joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140045360
Capabilities:
Encode data using xor

Disassembly:
mov r9, qword [rdx + 8]
mov r10, qword [rdx]
test r9, r9
je 0x1400453c7
nop dword [rax]
movzx edx, byte [r10]
lea r10, [r10 + 1]
xor edx, ecx
mov ecx, edx
shr edx, 4
and ecx, 0xf
imul eax, ecx, 0x4220000
imul r8d, ecx, 0x8840020
xor r8d, eax
imul eax, ecx, 0x11111044
xor r8d, edx
xor r8d, eax
mov edx, r8d
shr r8d, 4
and edx, 0xf
imul eax, edx, 0x4220000
imul ecx, edx, 0x8840020
xor ecx, eax
imul eax, edx, 0x11111044
xor ecx, eax
xor ecx, r8d
sub r9, 1
jne 0x140045370
mov eax, ecx
ret

Function at 0x140046e80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov r9d, ecx
lea rax, [0x1400c23e8]
rol r9d, 4
lea rbp, [0x1400c25e0]
xor r9d, r8d
mov r10d, ecx
xor r10d, edx
mov edx, r9d
mov r8d, r10d
shr r9d, 8
shr r10d, 8
and r9d, 0xfffcfffc
and edx, 0xfffcfffc
and r8d, 0xfffcfffc
and r10d, 0xfffcfffc
or r9d, 0xff00ff00
or edx, 0xff00ff00
or r8d, 0xff00ff00
or r10d, 0xff00ff00
xor r11d, r11d
mov ebx, r11d
mov edi, r11d
mov esi, r11d
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [rax - 8]
lea rax, [rax + 0x10]
and ecx, edx
add edx, 0x80008
xor r11d, ecx
mov ecx, dword [rax - 0x14]
and ecx, r9d
add r9d, 0x80008
xor ebx, ecx
mov ecx, dword [rax - 0x10]
and ecx, r8d
add r8d, 0x80008
xor edi, ecx
mov ecx, dword [rax - 0xc]
and ecx, r10d
add r10d, 0x80008
xor esi, ecx
lea rcx, [rax - 8]
cmp rcx, rbp
jb 0x140046f10
mov rbp, qword [rsp + 0x10]
and edx, 0x40004
imul edx, edx, 0x3c00
and r8d, 0x40004
imul eax, r8d, 0x3c00
and r9d, 0x40004
and r10d, 0x40004
imul ecx, r10d, 0x3c00
shr edx, 4
shr eax, 4
and edx, r11d
and eax, edi
shr r11d, 4
xor edx, r11d
shr edi, 4
xor eax, edi
shr edx, 4
mov rdi, qword [rsp + 0x20]
and eax, 0xf000f00
and edx, 0xf000f0
or edx, eax
imul eax, r9d, 0x3c00
shr edx, 4
shr eax, 4
and eax, ebx
shr ebx, 4
xor eax, ebx
mov rbx, qword [rsp + 8]
and eax, 0xf000f00
or edx, eax
mov eax, esi
shl eax, 4
and ecx, eax
xor ecx, esi
mov rsi, qword [rsp + 0x18]
and ecx, 0xf000f000
or edx, ecx
mov ecx, edx
shr ecx, 4
xor ecx, edx
and ecx, 0x7030702
mov eax, ecx
shl eax, 4
xor eax, ecx
xor edx, eax
mov ecx, edx
shr ecx, 8
xor ecx, edx
and ecx, 0x4e009e
mov eax, ecx
shl eax, 8
xor eax, ecx
xor edx, eax
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
and ecx, 0xd9d3
mov eax, ecx
shl eax, 0x10
xor eax, ecx
xor edx, eax
mov ecx, edx
shr ecx, 4
xor ecx, edx
and ecx, 0x5040004
mov eax, ecx
shl eax, 4
xor eax, ecx
xor edx, eax
mov ecx, edx
shr ecx, 1
xor ecx, edx
and ecx, 0x4045015
lea eax, [rcx + rcx]
xor eax, ecx
xor eax, edx
ret
Function at 0x14004e3e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r8, qword [rcx + 0x10]
mov rsi, rdx
mov qword [rcx + 8], 0
mov rbx, rcx
mov r14d, 1
test r8, r8
je 0x14004e44d
xor ecx, ecx
sub r8, rcx
mov r9, rsi
add rcx, qword [rbx]
mov rdx, r14
call fcn.1400915d8
mov rcx, rsi
mov rdi, rax
call fcn.14009c61c
test eax, eax
jne 0x14004e4a5
test rdi, rdi
je 0x14004e44d
mov rcx, qword [rbx + 8]
add rcx, rdi
mov qword [rbx + 8], rcx
mov r8, qword [rbx + 0x10]
cmp rcx, r8
jb 0x14004e414
mov rax, qword [rbx + 0x10]
xor edi, edi
cmp qword [rbx + 8], rax
jne 0x14004e468
mov rcx, rsi
call fcn.14009c68c
cmp eax, 0xffffffff
cmovne edi, r14d
mov rcx, qword [rbx]
mov eax, edi
mov rdx, qword [rbx + 8]
add rbx, 0x18
mov qword [rbx], rcx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 8], 0
mov dword [rbx + 0x18], 0
mov qword [rbx + 0x20], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov eax, 2
jmp 0x14004e48f
Function at 0x140051c90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x14011e258]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, r9
movsxd rbx, r8d
mov r13, rdx
mov r15, rcx
xor r14d, r14d
call qword [rcx]
mov rsi, rax
test rax, rax
je 0x140051cd6
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 8]
mov ebp, dword [rsp + 0x120]
test ebp, ebp
jle 0x140051e46
mov qword [rsp + 0xb8], r12
mov r12, rbx
mov rbx, qword [r15 + 0x28]
mov rcx, rsi
mov eax, ebp
cmp rax, rbx
mov rax, qword [rsi]
cmovbe ebx, ebp
call qword [rax + 8]
mov rcx, qword [rsi + 8]
mov r8, r12
mov rdx, r13
call fcn.140011830
mov rcx, qword [rsi + 8]
mov edx, r14d
call fcn.140011a10
mov rax, qword [rsi]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [rax + 0x18]
xor r9d, r9d
inc r14d
test ebx, ebx
jle 0x140051dfc
cmp ebx, 0x40
jb 0x140051dfc
lea eax, [rbx - 1]
movsxd rcx, eax
lea rax, [rsp + 0x20]
add rax, rcx
lea rdx, [rcx + rdi]
cmp rdi, rax
ja 0x140051d6a
lea rax, [rsp + 0x20]
cmp rdx, rax
jae 0x140051dfc
mov ecx, ebx
and ecx, 0x8000003f
jge 0x140051d7b
dec ecx
or ecx, 0xffffffc0
inc ecx
mov eax, ebx
lea rdx, [rsp + 0x30]
sub eax, ecx
lea rcx, [rsp + 0x20]
sub rcx, rdi
movsxd r8, eax
sub rdx, rdi
lea rax, [rdi + 0x20]
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x20]
add r9, 0x40
movdqu xmm1, xmmword [rcx + rax - 0x20]
movdqu xmm2, xmmword [rcx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x60], xmm1
movdqu xmm0, xmmword [rax - 0x50]
movdqu xmm1, xmmword [rdx + rax - 0x60]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [rdx + rax - 0x40]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
cmp r9, r8
jl 0x140051da0
movsxd r10, ebx
cmp r9, r10
jge 0x140051e31
lea r8, [rsp + 0x20]
mov rdx, r10
sub r8, rdi
lea rax, [r9 + rdi]
sub rdx, r9
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140051e20
add rdi, r10
sub ebp, ebx
test ebp, ebp
jg 0x140051cf0
mov r12, qword [rsp + 0xb8]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x20]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14008ce70
add rsp, 0xc0
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140052810
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rcx + 8]
jmp fcn.140016cd0
Function at 0x140054b00
Capabilities:
Hash data using sha1 via x86 extensions

Disassembly:
sub rsp, 0x38
movdqa xmm4, xmmword [0x1400bfed0]
movdqu xmm5, xmmword [rdx]
movdqu xmm0, xmmword [rcx + 0x10]
movdqu xmm1, xmmword [rcx]
pshufb xmm5, xmm4
movaps xmmword [rsp + 0x20], xmm6
movdqu xmm6, xmmword [rdx + 0x10]
paddd xmm0, xmm5
movaps xmmword [rsp + 0x10], xmm7
movdqu xmm7, xmmword [rdx + 0x30]
sha1rnds4 xmm1, xmm0, 0
movdqu xmm0, xmmword [rcx]
movdqa xmm2, xmm1
pshufb xmm7, xmm4
pshufb xmm6, xmm4
movaps xmmword [rsp], xmm8
movdqu xmm8, xmmword [rdx + 0x20]
sha1nexte xmm0, xmm6
sha1rnds4 xmm2, xmm0, 0
pshufb xmm8, xmm4
sha1msg1 xmm5, xmm6
sha1nexte xmm1, xmm8
sha1msg1 xmm6, xmm8
movdqa xmm3, xmm2
movdqa xmm4, xmm8
sha1rnds4 xmm3, xmm1, 0
sha1nexte xmm2, xmm7
sha1msg1 xmm8, xmm7
pxor xmm4, xmm5
movdqa xmm0, xmm3
sha1rnds4 xmm0, xmm2, 0
sha1msg2 xmm4, xmm7
sha1nexte xmm3, xmm4
pxor xmm8, xmm4
movdqa xmm1, xmm0
sha1rnds4 xmm1, xmm3, 0
movdqa xmm5, xmm7
movdqa xmm2, xmm1
sha1msg1 xmm7, xmm4
pxor xmm5, xmm6
sha1msg2 xmm5, xmm4
sha1nexte xmm0, xmm5
sha1rnds4 xmm2, xmm0, 1
sha1msg2 xmm8, xmm5
sha1nexte xmm1, xmm8
sha1msg1 xmm4, xmm5
movdqa xmm0, xmm2
pxor xmm7, xmm5
sha1rnds4 xmm0, xmm1, 1
sha1msg2 xmm7, xmm8
sha1nexte xmm2, xmm7
movdqa xmm1, xmm0
movdqa xmm3, xmm8
pxor xmm3, xmm4
movdqa xmm4, xmm7
sha1msg2 xmm3, xmm7
sha1rnds4 xmm1, xmm2, 1
sha1nexte xmm0, xmm3
sha1msg1 xmm5, xmm8
sha1msg1 xmm8, xmm7
movdqa xmm2, xmm1
pxor xmm4, xmm5
sha1msg2 xmm4, xmm3
sha1rnds4 xmm2, xmm0, 1
sha1nexte xmm1, xmm4
sha1msg1 xmm7, xmm3
pxor xmm8, xmm3
movdqa xmm0, xmm2
sha1msg2 xmm8, xmm4
sha1rnds4 xmm0, xmm1, 1
sha1msg1 xmm3, xmm4
pxor xmm7, xmm4
movdqa xmm1, xmm0
sha1msg2 xmm7, xmm8
movdqa xmm6, xmm8
sha1nexte xmm2, xmm8
pxor xmm6, xmm3
sha1rnds4 xmm1, xmm2, 2
sha1msg1 xmm4, xmm8
sha1msg2 xmm6, xmm7
sha1nexte xmm0, xmm7
sha1msg1 xmm8, xmm7
movdqa xmm2, xmm1
movdqa xmm5, xmm7
sha1rnds4 xmm2, xmm0, 2
sha1nexte xmm1, xmm6
movdqa xmm0, xmm2
pxor xmm8, xmm6
sha1rnds4 xmm0, xmm1, 2
movdqa xmm3, xmm0
pxor xmm5, xmm4
sha1msg1 xmm7, xmm6
sha1msg2 xmm5, xmm6
sha1nexte xmm2, xmm5
sha1rnds4 xmm3, xmm2, 2
sha1msg2 xmm8, xmm5
sha1nexte xmm0, xmm8
pxor xmm7, xmm5
movdqa xmm1, xmm3
sha1rnds4 xmm1, xmm0, 2
sha1msg2 xmm7, xmm8
sha1nexte xmm3, xmm7
movdqa xmm4, xmm8
movdqa xmm2, xmm1
sha1rnds4 xmm2, xmm3, 3
movdqa xmm3, xmm7
movdqa xmm0, xmm2
sha1msg1 xmm6, xmm5
sha1msg1 xmm5, xmm8
sha1msg1 xmm8, xmm7
pxor xmm4, xmm6
pxor xmm3, xmm5
movaps xmm6, xmmword [rsp + 0x20]
sha1msg2 xmm4, xmm7
sha1nexte xmm1, xmm4
sha1rnds4 xmm0, xmm1, 3
movdqa xmm1, xmm0
pxor xmm8, xmm4
sha1msg2 xmm3, xmm4
sha1nexte xmm2, xmm3
sha1rnds4 xmm1, xmm2, 3
sha1msg2 xmm8, xmm3
sha1nexte xmm0, xmm8
sha1msg1 xmm7, xmm4
movdqa xmm2, xmm1
pxor xmm7, xmm3
sha1rnds4 xmm2, xmm0, 3
sha1msg2 xmm7, xmm8
movaps xmm8, xmmword [rsp]
movdqa xmm0, xmm2
sha1nexte xmm2, xmmword [rcx + 0x10]
sha1nexte xmm1, xmm7
movaps xmm7, xmmword [rsp + 0x10]
sha1rnds4 xmm0, xmm1, 3
paddd xmm0, xmmword [rcx]
movdqu xmmword [rcx], xmm0
movdqu xmmword [rcx + 0x10], xmm2
add rsp, 0x38
ret
Function at 0x140068ae0
Capabilities:
Inspect section memory permissions

Disassembly:
sub rsp, 0x38
mov eax, dword [rcx + 0x178]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x30], rdi
xor edi, edi
test edx, edx
mov qword [rsp + 0x28], r14
mov ebp, edi
mov qword [rsp + 0x20], r15
cmovns ebp, edx
mov r14d, r9d
test r8d, r8d
cmovns edi, r8d
cmp r9d, eax
jl 0x140068b1f
lea r14d, [rax - 1]
mov edx, dword [rcx + 0x174]
mov eax, dword [rsp + 0x60]
cmp eax, edx
jl 0x140068b30
lea eax, [rdx - 1]
movsxd rbx, edi
movsxd r15, eax
cmp rbx, r15
jg 0x140068c20
mov qword [rsp + 0x50], rsi
movsxd rsi, ebp
nop word [rax + rax]
cmp edi, dword [rcx + 0x174]
jge 0x140068c1b
mov rax, qword [rcx + 0x28]
mov rdx, qword [rax + rbx*8]
test byte [rdx], 3
jne 0x140068bb6
movsxd r11, r14d
mov r8d, ebp
mov r10, rsi
cmp rsi, r11
jg 0x140068c0d
lea r9, [rsi + rsi*4]
shl r9, 2
cmp r8d, dword [rcx + 0x178]
jge 0x140068c0d
mov rax, qword [rcx + 0x28]
inc r8d
inc r10
mov rdx, qword [rax + rbx*8]
mov rax, qword [rdx + 0x18]
or dword [rax + r9 + 4], 0x3ffff
add r9, 0x14
cmp r10, r11
jle 0x140068b83
jmp 0x140068c0d
mov eax, ebp
cdq
sub eax, edx
sar eax, 1
movsxd r8, eax
mov eax, r14d
cdq
mov r10, r8
sub eax, edx
sar eax, 1
inc eax
movsxd r11, eax
cmp r8, r11
jg 0x140068c0d
lea r9, [r8 + r8*4]
shl r9, 2
nop dword [rax]
cmp r8d, dword [rcx + 0x178]
jge 0x140068c0d
mov rax, qword [rcx + 0x28]
inc r8d
inc r10
mov rdx, qword [rax + rbx*8]
mov rax, qword [rdx + 0x18]
or dword [rax + r9 + 4], 0x3ffff
add r9, 0x14
cmp r10, r11
jle 0x140068be0
inc edi
inc rbx
cmp rbx, r15
jle 0x140068b50
mov rsi, qword [rsp + 0x50]
cmp byte [rsp + 0x68], 0
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
je 0x140068c49
add rsp, 0x38
jmp fcn.14005f230
add rsp, 0x38
jmp fcn.1400696c0
Function at 0x14006bfc0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14011e258]
xor rax, rsp
mov qword [rsp + 0x10], rax
xor r10d, r10d
mov r11, rdx
mov r9d, r10d
nop dword [rax]
movsx r8d, byte [r9 + rcx]
lea eax, [r8 - 0x41]
cmp al, 0x19
ja 0x14006bff3
lea eax, [r8 - 0x41]
jmp 0x14006c038
lea eax, [r8 - 0x61]
cmp al, 0x19
ja 0x14006c001
lea eax, [r8 - 0x47]
jmp 0x14006c038
lea eax, [r8 - 0x30]
cmp al, 9
ja 0x14006c00f
lea eax, [r8 + 4]
jmp 0x14006c038
cmp r8b, 0x2b
jne 0x14006c01c
mov eax, 0x3e
jmp 0x14006c038
cmp r8b, 0x2f
jne 0x14006c029
mov eax, 0x3f
jmp 0x14006c038
cmp r8b, 0x3d
jne 0x14006c0c6
mov eax, 0xffffffff
mov dword [rsp + r9*4], eax
inc r9
cmp r9, 4
jl 0x14006bfe0
mov edx, dword [rsp]
cmp edx, 0xffffffff
je 0x14006c0c6
mov r8d, dword [rsp + 4]
cmp r8d, 0xffffffff
je 0x14006c0c6
mov ecx, dword [rsp + 8]
mov eax, dword [rsp + 0xc]
cmp ecx, 0xffffffff
jne 0x14006c06f
cmp eax, ecx
jne 0x14006c0c6
lea r10d, [rcx + 2]
jmp 0x14006c07a
cmp eax, 0xffffffff
setne r10b
add r10d, 2
shl edx, 6
and eax, 0x3f
or edx, r8d
and ecx, 0x3f
shl edx, 6
or edx, ecx
shl edx, 6
or edx, eax
mov eax, edx
shr eax, 0x10
mov byte [r11], al
cmp r10d, 1
jbe 0x14006c0a7
mov ecx, edx
shr ecx, 8
mov byte [r11 + 1], cl
cmp r10d, 2
jbe 0x14006c0b1
mov byte [r11 + 2], dl
mov eax, r10d
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.14008ce70
add rsp, 0x28
ret
xor eax, eax
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.14008ce70
add rsp, 0x28
ret

Function at 0x14006cea0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rdx
test r8, r8
je 0x14006cec7
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor edx, eax
or r9d, edx
sub r8, 1
jne 0x14006ceb0
mov eax, 0x100
sub eax, r9d
cmp eax, 0x100
setae al
ret

Function at 0x14006d790
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
cmp r9, 4
jb 0x14006d7ec
mov qword [rsp + 0x30], r14
mov r14d, 4
sub r14, rdx
mov rcx, rbp
call fcn.14006da50
mov eax, dword [rbp + 0x2004]
xor eax, dword [rbx]
add rbx, 4
mov dword [rdi], eax
add rdi, 4
lea rax, [r14 + rbx]
cmp rax, rsi
jbe 0x14006d7c4
mov r14, qword [rsp + 0x30]
and esi, 3
je 0x14006d827
mov rcx, rbp
call fcn.14006da50
xor edx, edx
test rsi, rsi
je 0x14006d827
mov ecx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rbp + 0x2004]
inc edx
xor al, byte [rcx + rbx]
mov byte [rcx + rdi], al
mov ecx, edx
cmp rcx, rsi
jb 0x14006d810
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14006d8b0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x2830
call fcn.14008cea0
sub rsp, rax
mov rax, qword [0x14011e258]
xor rax, rsp
mov qword [rsp + 0x2820], rax
mov eax, dword [r8]
lea r11, [rsp + 0x60]
movups xmm0, xmmword [rdx]
mov dword [rsp + 0x40], eax
mov rdi, rcx
mov eax, dword [r8 + 4]
lea r9, [rsp + 0x58]
movups xmm1, xmmword [rdx + 0x10]
mov dword [rsp + 0x44], eax
mov r10d, 0x10
mov eax, dword [r8 + 8]
mov dword [rsp + 0x48], eax
mov eax, dword [r8 + 0xc]
mov dword [rsp + 0x4c], eax
mov eax, dword [r8 + 0x10]
mov dword [rsp + 0x50], eax
mov eax, dword [r8 + 0x14]
mov dword [rsp + 0x54], eax
mov eax, dword [r8 + 0x18]
mov dword [rsp + 0x58], eax
mov eax, dword [r8 + 0x1c]
mov dword [rsp + 0x5c], eax
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm1
nop dword [rax + rax]
mov ecx, dword [r9 - 0x34]
mov r8d, ecx
mov edx, dword [r9]
lea r9, [r9 + 4]
rol r8d, 0xe
lea r11, [r11 + 4]
mov eax, ecx
shr ecx, 3
ror eax, 7
xor r8d, eax
mov eax, edx
xor r8d, ecx
rol eax, 0xd
mov ecx, edx
shr edx, 0xa
rol ecx, 0xf
xor ecx, eax
xor ecx, edx
add r8d, ecx
add r8d, dword [r9 - 0x3c]
add r8d, dword [r9 - 0x18]
add r8d, r10d
inc r10d
mov dword [r11 - 4], r8d
cmp r10d, 0xa00
jb 0x14006d940
lea rcx, [rsp + 0x181c]
lea rax, [rdi + 0xffc]
cmp rdi, rcx
ja 0x14006d9ce
lea rcx, [rsp + 0x820]
cmp rax, rcx
jb 0x14006d9ce
mov ebx, 0x1000
lea rdx, [rsp + 0x820]
mov r8d, ebx
mov rcx, rdi
call fcn.14008dc80
jmp 0x14006d9e6
mov ebx, 0x1000
lea rdx, [rsp + 0x820]
mov r8d, ebx
mov rcx, rdi
call fcn.14008dc80
lea rdx, [rdi + 0x1004]
mov r8d, 0x200
lea rax, [rsp + 0x1824]
nop dword [rax + rax]
mov ecx, dword [rax - 4]
lea rax, [rax + 8]
mov dword [rdx - 4], ecx
lea rdx, [rdx + 8]
mov ecx, dword [rax - 8]
mov dword [rdx - 8], ecx
sub r8, 1
jne 0x14006da00
mov dword [rdi + 0x2000], r8d
mov rcx, rdi
call fcn.14006da50
sub rbx, 1
jne 0x14006da21
mov rcx, qword [rsp + 0x2820]
xor rcx, rsp
call fcn.14008ce70
mov rbx, qword [rsp + 0x2848]
add rsp, 0x2830
pop rdi
ret
Function at 0x14006de40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
mov r9, qword [rcx]
movabs rax, 0xffffffff00000000
xor edi, edi
mov r14, rcx
movzx ebx, word [r9 + 0x14]
mov rsi, qword [r9 + 0x30]
add rbx, 0x28
and rsi, rax
cmp di, word [r9 + 6]
jae 0x14006df3b
mov qword [rsp + 0x48], r15
add rbx, r9
lea r15, [0x14011e1e0]
nop dword [rax]
mov r10d, dword [rbx + 0x14]
mov eax, dword [rbx]
bt r10d, 0x19
jae 0x14006deb3
mov ecx, dword [rbx - 8]
mov edx, eax
or rcx, rsi
mov r8d, 0x4000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14006df20
mov rdx, r10
mov rcx, r10
shr rcx, 0x1e
and ecx, 1
shr rdx, 0x1d
and edx, 1
lea rdx, [rcx + rdx*2]
mov rcx, r10
shr rcx, 0x1f
lea rdx, [rcx + rdx*2]
mov ecx, r10d
mov r11d, dword [r15 + rdx*4]
bts r11d, 9
and ecx, 0x4000000
cmove r11d, dword [r15 + rdx*4]
test eax, eax
jne 0x14006df0a
test r10b, 0x40
je 0x14006defd
mov eax, dword [r9 + 0x20]
jmp 0x14006df06
test r10b, r10b
jns 0x14006df20
mov eax, dword [r9 + 0x24]
test eax, eax
je 0x14006df20
mov ecx, dword [rbx - 8]
lea r9, [rsp + 0x40]
or rcx, rsi
mov edx, eax
mov r8d, r11d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r9, qword [r14]
inc edi
add rbx, 0x28
movzx eax, word [r9 + 6]
cmp edi, eax
jl 0x14006de90
mov r15, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14006e010
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x20
mov eax, 0x5a4d
mov r15, rdx
mov r14, rcx
cmp word [rcx], ax
jne 0x14006e18d
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
cmp dword [rsi], 0x4550
jne 0x14006e18d
mov edx, dword [rsi + 0x50]
mov r9d, 4
mov rcx, qword [rsi + 0x30]
mov r8d, 0x2000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
jne 0x14006e087
mov edx, dword [rsi + 0x50]
lea r9d, [rax + 4]
xor ecx, ecx
mov r8d, 0x2000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x14006e18d
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, 0x1000
mov rcx, rbp
mov rdi, rax
mov qword [rax + 8], rbp
xor eax, eax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x10], rax
mov edx, dword [rsi + 0x50]
lea r9d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [rsi + 0x54]
mov r9d, 4
mov r8d, 0x1000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsi + 0x54]
mov rdx, r14
add r8d, dword [r14 + 0x3c]
mov rcx, rax
mov rbx, rax
call fcn.14008dc80
movsxd rax, dword [r14 + 0x3c]
mov r8, rdi
add rax, rbx
mov rdx, rsi
mov qword [rdi], rax
mov rcx, r14
mov qword [rax + 0x30], rbp
call fcn.14006dd50
mov rbx, qword [rsp + 0x40]
mov rdx, rbp
sub rdx, qword [rsi + 0x30]
je 0x14006e12d
mov rcx, rdi
call fcn.14006e1a0
mov rcx, rdi
call fcn.14006dbe0
test eax, eax
je 0x14006e181
mov rcx, rdi
call fcn.14006de40
mov rax, qword [rdi]
mov ecx, dword [rax + 0x28]
test ecx, ecx
je 0x14006e16a
mov eax, ecx
add rax, rbp
je 0x14006e181
mov r8, r15
mov edx, 1
mov rcx, rbp
call rax
test eax, eax
je 0x14006e181
mov dword [rdi + 0x1c], 1
mov rax, rdi
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov rcx, rdi
call fcn.14006df50
xor eax, eax
jmp 0x14006e16d
mov rbp, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop rsi
ret

Function at 0x140075030
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [0x140123478]
lea r9, [fcn.14000f120]
xor r8d, r8d
mov qword [rsp + 0x20], 0
lea edx, [r8 + 0x6f]
call qword [sym.imp.USER32.dll_CreateDialogParamA]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetActiveWindow]
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp qword [sym.imp.USER32.dll_DestroyWindow]
Function at 0x140077b80
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp dword [0x14011fc58], 0
je 0x140077b9e
xor eax, eax
cmp qword [0x14011fc40], rax
setne al
add rsp, 0x28
ret
mov qword [rsp + 0x20], rbx
call fcn.140077d00
lea rcx, str.USER32
mov dword [0x14011fc5c], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x140077cac
lea rdx, [0x1400cb220]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14011fc20], rax
test rax, rax
je 0x140077cac
lea rdx, str.MonitorFromWindow
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14011fc28], rax
test rax, rax
je 0x140077cac
lea rdx, str.MonitorFromRect
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14011fc30], rax
test rax, rax
je 0x140077cac
lea rdx, str.MonitorFromPoint
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14011fc38], rax
test rax, rax
je 0x140077cac
lea rdx, str.EnumDisplayMonitors
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14011fc48], rax
test rax, rax
je 0x140077cac
lea rdx, str.GetMonitorInfoA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14011fc40], rax
test rax, rax
je 0x140077cac
lea rdx, str.EnumDisplayDevicesA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14011fc50], rax
test rax, rax
je 0x140077cac
mov rbx, qword [rsp + 0x20]
mov eax, 1
mov dword [0x14011fc58], eax
add rsp, 0x28
ret
mov rbx, qword [rsp + 0x20]
xor eax, eax
mov qword [0x14011fc20], rax
mov qword [0x14011fc28], rax
mov qword [0x14011fc30], rax
mov qword [0x14011fc38], rax
mov qword [0x14011fc40], rax
mov qword [0x14011fc48], rax
mov qword [0x14011fc50], rax
mov dword [0x14011fc58], 1
add rsp, 0x28
ret
Function at 0x14007e3d0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rcx, str.user32.dll
call fcn.140082e60
lea rcx, str.winmm.dll
mov rbx, rax
call fcn.140082e60
lea rcx, str.shcore.dll
mov rdi, rax
call fcn.140082e60
mov rsi, rax
test rbx, rbx
je 0x14007e43a
lea rdx, str.FlashWindowEx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ToUnicodeEx
mov rcx, rbx
mov qword [0x140120fe0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x14007e447
mov qword [0x140120fe0], 0
xor eax, eax
mov qword [0x140120fe8], rax
test rdi, rdi
je 0x14007e465
lea rdx, str.PlaySoundA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x14007e467
xor eax, eax
mov qword [0x140120ed0], rax
test rsi, rsi
je 0x14007e485
lea rdx, str.GetDpiForMonitor
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x14007e487
xor eax, eax
mov qword [0x140120f58], rax
test rbx, rbx
je 0x14007e4d1
lea rdx, str.GetSystemMetricsForDpi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.AdjustWindowRectExForDpi
mov rcx, rbx
mov qword [0x140120f60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140120f68], rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov qword [0x140120f60], 0
mov qword [0x140120f68], 0
add rsp, 0x20
pop rdi
ret

Function at 0x14007e500
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x138
mov rax, qword [0x14011e258]
xor rax, rsp
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x14007e553
test byte [rsp + 0x32], 0x80
jne 0x14007e539
test byte [rsp + 0xc5], 0x80
je 0x14007e553
mov al, 1
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14008ce70
add rsp, 0x138
ret
xor al, al
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14008ce70
add rsp, 0x138
ret

Function at 0x14007f100
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14011e258]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx ecx, cx
lea r8, [rsp + 0x20]
mov r9d, 0x14
mov edx, 0x1004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea rcx, [rsp + 0x20]
call fcn.140092510
mov dword [0x140120ee8], eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008ce70
add rsp, 0x48
ret