joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140042dc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x140042ddb
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x15
jb 0x140042dc8
mov byte [rcx + 0x16], 0
mov rax, rcx
ret

Function at 0x140042de0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x140042dfb
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0xb
jb 0x140042de8
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x140042e00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x140042e1b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 9
jb 0x140042e08
mov byte [rcx + 0xa], 0
mov rax, rcx
ret

Function at 0x140042e20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x140042e3b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0xe
jb 0x140042e28
mov byte [rcx + 0xf], 0
mov rax, rcx
ret

Function at 0x140042e40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x140042e5b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0xf
jb 0x140042e48
mov byte [rcx + 0x10], 0
mov rax, rcx
ret

Function at 0x140042e60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x140042e7b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0xa
jb 0x140042e68
mov byte [rcx + 0xb], 0
mov rax, rcx
ret

Function at 0x140042e80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x140042e9b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x13
jb 0x140042e88
mov byte [rcx + 0x14], 0
mov rax, rcx
ret

Function at 0x140042ea0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x140042ebb
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x12
jb 0x140042ea8
mov byte [rcx + 0x13], 0
mov rax, rcx
ret

Function at 0x140042ec0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x140042edb
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x11
jb 0x140042ec8
mov byte [rcx + 0x12], 0
mov rax, rcx
ret

Function at 0x140042ee0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x140042efb
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0xc
jb 0x140042ee8
mov byte [rcx + 0xd], 0
mov rax, rcx
ret

Function at 0x140042f00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x140042f1b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x1b
jb 0x140042f08
mov byte [rcx + 0x1c], 0
mov rax, rcx
ret

Function at 0x140042f20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x140042f3b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x14
jb 0x140042f28
mov byte [rcx + 0x15], 0
mov rax, rcx
ret
Function at 0x140042f40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x140042f5b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x10
jb 0x140042f48
mov byte [rcx + 0x11], 0
mov rax, rcx
ret

Function at 0x140042f60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x140042f7b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0xd
jb 0x140042f68
mov byte [rcx + 0xe], 0
mov rax, rcx
ret

Function at 0x140042f80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
je 0x140042f9b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x16
jb 0x140042f88
mov byte [rcx + 0x17], 0
mov rax, rcx
ret

Function at 0x140042fa0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
je 0x140042fbb
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x19
jb 0x140042fa8
mov byte [rcx + 0x1a], 0
mov rax, rcx
ret

Function at 0x140042fc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1d], 0
je 0x140042fdb
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x1c
jb 0x140042fc8
mov byte [rcx + 0x1d], 0
mov rax, rcx
ret

Function at 0x140042fe0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x140042ffb
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 3
jb 0x140042fe8
mov byte [rcx + 4], 0
mov rax, rcx
ret

Function at 0x140043000
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x14004301b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x17
jb 0x140043008
mov byte [rcx + 0x18], 0
mov rax, rcx
ret

Function at 0x140043020
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14004303b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 4
jb 0x140043028
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140043040
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x14004305b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x1a
jb 0x140043048
mov byte [rcx + 0x1b], 0
mov rax, rcx
ret

Function at 0x140043060
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x68], 0
je 0x14004307b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x67
jb 0x140043068
mov byte [rcx + 0x68], 0
mov rax, rcx
ret

Function at 0x140043080
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x14004309b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 8
jb 0x140043088
mov byte [rcx + 9], 0
mov rax, rcx
ret

Function at 0x1400430a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x1400430bb
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 7
jb 0x1400430a8
mov byte [rcx + 8], 0
mov rax, rcx
ret
Function at 0x1400430c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x1400430db
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 5
jb 0x1400430c8
mov byte [rcx + 6], 0
mov rax, rcx
ret

Function at 0x1400430e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x1400430fb
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 6
jb 0x1400430e8
mov byte [rcx + 7], 0
mov rax, rcx
ret

Function at 0x1400dcc64
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x26], 0
je 0x1400dcc7f
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x25
jb 0x1400dcc6c
mov byte [rcx + 0x26], 0
ret

Function at 0x1400dcc80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x1400dcc9b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 5
jb 0x1400dcc88
mov byte [rcx + 6], 0
ret

Function at 0x1400dcc9c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x1400dccb7
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 7
jb 0x1400dcca4
mov byte [rcx + 8], 0
ret

Function at 0x1400dccb8
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x1400dccd3
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 8
jb 0x1400dccc0
mov byte [rcx + 9], 0
ret

Function at 0x1400dccd4
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x1400dccef
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x1a
jb 0x1400dccdc
mov byte [rcx + 0x1b], 0
ret

Function at 0x1400dccf0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
je 0x1400dcd0b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x16
jb 0x1400dccf8
mov byte [rcx + 0x17], 0
ret

Function at 0x1400dcd0c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x1400dcd27
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0xd
jb 0x1400dcd14
mov byte [rcx + 0xe], 0
ret

Function at 0x1400dcd28
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x1400dcd43
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x10
jb 0x1400dcd30
mov byte [rcx + 0x11], 0
ret

Function at 0x1400dcd44
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x1400dcd5f
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x14
jb 0x1400dcd4c
mov byte [rcx + 0x15], 0
ret

Function at 0x1400dcd60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x1400dcd7b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0xc
jb 0x1400dcd68
mov byte [rcx + 0xd], 0
ret

Function at 0x1400dcd7c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x1400dcd97
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x11
jb 0x1400dcd84
mov byte [rcx + 0x12], 0
ret
Function at 0x1400dcd98
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x1400dcdb3
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x12
jb 0x1400dcda0
mov byte [rcx + 0x13], 0
ret

Function at 0x1400dcdb4
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x1400dcdcf
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x13
jb 0x1400dcdbc
mov byte [rcx + 0x14], 0
ret

Function at 0x1400dcdd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x1400dcdeb
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0xa
jb 0x1400dcdd8
mov byte [rcx + 0xb], 0
ret

Function at 0x1400dcdec
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x1400dce07
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0xf
jb 0x1400dcdf4
mov byte [rcx + 0x10], 0
ret

Function at 0x1400dce08
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x1400dce23
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0xe
jb 0x1400dce10
mov byte [rcx + 0xf], 0
ret

Function at 0x1400dce24
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x1400dce3f
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 9
jb 0x1400dce2c
mov byte [rcx + 0xa], 0
ret

Function at 0x1400dce40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x1400dce5b
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0xb
jb 0x1400dce48
mov byte [rcx + 0xc], 0
ret

Function at 0x1400dce5c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x1400dce77
xor edx, edx
lea eax, [rdx + 0x57]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x15
jb 0x1400dce64
mov byte [rcx + 0x16], 0
ret

Function at 0x1400dd860
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbp, rcx
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400dd914
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rbx, eax
test eax, eax
js 0x1400dd914
jne 0x1400dd8a7
xor eax, eax
jmp 0x1400dd919
lea eax, [rbx + 1]
movsxd rcx, eax
lea rdx, [0x14012fab0]
call fcn.14012c520
mov rdi, rax
test rax, rax
jne 0x1400dd8c6
lea eax, [rdi - 2]
jmp 0x1400dd919
xor r8d, r8d
mov byte [rbx + rax], 0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov r9, rsi
mov r8, rbx
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rbx
je 0x1400dd8f8
mov ebx, 0xfffffffd
jmp 0x1400dd908
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.1400de810
mov ebx, eax
mov rcx, rdi
call fcn.14012c3b0
mov eax, ebx
jmp 0x1400dd919
mov eax, 0xfffffffd
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e2310
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x1400e236a
mov r11b, 0x23
lea rdi, [0x140192f40]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x1400e2354
cmp rdx, 2
jb 0x1400e2354
cmp byte [r10], r11b
jne 0x1400e2354
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x1400e2332
jmp 0x1400e23ab
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x1400e23ab
mov r11b, 0x23
lea rdi, [0x140192f40]
cmp dl, r11b
jne 0x1400e238f
cmp byte [r10], r11b
jne 0x1400e238f
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x1400e237d
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x1400e24e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x1400e2500
and qword [r8], 0
lea rdx, [0x1401ef064]
call fcn.1400e23bc
mov rbx, rax
test rax, rax
je 0x1400e25f1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1400e25e8
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400e25e8
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1400e25e8
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400e25e8
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x1400e25e8
mov rax, qword [0x1402ae640]
test rax, rax
je 0x1400e2585
inc dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1400e25e8
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x1400e25d5
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1402ae640]
test rax, rax
je 0x1400e25ca
dec dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400e25f1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x1400e25e3
mov qword [rsi], rbp
mov rax, rdi
jmp 0x1400e25f3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e4be8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1401fb040]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsxd r8, dword [rcx + 0xf8]
mov r10d, 4
mov rax, qword [rcx + 0x100]
mov r9d, r10d
mov dword [rsp + 0x20], edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [rsp + 0x20]
not ebx
movzx eax, byte [r8]
inc r8
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x140192f40]
xor ebx, dword [rax + rcx*4]
sub r9, 1
jne 0x1400e4c24
mov rcx, qword [0x1402ae640]
not ebx
cmp dword [rcx + 0x3f00], ebx
jne 0x1400e4c62
movsxd r8, edx
mov ecx, ebx
mov edx, r10d
call fcn.1400f61ac
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14012c150
add rsp, 0x30
pop rbx
ret

Function at 0x1400e4c78
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401fb040]
xor rax, rsp
mov qword [rsp + 0x10], rax
movss xmm2, dword [rcx + 0x118]
lea r9, [rsp]
movss xmm3, dword [rcx + 0x11c]
mov r10d, 0x10
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
mov rax, qword [rcx + 0x100]
subss xmm1, xmm3
movsxd rcx, dword [rcx + 0xf8]
movss dword [rsp], xmm0
movss xmm0, dword [rdx + 8]
mov r8d, dword [rax + rcx*4 - 4]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
not r8d
movss xmm1, dword [rdx + 0xc]
subss xmm1, xmm3
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
movzx ecx, byte [r9]
lea rax, [0x140192f40]
movzx edx, r8b
inc r9
xor rdx, rcx
shr r8d, 8
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x1400e4cf5
not r8d
mov eax, r8d
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.14012c150
add rsp, 0x28
ret

Function at 0x1400f4e00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c60], 0
lea rbx, [rcx + 0x5c68]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400f4e99
mov r9d, dword [rbx + 4]
test r9d, r9d
jns 0x1400f4e51
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1400f7184
and dword [rbx], 0
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.1400e2f44
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c60]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x1402ae5ce]
movsxd r8, eax
mov rax, qword [rdi + 0x5c70]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x1400f4ea1
mov rcx, rbx
call fcn.1400e2f44
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f5554
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1402ae640]
mov rbx, rcx
and dword [rax + 0x5bc4], 0
test rcx, rcx
je 0x1400f55bd
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.1400f55c8
lea rdx, [0x1401efe08]
mov rcx, rbx
mov rdi, rax
call fcn.1400e23bc
mov rbx, rax
test rax, rax
je 0x1400f55bd
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140106f50
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401fb040]
xor rax, rsp
mov qword [rbp - 8], rax
mov rcx, qword [0x1402e44f0]
lea rdx, [rbp - 0x28]
mov rdi, qword [0x1402ae640]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp - 0x20]
lea rcx, [rbp - 0x10]
sub eax, dword [rbp - 0x28]
and qword [rbp - 0x10], 0
movd xmm1, eax
mov eax, dword [rbp - 0x1c]
sub eax, dword [rbp - 0x24]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x10], xmm1
movss dword [rdi + 0x14], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp - 0x10]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [0x1402e44f8]
cvtsi2ss xmm0, qword [0x1402e4500]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x18], xmm1
mov qword [0x1402e44f8], rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov ecx, 0x10
mov byte [rdi + 0xe14], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, bl
mov byte [rdi + 0xe15], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
mov byte [rdi + 0xe17], 0
mov rbx, qword [0x1402ae640]
mov byte [rdi + 0xe16], al
cmp byte [rbx + 0xdb], 0
je 0x140107087
cvttss2si eax, dword [rbx + 0xdfc]
mov rcx, qword [0x1402e44f0]
lea rdx, [rbp - 0x18]
mov dword [rbp - 0x18], eax
cvttss2si eax, dword [rbx + 0xe00]
mov dword [rbp - 0x14], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x140107087
mov edx, dword [rbp - 0x14]
mov ecx, dword [rbp - 0x18]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, 0xff7fffff
mov dword [rbx + 0xdfc], eax
mov dword [rbx + 0xe00], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x1401070ff
mov rdx, qword [0x1402e44f0]
cmp rax, rdx
je 0x1401070bc
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x1401070ff
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1401070ff
mov rcx, qword [0x1402e44f0]
lea rdx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1401070ff
movd xmm0, dword [rbp - 0x30]
movd xmm1, dword [rbp - 0x2c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0xdfc], xmm0
movss dword [rbx + 0xe00], xmm1
cmp byte [rdi + 0x78], 0
je 0x14010710a
or eax, 0xffffffff
jmp 0x140107117
mov rax, qword [0x1402ae640]
mov eax, dword [rax + 0x4a6c]
cmp dword [0x1402ad36c], eax
je 0x14010712a
mov dword [0x1402ad36c], eax
call fcn.140106be8
call fcn.140106c94
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14012c150
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140125a90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140125ac0
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140125b38
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140125ad7
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140125ad9
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140125b32
test ecx, ecx
jle 0x140125b12
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140125b32
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140125b32
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140125b54
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140125b74
xor eax, eax
jmp 0x140125c5d
cmp qword [rcx + 0x68], 0
je 0x140125b86
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140125c5d
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140125b9d
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140125b9f
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140125bd1
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140125c57
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140125c08
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140125c32
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x140125c57
cmp rdi, rbx
ja 0x140125c0f
test rdi, rdi
je 0x140125c57
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret