joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003b91c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
cmp qword [rdx + 0x18], 8
mov r9, qword [rdx + 0x10]
jb 0x14003b933
mov rdx, qword [rdx]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
add r9, r9
je 0x14003b963
movzx eax, byte [rdx + r8]
movabs r10, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, r10
cmp r8, r9
jb 0x14003b945
mov rax, rcx
mov edx, 0x1f31d
shr rax, 0x20
xor ecx, eax
btr ecx, 0x1f
call qword [sym.imp.msvcrt.dll_ldiv]
mov qword [rsp + 0x30], rax
shr rax, 0x20
imul ecx, eax, 0x41a7
imul eax, dword [rsp + 0x30], 0xb14
sub ecx, eax
jns 0x14003b99c
add ecx, 0x7fffffff
movsxd rax, ecx
add rsp, 0x28
ret

Function at 0x14003ffbc
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edx, dword [rcx + 0x7c]
xor al, al
mov rbx, rcx
cmp edx, 0xffffffff
je 0x140040163
mov ecx, edx
cmp ecx, 0x7c
je 0x140040163
cmp ecx, 0x29
jne 0x140040005
cmp dword [rbx + 0x1c], 0
jne 0x140040163
cmp ecx, ecx
jne 0x140040005
test dword [rbx + 0x80], 0x10000000
je 0x140040184
cmp ecx, 0x2e
jne 0x140040025
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.14004029c
mov rcx, rbx
call fcn.14003ff58
jmp 0x14004014b
cmp ecx, 0x5c
jne 0x14004008c
mov rcx, rbx
call fcn.14003ff58
test byte [rbx + 0x80], 0x80
je 0x14004007f
cmp word [rbx + 0x78], 0x62
jne 0x14004005d
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.14004029c
mov rcx, rbx
call fcn.14003ff58
jmp 0x140040153
cmp word [rbx + 0x78], 0x42
jne 0x14004007f
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.14004029c
mov rax, qword [rbx + 0x48]
add rax, 0xc
xor dword [rax], 1
jmp 0x140040050
mov rcx, rbx
call fcn.1400406d8
jmp 0x14004014b
cmp ecx, 0x5b
jne 0x1400400b0
mov rcx, rbx
call fcn.14003ff58
mov rcx, rbx
call fcn.140040570
cmp dword [rbx + 0x7c], 0x5d
jne 0x14004016e
jmp 0x140040018
cmp ecx, 0x28
jne 0x1400400d4
mov rcx, rbx
call fcn.14003ff58
mov rcx, rbx
call fcn.140040844
cmp dword [rbx + 0x7c], 0x29
mov dil, al
jne 0x140040179
jmp 0x14004013e
cmp ecx, 0x5e
jne 0x1400400e1
lea edx, [rcx - 0x5c]
jmp 0x140040047
cmp ecx, 0x24
jne 0x1400400ee
lea edx, [rcx - 0x21]
jmp 0x140040047
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x1400401a5
cmp ecx, 0x3f
je 0x1400401a5
cmp ecx, 0x7b
je 0x1400401a5
cmp edx, 0x7d
jne 0x14004011d
test dword [rbx + 0x80], 0x10000000
je 0x14004018f
cmp edx, 0x5d
jne 0x14004012e
test dword [rbx + 0x80], 0x10000000
je 0x14004019a
movzx edx, word [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.140040a30
mov dil, 1
mov rcx, rbx
call fcn.14003ff58
test dil, dil
je 0x140040153
mov rcx, rbx
call fcn.140040930
mov edx, dword [rbx + 0x7c]
mov al, 1
mov ecx, edx
cmp edx, 0xffffffff
jne 0x14003ffd9
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 4
call fcn.14003fb1c
int3
mov edx, 5
call fcn.14003fb1c
int3
mov edx, 5
call fcn.14003fb1c
int3
mov edx, 6
call fcn.14003fb1c
int3
mov edx, 4
call fcn.14003fb1c
int3
mov edx, 0xa
call fcn.14003fb1c
int3
Function at 0x140043284
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov rsi, rdx
mov r15, rcx
xor ebp, ebp
mov r12d, 0x811c9dc5
mov r14, qword [rdx + 0x10]
movabs rax, 0xcccccccccccccccd
mul r14
mov rdi, rdx
shr rdi, 3
inc rdi
test r14, r14
je 0x140043361
mov cl, 1
call fcn.140093638
mov qword [rsp + 0x60], rax
cmp qword [rsi + 0x18], 8
jb 0x1400432ee
mov rax, qword [rsi]
jmp 0x1400432f1
mov rax, rsi
movzx ebx, word [rax + rbp*2]
lea rcx, [rsp + 0x60]
call fcn.140006240
mov r8, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x40]
movzx edx, bx
mov rcx, r8
call qword [str.__a_v_]
movzx ecx, ax
imul r12, r12, 0x1000193
xor r12, rcx
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140043355
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.__a_v_]
mov r8, rax
test rax, rax
je 0x140043355
mov rcx, qword [rax]
mov rax, qword [rcx]
mov edx, 1
mov rcx, r8
call qword [str.__a_v_]
add rbp, rdi
cmp rbp, r14
jb 0x1400432d6
mov rdx, qword [r15 + 0x28]
mov rax, rdx
and rax, r12
cmp qword [r15 + 0x30], rax
ja 0x14004337e
shr rdx, 1
or rcx, 0xffffffffffffffff
sub rcx, rdx
add rax, rcx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400afadc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x14011cc18], rbx
je 0x1400afb28
cmp rax, rbx
jne 0x1400afb1b
mov ebx, 1
mov esi, ebx
jmp 0x1400afb2d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400afb00
mov ebx, 1
mov eax, dword [0x14011cc20]
cmp eax, ebx
jne 0x1400afb43
mov ecx, 0x1f
call fcn.1401b4000
jmp 0x1400afba8
mov eax, dword [0x14011cc20]
test eax, eax
jne 0x1400afba2
mov dword [0x14011cc20], ebx
lea r15, [0x1400c5768]
lea rdi, [0x1400c5750]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400afb94
test eax, eax
jne 0x1400afb98
cmp qword [rdi], 0
je 0x1400afb89
mov rax, qword [rdi]
mov rcx, qword [str.__a_v_]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400afb6a
test eax, eax
je 0x1400afba8
mov eax, 0xff
jmp 0x1400afc84
mov dword [0x14011b398], ebx
mov eax, dword [0x14011cc20]
cmp eax, ebx
jne 0x1400afbcf
lea rdx, [0x1400c5748]
lea rcx, [0x1400c51a8]
call sub.msvcrt.dll__initterm
mov dword [0x14011cc20], 2
test esi, esi
jne 0x1400afbdc
xor eax, eax
xchg qword [0x14011cc18], rax
cmp qword [0x14011cc38], 0
je 0x1400afc10
lea rcx, [0x14011cc38]
call fcn.1400b01a0
test eax, eax
je 0x1400afc10
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14011cc38]
mov r9, qword [str.__a_v_]
call r9
mov r8, qword [0x14011b3b0]
mov rdx, qword [0x14011b3a8]
mov ecx, dword [0x14011b3a0]
call fcn.14000345c
mov dword [0x14011b394], eax
cmp dword [0x14011b3b8], 0
jne 0x1400afc40
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14011b398], 0
jne 0x1400afc55
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14011b394]
jmp 0x1400afc84
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400b0220
add rsp, 0x28
jmp 0x1400afadc

Function at 0x1400b00b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400b00fc
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400b00f4
cmp dword [rcx + 0x3c], edx
jl 0x1400b00f4
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400b00f4
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400b00fc
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14000fa90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss dword [rsp + 0x20], xmm3
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, qword [rsp + 0x80]
call fcn.140004fa0
mov eax, dword [rsp + 0x88]
and eax, 1
test eax, eax
je 0x14000fb69
mov edx, dword [rsp + 0x90]
mov ecx, reloc.WS2_32.dll_sendto
call fcn.14000fd50
movss dword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, reloc.WS2_32.dll_send
call fcn.14000fd50
movss xmm1, dword [rsp + 0x20]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x28], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, reloc.WS2_32.dll_select
call fcn.14000fd50
movss dword [rsp + 0x24], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, reloc.WS2_32.dll_recvfrom
call fcn.14000fd50
movss xmm1, dword [rsp + 0x24]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x2c], xmm0
movss xmm2, dword [rsp + 0x28]
movss xmm1, dword [rsp + 0x2c]
lea rcx, [rsp + 0x50]
call fcn.140004fa0
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.140005c30
mov eax, dword [rsp + 0x88]
and eax, 2
test eax, eax
je 0x14000fc17
mov edx, dword [rsp + 0x90]
mov ecx, 7
call fcn.14000fd50
movss dword [rsp + 0x30], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 6
call fcn.14000fd50
movss xmm1, dword [rsp + 0x30]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x38], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 5
call fcn.14000fd50
movss dword [rsp + 0x34], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 4
call fcn.14000fd50
movss xmm1, dword [rsp + 0x34]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x3c], xmm0
movss xmm2, dword [rsp + 0x38]
movss xmm1, dword [rsp + 0x3c]
lea rcx, [rsp + 0x58]
call fcn.140004fa0
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.140005c30
mov eax, dword [rsp + 0x88]
and eax, 4
test eax, eax
je 0x14000fcc5
mov edx, dword [rsp + 0x90]
mov ecx, listen
call fcn.14000fd50
movss dword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 0xa
call fcn.14000fd50
movss xmm1, dword [rsp + 0x40]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x48], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 9
call fcn.14000fd50
movss dword [rsp + 0x44], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 8
call fcn.14000fd50
movss xmm1, dword [rsp + 0x44]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x4c], xmm0
movss xmm2, dword [rsp + 0x48]
movss xmm1, dword [rsp + 0x4c]
lea rcx, [rsp + 0x60]
call fcn.140004fa0
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.140005c30
movss xmm0, dword [rsp + 0x98]
ucomiss xmm0, dword [0x1400efe3c]
jp 0x14000fcd9
je 0x14000fd00
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.140012b70
movzx eax, al
test eax, eax
je 0x14000fd00
movss xmm1, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x80]
call fcn.140005be0
movss xmm0, dword [rsp + 0xa0]
ucomiss xmm0, dword [0x1400efe3c]
jp 0x14000fd14
je 0x14000fd3b
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.140012b70
movzx eax, al
test eax, eax
je 0x14000fd3b
movss xmm1, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x80]
call fcn.140005be0
mov rax, qword [rsp + 0x80]
add rsp, 0x78
ret
Function at 0x140010ed0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1400ef400]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x140010f5e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x140010f02
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x140010f70
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1400ef400]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x140011074
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x14001106f
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x140011044
cmp qword [rsp + 0x38], 2
jb 0x140011044
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140011044
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140011044
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140010fb7
jmp 0x140011106
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x140011106
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x1400110dc
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400110dc
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400110dc
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140011074
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x140041860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1424dea78]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x19d0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
movss xmm0, dword [rax + 0x19d8]
movss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x50]
movss xmm0, dword [rsp + 0x24]
divss xmm0, dword [rax + 0x14]
movss dword [rsp + 0x3c], xmm0
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, qword [rsp + 0x70]
call fcn.140004fa0
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x80]
cmp qword [rsp + 0x30], rax
jae 0x1400419ae
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xa
jne 0x140041970
movss xmm1, dword [rsp + 0x20]
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax]
call fcn.140002420
mov rax, qword [rsp + 0x70]
movss dword [rax], xmm0
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
movss dword [rax + 4], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0x98]
test eax, eax
je 0x14004196b
jmp 0x1400419ae
jmp 0x1400418e1
cmp dword [rsp + 0x28], 0xd
jne 0x14004197c
jmp 0x1400418e1
movzx edx, word [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.140040c30
mulss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x40], xmm0
movss xmm0, dword [rsp + 0x20]
addss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x20], xmm0
jmp 0x1400418e1
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [rax]
jbe 0x1400419cd
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rsp + 0x20]
movss dword [rax], xmm0
cmp qword [rsp + 0x90], 0
je 0x140041a09
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
movaps xmm2, xmm0
movss xmm1, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.140004fa0
mov rax, qword [rax]
mov rcx, qword [rsp + 0x90]
mov qword [rcx], rax
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [0x1400efe3c]
ja 0x140041a2d
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
ucomiss xmm0, dword [0x1400efe3c]
jp 0x140041a47
jne 0x140041a47
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
movss dword [rax + 4], xmm0
cmp qword [rsp + 0x88], 0
je 0x140041a62
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x14004e0d0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x68
call fcn.14000f8b0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x4c], 0
lea rdx, [rsp + 0x40]
mov rcx, qword [0x1424dec98]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x4c]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm0, eax
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x48]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm1, eax
movaps xmm2, xmm0
lea rcx, [rsp + 0x58]
call fcn.140004fa0
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 8], rax
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x1424deca0]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
cvtsi2ss xmm0, rax
cvtsi2ss xmm1, qword [0x1424deca8]
divss xmm0, xmm1
mov rax, qword [rsp + 0x20]
movss dword [rax + 0x10], xmm0
mov rax, qword [rsp + 0x50]
mov qword [0x1424deca0], rax
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14004e1b6
mov dword [rsp + 0x28], 1
jmp 0x14004e1be
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x28]
mov byte [rax + 0x138], cl
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14004e1ed
mov dword [rsp + 0x2c], 1
jmp 0x14004e1f5
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x2c]
mov byte [rax + 0x139], cl
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14004e224
mov dword [rsp + 0x30], 1
jmp 0x14004e22c
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x30]
mov byte [rax + 0x13a], cl
mov rax, qword [rsp + 0x20]
mov byte [rax + 0x13b], 0
call fcn.14004eaf0
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0xc0]
test eax, eax
je 0x14004e267
mov dword [rsp + 0x34], 0xffffffff
jmp 0x14004e270
call fcn.14000fa70
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
cmp dword [reloc.WS2_32.dll_htons], eax
je 0x14004e293
mov eax, dword [rsp + 0x38]
mov dword [reloc.WS2_32.dll_htons], eax
call fcn.14004e9c0
call fcn.14004e320
add rsp, 0x68
ret
Function at 0x14005fdf0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14005fe1b
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14005fe22
mov al, 1
jmp 0x14005ff7c
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.140066130
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.140066130
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x40]
call fcn.140066140
movzx eax, al
test eax, eax
je 0x14005fe79
xor al, al
jmp 0x14005ff7c
mov qword [rsp + 0x68], reloc.WLDAP32.dll_Ordinal_32
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14005fee9
cmp dword [rsp + 0x30], 1
je 0x14005fef5
cmp dword [rsp + 0x30], 3
je 0x14005ff6a
jmp 0x14005ff7a
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x14005ff41
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x14005ff41
xor al, al
jmp 0x14005ff7c
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14005ff5b
mov dword [rsp + 0x34], 1
jmp 0x14005ff63
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x14005ff7c
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14005ff7c
xor al, al
add rsp, 0xa8
ret
Function at 0x1400670c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x80], 0
jg 0x1400670e5
xor eax, eax
jmp 0x1400672ab
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x14006710e
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x1400672ab
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x1400671ad
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.14003f430
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.140049ab0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x14006729b
mov rcx, qword [rsp + 0x70]
call fcn.1400602d0
mov qword [rsp + 0x58], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x14006724e
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x14006724c
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x1400672ab
jmp 0x1400671d3
cmp qword [rsp + 0x20], 0
jbe 0x14006729b
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x68
ret