joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ffc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
xorps xmm15, xmm15
xor r14, r14
mov rax, qword [0x00657eb0]
mov rax, qword gs:[rax]
cmp rax, 0
je 0x47005b
mov r14, qword [rax]
sub rsp, 0x10
mov rax, rcx
mov rbx, rdx
call sym.runtime.sigtrampgo
add rsp, 0x10
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
pop rbp
ret

Function at 0x470280
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
mov rax, qword [0x00657eb0]
mov rax, qword gs:[rax]
cmp rax, 0
jne 0x470317
int 3
mov r14, qword [rax]
sub rsp, 0x28
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
call sym.runtime.sehhandler.abi0
mov eax, dword [rsp + 0x20]
add rsp, 0x28
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
add rsp, 0x28
pop rbp
ret
Function at 0x4706e0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x470714
mov rcx, 0x28
jmp 0x47071f
shl rcx, 3
add rcx, 0x1480
mov qword [0x00657eb0], rcx
pop rbp
ret

Function at 0x479940
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47a07f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x47996d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x479bf1
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x479c1d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x0054eac0]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004f97a0]
lea rbx, [0x0054c560]
call sym.runtime.gopanic
inc rax
cmp rax, r8
jge 0x479c42
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x479c77
lea rdi, [0x004f9820]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x479963
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x479c5b
jmp 0x479c30
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_bisect.Hash

Function at 0x47a220
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x47a237
inc rax
cmp rax, 4
jge 0x47a24f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x47a234
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x47a260
inc rax
cmp rax, 4
jge 0x47a26e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x47a297
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x47a27b
jmp 0x47a25d
Function at 0x47eb20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47ebea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00657eb0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47ebcf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004f98a0]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x47ebbe
mov edi, 1
lea rsi, [0x004f98a0]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0054c7a8]
lea rsi, [0x0054bb10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString
Function at 0x4df220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x4df2f5
movdqa xmm0, xmmword [0x0054bc40]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x4df261
movdqa xmm0, xmmword [0x0054bc50]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x4df377
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x4df34b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x0054baa0]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x0054bc60]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x401160
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov rsi, qword [0x004b0048]
xor eax, eax
lock cmpxchg qword [rsi], rdi
sete bl
je 0x4011b9
cmp rdi, rax
je 0x4011b9
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax]
mov ecx, 0x3e8
call r14
xor eax, eax
lock cmpxchg qword [rsi], rdi
sete bl
je 0x4011b9
cmp rdi, rax
jne 0x4011a0
mov rdi, qword [0x004b0050]
mov eax, dword [rdi]
cmp eax, 1
jne 0x4011d3
mov ecx, 0x1f
call fcn.00495760
jmp 0x4011fa
cmp dword [rdi], 0
je 0x4011e1
mov byte [0x004c5990], 1
jmp 0x4011fa
mov dword [rdi], 1
mov rcx, qword [0x004b0068]
mov rdx, qword [0x004b0070]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov eax, dword [rdi]
cmp eax, 1
jne 0x40121a
mov rcx, qword [0x004b0058]
mov rdx, qword [0x004b0060]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [rdi], 2
test bl, bl
je 0x401223
xor eax, eax
xchg qword [rsi], rax
mov rax, qword [0x004b0010]
mov rax, qword [rax]
test rax, rax
je 0x40123e
xor ecx, ecx
mov edx, 2
xor r8d, r8d
call rax
call fcn.00495010
lea rcx, [0x00495580]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [0x004b0040]
mov qword [rcx], rax
lea rcx, [0x00401390]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.00495000
movsxd rdi, dword [0x004c597c]
lea rcx, [rdi*8 + 8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rsi, rax
test rdi, rdi
jle 0x4012d9
mov r14d, edi
mov r15, qword [0x004c5980]
xor r12d, r12d
nop word cs:[rax + rax]
nop
mov rdi, qword [r15 + r12*8]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea rbx, [rax*2 + 2]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rsi + r12*8], rax
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call fcn.0041bb90
add r12, 1
cmp r14, r12
jne 0x4012a0
jmp 0x4012dc
xor r14d, r14d
mov qword [rsi + r14*8], 0
mov qword [0x004c5980], rsi
call fcn.00494e40
mov r8, qword [0x004c5988]
mov rax, qword [0x004b0018]
mov rax, qword [rax]
mov qword [rax], r8
mov ecx, dword [0x004c597c]
mov rdx, qword [0x004c5980]
call fcn.0042b500
mov dword [0x004c5994], eax
cmp dword [0x004c5974], 0
je 0x401347
cmp byte [0x004c5990], 0
jne 0x401339
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x004c5994]
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x495320
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov eax, dword [0x004c6c60]
test eax, eax
jle 0x495389
mov rcx, qword [0x004c6c70]
lea rdx, [rax*8]
lea rdx, [rdx + rdx*4]
xor r8d, r8d
jmp 0x495369
add r8, 0x28
cmp rdx, r8
je 0x49538b
mov r9, qword [rcx + r8 + 0x18]
cmp r9, rsi
ja 0x495360
mov r10, qword [rcx + r8 + 0x20]
mov r10d, dword [r10 + 8]
add r9, r10
cmp r9, rsi
jbe 0x495360
jmp 0x4954b2
xor eax, eax
mov rcx, qword [0x004b0008]
movzx edx, word [rcx]
cmp edx, 0x5a4d
jne 0x4954cd
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x4954cd
add rcx, rdx
movzx edx, word [rcx + 0x18]
cmp edx, 0x20b
jne 0x4954cd
movzx edx, word [rcx + 6]
test edx, edx
je 0x4954cd
mov r8, rsi
sub r8, qword [0x004b0008]
movzx r9d, word [rcx + 0x14]
lea r15, [rcx + r9]
add r15, 0x18
jmp 0x4953fd
add r15, 0x28
add edx, 0xffffffff
je 0x4954cd
mov ecx, dword [r15 + 0xc]
cmp r8, rcx
jb 0x4953f0
mov r9d, dword [r15 + 8]
add r9d, ecx
cmp r8, r9
jae 0x4953f0
mov rdx, qword [0x004c6c70]
lea r14, [rax + rax*4]
mov qword [rdx + r14*8 + 0x20], r15
mov dword [rdx + r14*8], 0
add rcx, qword [0x004b0008]
mov qword [rdx + r14*8 + 0x18], rcx
lea rdx, [rsp + 0x20]
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4954dc
mov eax, dword [rsp + 0x44]
cmp eax, 7
jle 0x49546c
cmp eax, 8
je 0x4954ab
cmp eax, 0x40
je 0x4954ab
cmp eax, 0x80
je 0x4954ab
jmp 0x49547c
mov r8d, 4
cmp eax, 2
je 0x495482
cmp eax, 4
je 0x4954ab
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rax, qword [0x004c6c70]
lea r9, [rax + r14*8]
mov qword [rax + r14*8 + 8], rcx
mov rdx, qword [rsp + 0x38]
mov qword [rax + r14*8 + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4954f8
add dword [0x004c6c60], 1
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.0041bb90
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.00495510
mov edx, dword [r15 + 8]
mov rax, qword [0x004c6c70]
mov r8, qword [rax + r14*8 + 0x18]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00495510
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00495510
int3

Function at 0x495510
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call rdi
mov r8, qword [rsp + 0x20]
mov rcx, rax
mov rdx, rsi
call fcn.004962c0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3
Function at 0x496620
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rcx, str.libcabi:
mov edx, 0xb
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov ecx, 2
call rdi
mov r8, qword [rsp + 0x20]
mov rcx, rax
mov rdx, rsi
call fcn.004962c0
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3
Function at 0x140e98058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140e981df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140e98089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e9806f
add dl, dl
jne 0x140e98096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e980f6
xor eax, eax
add dl, dl
jne 0x140e980a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e981ad
add dl, dl
jne 0x140e980b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e980c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e980d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e980dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140e980ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140e9807e
mov eax, 1
add dl, dl
jne 0x140e98106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e98113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e980fb
sub eax, ebx
mov ebx, 1
jne 0x140e9814c
mov ecx, 1
add dl, dl
jne 0x140e9812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e9813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e98123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e9807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140e98168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e98175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e9815d
cmp eax, 0x7d00
jae 0x140e9819b
cmp eax, 0x500
jb 0x140e98196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e9807e
cmp eax, 0x7f
ja 0x140e9819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e9807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140e981d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140e9807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001070
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1f4
jae 0x1400010cf
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1f4
jb 0x1400010b5
xor ebx, ebx
mov qword [rsp + 0x20], rbx
mov edi, ebx
mov qword [rsp + 0x28], rbx
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, str.Iniciando_o_monitoramento..._n
mov ebp, eax
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, 0x4e20
jae 0x140001161
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rsp + 0x28]
cmp eax, ebx
jne 0x140001120
mov ecx, dword [rsp + 0x24]
cmp dword [rsp + 0x2c], ecx
je 0x14000112a
inc esi
mov qword [rsp + 0x20], rax
mov rbx, rax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001147
inc edi
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x96
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, 0x4e20
jb 0x140001102
mov edx, edi
lea rcx, [0x1400032c8]
call fcn.140001010
mov edx, esi
lea rcx, [0x1400032e0]
call fcn.140001010
lea rax, str.Clique_suficiente_detectado._n
cmp edi, 8
lea rcx, str.Clique_insuficiente_detectado._n
cmovge rcx, rax
call fcn.140001010
lea rax, str.Movimento_suficiente_detectado._n
cmp esi, 0xf
lea rcx, str.Movimento_insuficiente_detectado._n
cmovge rcx, rax
call fcn.140001010
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.Realizando_uma_opera
call fcn.140001010
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140001210
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140001ad0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b1a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b1c
xor al, al
add rsp, 0x28
ret
Function at 0x180001ac0
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call fcn.180002470
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3

Function at 0x180002190
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x18000f230]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x1800021fc
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x1800021fc
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x1800021fc
movzx edx, word [rax + 6]
test edx, edx
je 0x1800021fc
sub rcx, qword [0x18000f230]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x1800021e8
add rax, 0x28
dec edx
je 0x1800021fc
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x1800021e0
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x1800021e0
jmp 0x1800021fe
xor eax, eax
ret

Function at 0x180002200
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x18000f230]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x180002235
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x180002235
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x180002235
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1800022b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x18000f230]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1800022dc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1800022dc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1800022de
xor eax, eax
ret

Function at 0x1800074e8
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rdi, rcx
mov eax, dword [0x180014180]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rsi, [rax + 8]
mov edx, 0x50
mov rcx, rsi
call fcn.1800080ce
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
lea rcx, [rax + 0x10]
lea rdx, [0x1800140d8]
mov qword [rax + 0x10], rdx
lea rdx, str.IOError
mov qword [rax + 0x20], rdx
movups xmm1, xmmword [rdi]
movaps xmmword [rsp + 0x20], xmm1
movups xmmword [rdi], xmm0
movaps xmm0, xmmword [rsp + 0x20]
movups xmmword [rax + 0x28], xmm0
mov qword [rax + 0x18], 0
lea rdx, str.raiseEIO
mov r8d, 0x9e
call fcn.180009ae7
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x180007593
test byte [rdx + 7], 0x40
jne 0x180007593
mov rcx, rsi
add rsp, 0x38
pop rdi
pop rsi
jmp fcn.18000865a
nop
add rsp, 0x38
pop rdi
pop rsi
ret