joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005a490
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x14005a4c9
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14005a5b8
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x14005a560
cmp qword [rsp + 0x20], 0
jle 0x14005a560
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x14005a509
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.14001af40
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rsp + 0x50], 0
jle 0x14005a5a8
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x14005a5a8
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x14005be20
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
sub rsp, 0x258
mov rax, qword [0x140413c00]
xor rax, rsp
mov qword [rsp + 0x240], rax
movzx eax, byte [0x140414d40]
test eax, eax
jne 0x14005c09d
mov eax, dword [0x140414d50]
inc eax
mov dword [rsp + 0x34], eax
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x80]
call fcn.140014ab0
mov rcx, rax
call fcn.140017610
nop
movzx eax, byte [0x140414bf8]
test eax, eax
jne 0x14005be7f
jmp 0x14005be3c
lea rcx, [rsp + 0x160]
call fcn.14005b790
nop
lea rax, [0x140414c08]
test rax, rax
je 0x14005bea0
mov byte [rsp + 0x30], 1
jmp 0x14005bea5
mov byte [rsp + 0x30], 0
cvtsi2ss xmm0, dword [0x140414c00]
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
movzx r9d, byte [rsp + 0x30]
mov r8d, dword [0x140414c0c]
movaps xmm1, xmm0
lea rcx, [0x1404148a0]
call fcn.14006c010
movzx eax, al
test eax, eax
jne 0x14005bef0
lea rcx, [rsp + 0x160]
call fcn.140023590
nop
jmp 0x14005be3c
movzx eax, byte [rsp + 0x1a0]
test eax, eax
jne 0x14005bf29
lea rdx, [rsp + 0x160]
lea rcx, [0x1404148a8]
call fcn.14005bba0
movzx eax, byte [rax + 0x40]
test eax, eax
jne 0x14005bf29
mov ecx, dword [0x140414c04]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
jne 0x14005bf3c
lea rcx, [rsp + 0x160]
call fcn.140023590
nop
jmp 0x14005be3c
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x160]
mov rcx, qword [rsp + 0x38]
call fcn.14005b700
mov qword [rsp + 0x40], rax
mov r9d, 0x796e
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x210]
lea rcx, [0x1404148a0]
call fcn.14006c6c0
nop
lea rdx, [rsp + 0x98]
lea rcx, [0x1404148a0]
call fcn.14005bdb0
mov rcx, qword [rax]
call fcn.14005bde0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
add rax, 0x78
mov rcx, rax
call fcn.14005aba0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
add rax, 0x320
mov rcx, rax
call fcn.14005aba0
mov qword [rsp + 0x60], rax
mov ecx, dword [0x140414c04]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x14005c08a
mov rax, qword [rsp + 0x160]
add rax, 0x70
mov rdx, rax
lea rcx, [rsp + 0x200]
call fcn.14005ab60
movss xmm3, dword [0x140135c30]
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rsp + 0x220]
call fcn.14005b900
nop
lea r8, [rsp + 0x200]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x210]
call fcn.14005bc70
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x220]
lea rdx, [rsp + 0x230]
mov rcx, qword [rsp + 0x58]
call fcn.14005bc70
nop
lea rax, [rsp + 0x70]
lea rcx, [rsp + 0x230]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x60]
add rax, 0x20
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.14005abf0
nop
lea rcx, [rsp + 0x160]
call fcn.140023590
nop
jmp 0x14005be3c
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14011cd30
add rsp, 0x258
pop rdi
pop rsi
ret
Function at 0x140061270
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
sub rsp, 0x138
mov rax, qword [0x140413c00]
xor rax, rsp
mov qword [rsp + 0x120], rax
movzx eax, byte [0x140414d40]
test eax, eax
jne 0x14006142f
lea rdx, [0x140414d50]
lea rcx, [rsp + 0x40]
call fcn.140014ab0
mov rcx, rax
call fcn.140017610
nop
movzx eax, byte [0x140414bc4]
test eax, eax
je 0x1400612d7
lea rdx, [rsp + 0x48]
lea rcx, [0x1404148a0]
call fcn.14005bdb0
cmp qword [rax], 0
jne 0x1400612d9
jmp 0x14006128c
lea rcx, [rsp + 0x80]
call fcn.14005b790
nop
cvtsi2ss xmm0, dword [0x140414bd8]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
movzx r9d, byte [0x140414bcc]
mov r8d, dword [0x140414bd4]
movaps xmm1, xmm0
lea rcx, [0x1404148a0]
call fcn.14006c010
movzx eax, al
test eax, eax
jne 0x140061334
lea rcx, [rsp + 0x80]
call fcn.140023590
nop
jmp 0x14006128c
movzx eax, byte [rsp + 0xc0]
test eax, eax
jne 0x14006135c
lea rdx, [rsp + 0x80]
lea rcx, [0x1404148a8]
call fcn.14005bba0
movzx eax, byte [rax + 0x40]
test eax, eax
je 0x14006136f
lea rcx, [rsp + 0x80]
call fcn.140023590
nop
jmp 0x14006128c
mov ecx, dword [0x140414bc8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
jne 0x140061393
lea rcx, [rsp + 0x80]
call fcn.140023590
nop
jmp 0x14006128c
movzx eax, byte [0x140414bcd]
test eax, eax
je 0x1400613bd
movzx eax, byte [rsp + 0x114]
test eax, eax
jne 0x1400613bd
lea rcx, [rsp + 0x80]
call fcn.140023590
nop
jmp 0x14006128c
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x68]
call fcn.14001d980
mov r8d, dword [0x140414bd0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call fcn.140060e60
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x70]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov r9d, dword [0x140414be0]
mov r8d, dword [0x140414bdc]
lea rdx, [rsp + 0x30]
lea rcx, [0x1404148a0]
call fcn.14006fca0
nop
lea rcx, [rsp + 0x80]
call fcn.140023590
nop
jmp 0x14006128c
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14011cd30
add rsp, 0x138
pop rdi
pop rsi
ret
Function at 0x1400626d0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0xb8
mov rax, qword [0x140413c00]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movzx eax, byte [0x140414d40]
test eax, eax
jne 0x1400628f4
mov eax, dword [0x140414d50]
inc eax
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.140014ab0
mov rcx, rax
call fcn.140017610
nop
movzx eax, byte [0x140414be4]
test eax, eax
je 0x14006273e
lea rdx, [rsp + 0x60]
lea rcx, [0x1404148a0]
call fcn.14005bdb0
cmp qword [rax], 0
jne 0x140062740
jmp 0x1400626e9
mov byte [rsp + 0x20], 0
mov ecx, dword [0x140414be8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
jne 0x140062777
movzx eax, byte [0x140414eac]
test eax, eax
je 0x140062772
mov ecx, 4
call fcn.140062910
mov byte [0x140414eac], 0
jmp 0x1400626e9
lea rcx, [0x1404148a0]
call fcn.14006c430
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
je 0x140062889
lea rdx, [rsp + 0x80]
lea rcx, [0x1404148a0]
call fcn.14005bdb0
add rax, 0x14
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0xa0]
call fcn.14005e860
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.1400624f0
movss dword [rsp + 0x2c], xmm0
cvtsi2ss xmm0, dword [0x140414bf0]
comiss xmm0, dword [rsp + 0x2c]
jb 0x1400627fc
mov dword [rsp + 0x24], 1
jmp 0x140062804
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
mov byte [rsp + 0x20], al
mov rcx, qword [rsp + 0xa0]
call fcn.1400625c0
movzx eax, al
test eax, eax
je 0x140062831
movzx eax, byte [0x140414bec]
test eax, eax
jne 0x140062831
mov byte [rsp + 0x20], 0
movzx eax, byte [0x140414bcd]
test eax, eax
je 0x140062855
mov rcx, qword [rsp + 0xa0]
call fcn.140062610
movzx eax, al
test eax, eax
jne 0x140062855
mov byte [rsp + 0x20], 0
lea rcx, [0x1404148a0]
call fcn.14006fb40
movzx eax, al
test eax, eax
je 0x140062884
lea rdx, [rsp + 0xa0]
lea rcx, [0x1404148a8]
call fcn.14005bba0
movzx eax, byte [rax + 0x40]
test eax, eax
je 0x140062889
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1400628ca
movzx eax, byte [0x140414eac]
test eax, eax
jne 0x1400628ca
lea rdx, [0x140414bf4]
lea rcx, [rsp + 0x48]
call fcn.140014ab0
mov rcx, rax
call fcn.140017610
nop
mov ecx, 2
call fcn.140062910
mov byte [0x140414eac], 1
jmp 0x1400628ef
movzx eax, byte [0x140414eac]
test eax, eax
je 0x1400628ef
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400628ef
mov ecx, 4
call fcn.140062910
mov byte [0x140414eac], 0
jmp 0x1400626e9
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14011cd30
add rsp, 0xb8
ret
Function at 0x140069760
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140413c00]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.1400257f0
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.14006a6e0
nop
lea rax, [0x140069370]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.1400167a0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x140069804
lea rcx, [rsp + 0x40]
call fcn.140026c30
nop
jmp 0x14006981b
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.14006b610
nop
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011cd30
add rsp, 0x58
ret
Function at 0x1400752c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140413c00]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.14001a540
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140075c50
nop
lea rax, [0x140074dd0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.1400167a0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x140075364
lea rcx, [rsp + 0x40]
call fcn.14001c910
nop
jmp 0x14007537b
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.140079200
nop
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011cd30
add rsp, 0x58
ret

Function at 0x1400753a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140413c00]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.14001a540
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140075c50
nop
lea rax, [0x140074e60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.1400167a0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x140075444
lea rcx, [rsp + 0x40]
call fcn.14001c910
nop
jmp 0x14007545b
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.140079200
nop
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011cd30
add rsp, 0x58
ret

Function at 0x140079d60
Capabilities:
Check for outputdebugstring error
Print debug messages

Disassembly:
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, str.Anti_debugging_test
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140079d8d
mov dword [rsp + 0x20], 1
jmp 0x140079d95
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140079e10
Capabilities:
Allocate or change rwx memory
Check for software breakpoints

Disassembly:
sub rsp, 0x38
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140079ea4
mov qword [rsp + 0x20], 0
jmp 0x140079e52
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x1000
jae 0x140079e90
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
cmp eax, 0xcc
jne 0x140079e8e
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov al, 1
jmp 0x140079ea6
jmp 0x140079e45
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
xor al, al
add rsp, 0x38
ret

Function at 0x140079eb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x2c], 0x3e8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x24], eax
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
sub ecx, eax
mov eax, ecx
cmp eax, 0x3e8
jae 0x140079ef8
mov dword [rsp + 0x20], 1
jmp 0x140079f00
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x14007b770
Capabilities:
Check for debugger via api

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140413c00]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x24]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x24], 0
je 0x14007b7ad
mov byte [rsp + 0x20], 1
jmp 0x14007b7b2
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14011cd30
add rsp, 0x38
ret
Function at 0x140098210
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14013d7b0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x14009829e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x140098242
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x1400982b0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14013d7b0]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x1400983b4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x1400983af
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x140098384
cmp qword [rsp + 0x38], 2
jb 0x140098384
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140098384
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140098384
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x1400982f7
jmp 0x140098446
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x140098446
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x14009841c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14009841c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14009841c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x1400983b4
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x1400be5e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x140413c00]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x80]
add rax, 0x68
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x58]
call fcn.140083650
nop
mov rax, qword [rsp + 0x30]
mov edx, dword [rax]
lea rcx, [rsp + 0x58]
call fcn.1400c7690
lea rcx, [rsp + 0x58]
call fcn.1400c7710
cdqe
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
nop
mov dword [rsp + 0x24], 0
jmp 0x1400be667
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
cmp dword [rsp + 0x24], eax
jge 0x1400be6cb
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x30]
call fcn.140087380
movzx eax, word [rax]
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x24]
lea rcx, [rsp + 0x58]
call fcn.1400b37c0
mov ecx, dword [rsp + 0x38]
mov dword [rax + 4], ecx
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x30]
call fcn.140087380
movzx eax, word [rax + 2]
mov dword [rsp + 0x3c], eax
mov edx, dword [rsp + 0x24]
lea rcx, [rsp + 0x58]
call fcn.1400b37c0
mov ecx, dword [rsp + 0x3c]
mov dword [rax + 8], ecx
jmp 0x1400be65d
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.1400b37c0
mov r8d, dword [rsp + 0x58]
mov rdx, rax
mov rcx, qword [rsp + 0x48]
call fcn.1400d1700
nop
mov dword [rsp + 0x20], 0
jmp 0x1400be6fe
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x58]
cmp dword [rsp + 0x20], eax
jge 0x1400be7de
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.1400b37c0
cmp dword [rax + 0x14], 0
je 0x1400be7d9
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.1400b37c0
movzx eax, word [rax + 0xc]
mov word [rsp + 0x28], ax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
call fcn.140087380
movzx ecx, word [rsp + 0x28]
mov word [rax + 4], cx
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.1400b37c0
movzx eax, word [rax + 0x10]
mov word [rsp + 0x2a], ax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
call fcn.140087380
movzx ecx, word [rsp + 0x2a]
mov word [rax + 6], cx
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.1400b37c0
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.1400b37c0
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0x10]
add ecx, dword [rax + 8]
mov eax, ecx
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x44]
mov dword [rsp + 0x44], eax
mov edx, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
call fcn.140083480
mov rcx, qword [rsp + 0x80]
mov dword [rcx + 0x44], eax
jmp 0x1400be6f4
lea rcx, [rsp + 0x58]
call fcn.140086aa0
nop
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14011cd30
add rsp, 0x78
ret
Function at 0x1400d70e0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub rsp, 0x48
call fcn.1400d5fa0
mov qword [rsp + 0x28], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
add rax, 0x2c
mov r9d, 4
mov r8, rax
mov edx, 0x20001004
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1400d7142
mov rax, qword [rsp + 0x28]
mov dword [rax + 0x2c], 0
add rsp, 0x48
ret

Function at 0x1400d86b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400d86d6
mov dword [rsp + 0x20], 1
jmp 0x1400d86de
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret