 8
xor ebp, edx
xor eax, dword [rsi + rbp*4]
add rcx, 1
mov edx, ebx
test bl, bl
je 0x140018dd0
movzx ebx, byte [rcx - 1]
cmp dl, 0x23
jne 0x140018da0
cmp bl, 0x23
jne 0x140018da0
cmp byte [rcx], 0x23
cmove eax, edi
mov bl, 0x23
jmp 0x140018da0
not eax
jmp 0x140018dd6
xor eax, eax
mov rdx, qword [0x1400d2160]
mov rcx, qword [rdx + 0x1a08]
movsxd rbp, dword [rdx + 0x1a00]
test rbp, rbp
je 0x140018e26
mov rdx, rcx
mov rsi, rbp
mov rbx, rbp
jmp 0x140018e08
mov rsi, rbx
test rbx, rbx
je 0x140018e2b
shr rbx, 1
mov rdi, rbx
shl rdi, 4
cmp dword [rdx + rdi], eax
jae 0x140018e00
not rbx
add rbx, rsi
add rdx, rdi
add rdx, 0x10
jmp 0x140018e00
xor ebp, ebp
mov rdx, rcx
shl rbp, 4
add rcx, rbp
cmp rdx, rcx
je 0x140018e83
cmp dword [rdx], eax
jne 0x140018e83
mov rax, qword [rdx + 8]
test rax, rax
je 0x140018e83
cmp byte [rax + 0x7e], 0
je 0x140018e83
mov byte [rax + 0x85], 1
mov dword [rax + 0xa8], 1
mov r9d, dword [r14 + 0x2fd8]
add r9d, 1
mov dword [r14 + 0x2fd8], r9d
lea r8, str.Tooltip__02d
lea rcx, [rsp + 0x20]
mov edx, 0x10
call fcn.1400068e0
or r15d, 0x20c0347
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, r15d
call fcn.1400102c0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400a7f70
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140019e00
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rbx, qword [0x1400d2160]
mov eax, dword [rbx + 0x3030]
cmp eax, dword [rbx + 0x3034]
jne 0x140019e3a
lea ebp, [rax + 1]
test eax, eax
je 0x140019e42
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x140019e47
mov rdi, rbx
jmp 0x140019eda
mov ecx, 8
cmp ecx, ebp
cmovg ebp, ecx
mov rdi, rbx
cmp eax, ebp
jge 0x140019eda
movsxd rcx, ebp
shl rcx, 5
add dword [rbx + 0x3b0], 1
mov rdx, qword [0x1400d2170]
call qword [0x1400d0178]
mov rdi, rax
mov rdx, qword [rbx + 0x3038]
test rdx, rdx
je 0x140019ec0
movsxd r8, dword [rbx + 0x3030]
shl r8, 5
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0x3038]
test rcx, rcx
je 0x140019eb3
mov rax, qword [0x1400d2160]
test rax, rax
je 0x140019eb3
add dword [rax + 0x3b0], 0xffffffff
mov rdx, qword [0x1400d2170]
call qword [0x1400d0180]
mov qword [rbx + 0x3038], rdi
mov dword [rbx + 0x3034], ebp
mov eax, dword [rbx + 0x3030]
mov rdi, qword [0x1400d2160]
mov rcx, qword [rbx + 0x3038]
cdqe
shl rax, 5
xorps xmm0, xmm0
movups xmmword [rcx + rax + 0xd], xmm0
movups xmmword [rcx + rax], xmm0
movsxd r15, dword [rbx + 0x3030]
lea eax, [r15 + 1]
mov dword [rbx + 0x3030], eax
mov r12, qword [rbx + 0x3038]
shl r15, 5
lea r14, [r12 + r15]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rbx, rax
add rbx, 1
test rdi, rdi
je 0x140019f2e
add dword [rdi + 0x3b0], 1
mov rdx, qword [0x1400d2170]
mov rcx, rbx
call qword [0x1400d0178]
mov rdi, rax
mov rcx, rax
mov rdx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov qword [r14], rdi
mov bl, byte [rsi]
test bl, bl
je 0x140019fa4
add rsi, 2
mov ebp, 0xffffffff
lea rdx, [0x1400aa520]
mov eax, 0xffffffff
jmp 0x140019f88
movzx ebx, bl
movzx edi, al
shr eax, 8
xor edi, ebx
xor eax, dword [rdx + rdi*4]
add rsi, 1
mov ebx, ecx
test cl, cl
je 0x140019fa0
movzx ecx, byte [rsi - 1]
cmp bl, 0x23
jne 0x140019f70
cmp cl, 0x23
jne 0x140019f70
cmp byte [rsi], 0x23
cmove eax, ebp
mov cl, 0x23
jmp 0x140019f70
not eax
jmp 0x140019fa6
xor eax, eax
mov dword [r12 + r15 + 8], eax
mov rax, r14
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140035120
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rax, qword [0x1400d20f0]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp edx, 0xffffffff
je 0x14003524f
mov esi, edx
mov rdi, rcx
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x14003517e
mov rax, qword [rdi + 0x58]
mov ecx, dword [rax]
test ecx, ecx
jle 0x14003517e
add ecx, 0xffffffff
mov dword [rax], ecx
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
lea rdx, [rcx + 1]
mov qword [rax], rdx
mov byte [rcx], sil
jmp 0x140035294
cmp qword [rdi + 0x80], 0
je 0x140035253
mov rax, qword [rdi + 0x18]
lea rcx, [rdi + 0x70]
cmp qword [rax], rcx
jne 0x1400351b8
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x14003525a
mov byte [rsp + 0x5f], sil
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov rbp, qword [rcx]
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea r15, [rsp + 0x60]
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r14, [rsp + 0x5f]
mov r8, r14
call qword [rbp + 0x38]
mov ebp, 0xffffffff
cmp eax, 2
jae 0x140035273
mov rbx, qword [rsp + 0x48]
sub rbx, r15
je 0x14003523f
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x60]
mov edx, 1
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140035292
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], r14
mov eax, 0xffffffff
jmp 0x14003528d
xor esi, esi
jmp 0x140035294
mov esi, 0xffffffff
jmp 0x140035294
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
jmp 0x140035294
cmp eax, 3
jne 0x140035292
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rsp + 0x5f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
mov ebp, esi
mov esi, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400a7f70
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140035720
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x14003575b
mov r14, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x140035763
mov rcx, rbx
mov rdx, rdi
mov r8, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
xor r14d, r14d
jmp 0x140035858
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400357b6
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x1400357b6
cmp r15, r14
cmovae r15, r14
mov rcx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov rsi, r14
sub rsi, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x1400357c7
jmp 0x140035855
mov rsi, r14
cmp qword [rbx + 0x80], 0
je 0x140035855
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x1400357f3
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
nop word [rax + rax]
cmp rsi, 0x1000
jb 0x140035831
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call r15
add rdi, rax
sub rsi, rax
cmp rax, 0xfff
je 0x140035800
jmp 0x140035855
test rsi, rsi
je 0x140035853
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rsi, rax
jmp 0x140035855
xor esi, esi
sub r14, rsi
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140035870
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x1400358a6
mov rcx, rbx
mov rdx, r14
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400358f7
test rsi, rsi
jle 0x1400358f7
mov rax, qword [rbx + 0x58]
mov eax, dword [rax]
test eax, eax
jle 0x1400358f7
movsxd r15, eax
cmp r15, rsi
cmovg r15, rsi
mov rdx, r14
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add r14, r15
mov rdi, rsi
sub rdi, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
movsxd rcx, r15d
add qword [rax], rcx
test rdi, rdi
jg 0x1400358ff
jmp 0x14003591f
mov rdi, rsi
test rdi, rdi
jle 0x14003591f
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x14003591f
mov edx, 1
mov rcx, r14
mov r8, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rdi, rax
sub rsi, rdi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140035d10
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x1400d20f0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x140035dbc
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x140035dbc
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140035dba
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea rbx, [rsp + 0x28]
mov qword [rsp + 0x20], rbx
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x140035dd3
cmp eax, 1
je 0x140035d87
test eax, eax
jne 0x140035dba
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x140035db0
mov r9, qword [rsi + 0x80]
lea rcx, [rsp + 0x30]
mov edx, 1
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140035dba
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x140035dbc
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400a7f70
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov dil, 1
jmp 0x140035dbc

Function at 0x140049870
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x38
mov rcx, qword [0x1400d6960]
mov rax, qword [rcx]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x3f800000
mov dword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [rax + 0x158]
nop word [rax + rax]
mov rcx, qword [0x1400d6960]
mov rax, qword [rcx]
mov qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [rax + 0x88]
cmp eax, 0x8876021c
je 0x1400498b0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14002e7b0
call fcn.14002eaf0
xor ecx, ecx
call fcn.14000b110
mov rcx, qword [0x1400d6960]
test rcx, rcx
je 0x140049906
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1400d6958]
test rcx, rcx
je 0x140049918
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1400d6998]
test rcx, rcx
je 0x140049935
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [0x1400d6998], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140049940
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x13f8
call fcn.1400a7f10
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1360], xmm6
mov qword [rbp + 0x1358], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov qword [rbp + 0x1328], 0
movaps xmm6, xmmword [0x1400aa050]
movups xmmword [rbp + 0x1338], xmm6
mov byte [rbp + 0x1328], 0
lea r9, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
lea r14, [rbp + 0x1328]
mov edx, 0x3e
mov rcx, r14
call fcn.140002ec0
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rbp + 0x1324], 0xffffffff
mov dword [rbp - 0x5c], eax
mov ecx, 3
nop word [rax + rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add rax, rcx
add rax, 0xfffffffffffffffe
mov dword [rbp + rcx*4 - 0x64], eax
cmp rcx, 0x271
je 0x140049a0d
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 0xffffffff
mov dword [rbp + rcx*4 - 0x60], eax
add rcx, 2
jmp 0x1400499d0
mov dword [rbp - 0x60], 0x270
mov r9d, dword [rbp + 0x1338]
add r9d, 0xffffffff
mov dword [rbp + 0x1350], 0
mov dword [rbp + 0x1354], r9d
mov qword [rdi], 0
movups xmmword [rdi + 0x10], xmm6
mov qword [rbp + 0x1348], rdi
mov byte [rdi], 0
test rsi, rsi
je 0x140049ae0
add rsi, 0xffffffffffffffff
xor r8d, r8d
lea r15, [rbp + 0x1350]
lea rdi, [rbp - 0x60]
mov rcx, r15
mov rdx, rdi
call fcn.14009bf90
cmp qword [rbp + 0x1340], 0x10
mov rcx, r14
jb 0x140049a7f
mov rcx, qword [rbp + 0x1328]
cdqe
movzx r9d, byte [rcx + rax]
mov rcx, qword [rbp + 0x1348]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rcx + 0x18]
cmp rax, rbx
jae 0x140049ac0
lea rdx, [rax + 1]
mov qword [rcx + 0x10], rdx
mov rdx, rcx
cmp rbx, 0x10
jb 0x140049aae
mov rdx, qword [rcx]
mov byte [rdx + rax], r9b
mov byte [rdx + rax + 1], 0
jmp 0x140049aca
mov edx, 1
call fcn.140032060
sub rsi, 1
jb 0x140049ae0
mov r8d, dword [rbp + 0x1350]
mov r9d, dword [rbp + 0x1354]
jmp 0x140049a60
mov rax, qword [rbp + 0x1340]
cmp rax, 0x10
mov rsi, qword [rbp + 0x1348]
jb 0x140049b28
mov rcx, qword [rbp + 0x1328]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140049b23
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140049b42
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400a7c2c
mov rax, rsi
movaps xmm6, xmmword [rbp + 0x1360]
add rsp, 0x13f8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140097630
Capabilities:
Log keystrokes via polling

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
movaps xmmword [rsp + 0x150], xmm7
movaps xmmword [rsp + 0x140], xmm6
mov rax, qword [0x1400d20f0]
xor rax, rsp
mov qword [rsp + 0x138], rax
call fcn.14000b8f0
mov rsi, rax
mov rax, qword [0x1400d6998]
mov qword [rsi + 0x108], rax
mov dword [rsi + 0x10], 0x3c888889
mov rdi, qword [0x1400d69a0]
mov ebx, dword [0x1400d7fec]
mov ebp, dword [0x1400d7fe8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1400976c3
mov eax, dword [rsp + 0x30]
mov ecx, ebp
shr ecx, 0x1f
add ecx, ebp
sar ecx, 1
sub eax, ecx
mov dword [rdi], eax
mov eax, dword [rsp + 0x34]
mov ecx, ebx
shr ecx, 0x1f
add ecx, ebx
sar ecx, 1
sub eax, ecx
mov dword [rdi + 4], eax
mov rdi, qword [0x1400d69a0]
xorps xmm6, xmm6
cvtsi2ss xmm6, dword [rdi]
xorps xmm7, xmm7
cvtsi2ss xmm7, dword [rdi + 4]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
shr eax, 0xf
mov byte [rdi + 8], al
mov rbx, qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 1
call rbx
and al, 1
mov byte [rdi + 9], al
mov ecx, 0x2d
call rbx
and al, 1
mov byte [rdi + 0xa], al
subss xmm6, dword [0x1400d68d4]
subss xmm7, dword [0x1400d68d8]
movss dword [0x1400d2150], xmm6
movss dword [0x1400d2154], xmm7
movss dword [rsi + 0x118], xmm6
movss dword [rsi + 0x11c], xmm7
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetKeyboardState]
xor ebx, ebx
lea r14, [rsp + 0x28]
mov r15, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x140097775
test al, al
je 0x1400977a2
add rbx, 1
cmp rbx, 0x9d
je 0x140097842
cmp byte [rsp + rbx + 0x38], 0
movzx eax, byte [rsi + rbx + 0x13c]
js 0x140097760
test al, al
je 0x140097764
mov ecx, 0x101
xor edi, edi
lea rdx, [rbx + 8]
mov byte [rsi + rbx + 0x13c], dil
call fcn.140033ea0
jmp 0x140097764
mov rdx, qword [0x1400d0ef8]
add rdx, qword [0x1400d69b0]
je 0x1400977e1
mov rax, qword [0x1400d69b8]
mov rcx, qword [rax]
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8, r14
call r15
test eax, eax
jns 0x1400977e8
mov edx, 0xc
test rdx, rdx
jne 0x1400977f6
jmp 0x140097835
mov edx, 0xc
jmp 0x1400977f6
mov rdx, qword [rsp + 0x28]
add rdx, 0xc
test rdx, rdx
je 0x140097835
mov rax, qword [0x1400d69b8]
mov rcx, qword [rax]
mov qword [rsp + 0x20], 0
mov r9d, 4
mov r8, r14
call r15
mov ecx, 0x100
mov dil, 1
test eax, eax
js 0x14009778f
cmp dword [rsp + 0x28], 0
jne 0x140097764
jmp 0x14009778f
mov ecx, 0x100
mov dil, 1
jmp 0x14009778f
mov rax, qword [0x1400d69a0]
mov cl, byte [rax + 8]
mov byte [rsi + 0x120], cl
mov al, byte [rax + 9]
mov byte [rsi + 0x410], al
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.1400a7f70
movaps xmm6, xmmword [rsp + 0x140]
movaps xmm7, xmmword [rsp + 0x150]
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret