joyce8/EMBER2024-capa huggingface dataset:
Function at 0x512180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0xa0]
cmp r12, qword [r14 + 0x10]
jbe 0x5123be
push rbp
mov rbp, rsp
sub rsp, 0x118
nop dword [rax]
cmp cl, 0x10
jae 0x5123aa
mov qword [rsp + 0x128], rax
mov byte [rsp + 0x138], cl
mov qword [rsp + 0x130], rbx
nop
movups xmmword [rsp + 0xb8], xmm15
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0xd0], xmm15
movups xmmword [rsp + 0xe0], xmm15
movups xmmword [rsp + 0xf0], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
nop
movabs rdx, 0x80000000000000
mov qword [rsp + 0x70], rdx
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x100], xmm15
mov qword [rsp + 0x110], 0
lea rdx, [rsp + 0xb8]
mov qword [rsp + 0x100], rdx
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x108], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x110], rdx
mov rdx, qword [rbx]
mov rsi, qword [rsp + 0xb8]
mov qword [rdx], rsi
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsp + 0xd0]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsp + 0xe0]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x108]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x110]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov edx, 1
jmp 0x512378
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.005120a0
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x130]
movzx r8d, byte [rsp + 0x138]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0x130]
cmp dl, 0x10
jae 0x512394
test byte [rax], al
lea esi, [rdx - 1]
movzx esi, sil
nop
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x51232b
jmp 0x51239d
add rsp, 0x118
pop rbp
ret
mov rax, rsi
mov ecx, 0xf
call fcn.004652a0
lea rax, [0x0053da40]
lea rbx, [0x005b5070]
call fcn.00436060
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.00463020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00512180
Function at 0x515540
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm6, xmmword [rdi]
movdqu xmm7, xmmword [rdi + 0x10]
movdqu xmm8, xmmword [rdi + 0x20]
movdqu xmm9, xmmword [rdi + 0x30]
movdqu xmm10, xmmword [rdi + 0x40]
movdqu xmm11, xmmword [rdi + 0x50]
add rdi, 0x60
pand xmm6, xmm12
pand xmm7, xmm12
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm6
pxor xmm1, xmm7
pxor xmm2, xmm8
pxor xmm3, xmm9
pxor xmm4, xmm10
pxor xmm5, xmm11
dec rax
jne 0x51558d
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
movdqu xmmword [rdx + 0x40], xmm4
movdqu xmmword [rdx + 0x50], xmm5
ret

Function at 0x515620
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm4, xmmword [rdi]
movdqu xmm5, xmmword [rdi + 0x10]
movdqu xmm6, xmmword [rdi + 0x20]
movdqu xmm7, xmmword [rdi + 0x30]
movdqu xmm8, xmmword [rdi + 0x40]
movdqu xmm9, xmmword [rdi + 0x50]
movdqu xmm10, xmmword [rdi + 0x60]
movdqu xmm11, xmmword [rdi + 0x70]
add rdi, 0x80
pand xmm4, xmm12
pand xmm5, xmm12
pand xmm6, xmm12
pand xmm7, xmm12
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm0, xmm8
pxor xmm1, xmm9
pxor xmm2, xmm10
pxor xmm3, xmm11
dec rax
jne 0x515665
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
ret
Function at 0x5172c0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5173f4
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
call fcn.00516fe0
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x517354
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x517397
mov rdx, qword [rsp + rax*8 + 0x40]
imul rsi, rax, 0x33
mov rdi, rsi
sar rsi, 0x3f
shr rsi, 0x3d
add rsi, rdi
mov r8, rsi
and rsi, 0xfffffffffffffff8
sub rdi, rsi
mov rbx, rcx
mov rcx, rdi
shl rdx, cl
cmp rcx, 0x40
sbb rsi, rsi
and rdx, rsi
mov qword [rsp + 0x10], rdx
xor ecx, ecx
jmp 0x5173c1
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
add rsp, 0x68
pop rbp
ret
movzx edi, byte [rbx + rsi]
movzx r9d, byte [rsp + rcx + 0x10]
or edi, r9d
mov byte [rbx + rsi], dil
inc rcx
mov r8, rdx
cmp rcx, 8
jge 0x51734e
mov rdx, r8
sar r8, 3
lea rsi, [r8 + rcx]
cmp rsi, 0x20
jge 0x51734e
test byte [rbx], al
nop
cmp rsi, 0x20
jb 0x5173aa
mov rax, rsi
mov ecx, 0x20
call fcn.004652a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.00463020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005172c0
Function at 0x51a6a0
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x51a725
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x51a886
cmp rcx, 0xe
jne 0x51a7a0
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x51a886
cmp rcx, 0xf
jne 0x51a817
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x51a886
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x5206c0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5207a5
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
mov rdx, rdi
sar rdi, 0x3f
shr rdi, 0x3d
lea rsi, [rdi + rdx]
and rsi, 0xfffffffffffffff8
sub rdx, rsi
lea rsi, [rdx - 8]
neg rsi
cmp rsi, 8
je 0x520758
test rbx, rbx
je 0x520758
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x38], rax
cmp rsi, 8
sbb edx, edx
mov byte [rsp + 0x1f], dl
lea rax, [0x0053dd80]
mov rcx, rbx
call fcn.0044ad20
mov rdx, qword [rsp + 0x38]
movzx esi, byte [rdx]
mov rcx, qword [rsp + 0x28]
shr sil, cl
movzx edi, byte [rsp + 0x1f]
and esi, edi
mov byte [rax], sil
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x30]
mov r8d, 1
jmp 0x520797
add rsp, 0x40
pop rbp
ret
movzx r9d, byte [r8 + rdx - 1]
mov r10, rcx
mov rcx, rsi
shl r9d, cl
lea r11, [r8 + 1]
cmp rcx, 0x20
sbb r12d, r12d
and r9d, r12d
mov byte [rax + r8], r9b
movzx r12d, byte [rdx + r8]
mov rcx, r10
shr r12b, cl
and r12d, edi
or r9d, r12d
mov byte [rax + r8], r9b
mov r8, r11
cmp rbx, r8
jg 0x52075e
mov rcx, rbx
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005206c0
Function at 0x5272a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5274ab
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x5273c4
cmp rdx, 0x40
ja 0x52749d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x527334
mov rax, rdx
mov rcx, rsi
call fcn.00465c80
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x5273a0
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00527700
xorps xmm15, xmm15
mov r14, qword [0x0072b530]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x527495
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x5273c7
mov r8, rcx
cmp r8, 0x40
jl 0x527445
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.00527700
xorps xmm15, xmm15
mov r14, qword [0x0072b530]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x527488
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x527484
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.00465c80
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.00465360
mov rax, rdx
mov ecx, 0x40
call fcn.00465360
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.00463020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005272a0
Function at 0x140001070
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm7
movaps xmmword [rsp + 0x50], xmm8
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp - 0x40], rax
xor ecx, ecx
xor eax, eax
mov qword [rbp - 0x58], rcx
movaps xmm7, xmm0
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x48], rcx
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x60], rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x58]
xorps xmm1, xmm1
sub rax, qword [rbp - 0x60]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rbp - 0x50]
mov qword [rbp - 0x48], rax
movss xmm6, dword [0x1400032ec]
movaps xmm8, xmm7
subss xmm8, dword [0x1400032dc]
cvtsi2ss xmm1, rax
mulss xmm1, xmm6
divss xmm1, xmm0
comiss xmm8, xmm1
jbe 0x140001150
nop
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x58]
xorps xmm1, xmm1
sub rax, qword [rbp - 0x60]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rbp - 0x50]
mov qword [rbp - 0x48], rax
cvtsi2ss xmm1, rax
mulss xmm1, xmm6
divss xmm1, xmm0
comiss xmm8, xmm1
ja 0x140001110
lea rcx, [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x58]
xorps xmm1, xmm1
sub rax, qword [rbp - 0x60]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rbp - 0x50]
mov qword [rbp - 0x48], rax
cvtsi2ss xmm1, rax
mulss xmm1, xmm6
divss xmm1, xmm0
comiss xmm7, xmm1
jbe 0x1400011c0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x58]
xorps xmm1, xmm1
sub rax, qword [rbp - 0x60]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rbp - 0x50]
mov qword [rbp - 0x48], rax
cvtsi2ss xmm1, rax
mulss xmm1, xmm6
divss xmm1, xmm0
comiss xmm7, xmm1
ja 0x140001184
mov rcx, qword [rbp - 0x40]
xor rcx, rsp
call fcn.140001450
movaps xmm6, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x50]
add rsp, 0x80
pop rbp
ret
Function at 0x1400011f0
Capabilities:
Log keystrokes
Log keystrokes via polling
Set console window title

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x100
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rcx, str.DjumpBugger
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, str.bind_mwheeldown_jump__n
call fcn.140001010
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x140001413
mov qword [rsp + 0xa0], rdi
xor edi, edi
movaps xmmword [rsp + 0x80], xmm6
movss xmm6, dword [0x1400032e0]
movaps xmmword [rsp + 0x70], xmm7
movss xmm7, dword [0x1400032e8]
movaps xmmword [rsp + 0x60], xmm8
movss xmm8, dword [0x1400032e4]
nop dword [rax]
mov ecx, 5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x1400013d7
mov r9d, 0xffffff88
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.USER32.dll_mouse_event]
movaps xmm0, xmm7
call fcn.140001070
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
xor edx, edx
mov dword [rsp + 0x30], 1
mov ecx, 0xa2
mov dword [rsp + 0x3c], 8
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, 0x28
lea rdx, [rsp + 0x30]
mov word [rsp + 0x3a], ax
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
movaps xmm0, xmm8
call fcn.140001070
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
xor edx, edx
mov dword [rsp + 0x30], 1
mov ecx, 0xa2
mov dword [rsp + 0x3c], 0xa
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, 0x28
lea rdx, [rsp + 0x30]
mov word [rsp + 0x3a], ax
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov r9d, 0xffffff88
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x1400013e2
nop word [rax + rax]
mov r9d, 0xffffff88
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.USER32.dll_mouse_event]
movaps xmm0, xmm6
call fcn.140001070
mov ecx, 5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x1400013a0
jmp 0x1400013e2
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x140001290
movaps xmm8, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x80]
mov rdi, qword [rsp + 0xa0]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001450
add rsp, 0x90
pop rbx
ret
Function at 0x140001a94
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x1400224e8]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rdi, rcx
mov esi, 0x800
mov r8d, esi
lea rcx, [rsp + 0x40]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp dword [0x1400228a8], 0
jne 0x140001b69
lea rcx, str.DEPLOY_TRACE_NATIVE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140001b69
call fcn.140001a2c
mov rbx, rax
test rax, rax
je 0x140001b69
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x38], eax
lea r9, str._s_s_s__ld.trace
mov qword [rsp + 0x30], rdi
mov r8d, esi
lea rax, [0x14001268c]
mov edx, esi
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rbx
call fcn.140003804
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, [0x1400126a4]
lea rcx, [rsp + 0x40]
call fcn.1400019f4
mov ecx, dword [0x1400228a8]
test rax, rax
mov edx, 1
mov qword [0x1400228b0], rax
cmovne ecx, edx
mov dword [0x1400228a8], ecx
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14000fab0
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140002c9c
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x140012a18]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbslen]
mov rdi, rax
lea rcx, [rax + 0x105]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x140002cd7
xor eax, eax
jmp 0x140002d38
lea r8d, [rdi + 0x105]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
jne 0x140002d48
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x140002d2a
lea rcx, [rbx - 1]
inc rcx
cmp byte [rcx], 0
jne 0x140002d01
movsd xmm0, qword [str.JavaLow]
mov rdx, rbx
movsd qword [rcx], xmm0
mov al, byte [0x140012a40]
mov byte [rcx + 8], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp edi, 0x104
jbe 0x140002cfd
lea rcx, [0x140012a28]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbslen]
mov rcx, rbx
lea rdx, [rax + 1]
add rdx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r8d, edi
xor edx, edx
mov rcx, rsi
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x140002cfd
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002cd3
Function at 0x1400075b4
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x1400224e8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor bl, bl
cmp byte [0x140023420], bl
je 0x1400075e1
mov al, byte [0x140023421]
jmp 0x140007625
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x90
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], DllRegisterServer
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
jne 0x140007616
cmp dword [rsp + 0x24], 6
jb 0x140007616
mov bl, 1
mov byte [0x140023421], bl
mov al, bl
mov byte [0x140023420], 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14000fab0
add rsp, 0xd0
pop rbx
ret

Function at 0x140007750
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
xor r8d, r8d
mov byte [rax + 0x10], 0
lea rdx, [rax + 0x10]
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
jne 0x140007789
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x1400077d4
jmp 0x14000779f
mov rcx, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
test rax, rax
jne 0x1400077a3
xor al, al
jmp 0x1400077d6
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x1400077cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400077cb
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000779f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140007a58
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 0x10
mov sil, dl
mov rbx, rcx
mov rax, rcx
jb 0x140007a7f
mov rax, qword [rcx]
cmp byte [rax], 0x2d
je 0x140007a8b
xor al, al
jmp 0x140007b62
mov ebp, 0x16
cmp qword [rcx + 0x10], rbp
mov edi, ebp
cmovb rdi, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x140007aa5
mov rcx, qword [rcx]
cmp rdi, rbp
lea rdx, str._Dsun.plugin2.jvm.args
mov r8, rdi
cmova r8, rbp
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140007ae5
cmp rdi, rbp
jne 0x140007ae5
test eax, eax
jne 0x140007ae5
lea rcx, str.Invalid_argument_1_n
call fcn.140001bd4
call fcn.140001ba4
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
jb 0x140007af2
mov rcx, qword [rbx]
mov dl, sil
call fcn.140008988
test al, al
jne 0x140007b0f
lea rcx, str.Invalid_argument_2_n
call fcn.140001bd4
jmp 0x140007a84
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
jb 0x140007b1c
mov rcx, qword [rbx]
call fcn.1400080b0
test al, al
je 0x140007b60
cmp qword [rbx + 0x18], 0x10
jb 0x140007b2f
mov rbx, qword [rbx]
mov rcx, rbx
int3
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret