joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68125e50
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
movups xmmword [rsp + 0x20], xmm6
movups xmmword [rsp + 0x30], xmm7
movups xmmword [rsp + 0x40], xmm8
movups xmmword [rsp + 0x50], xmm9
movups xmmword [rsp + 0x60], xmm10
movups xmmword [rsp + 0x70], xmm11
movss xmm10, dword [rsp + 0xd0]
mov edi, dword [rsp + 0xe0]
movss xmm11, dword [rsp + 0xd8]
mov r12, rcx
mov r13, rdx
movups xmm6, xmm3
mov ebx, r8d
cmp r8d, 2
jbe 0x68125eb2
xorps xmm0, xmm0
comiss xmm0, xmm3
jb 0x68125ef8
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
mov r8d, 0x63
lea rdx, str.src_Cairo.cpp
movups xmm8, xmmword [rsp + 0x40]
movups xmm9, xmmword [rsp + 0x50]
lea rcx, str.numSegments___3__size___0.0f
movups xmm10, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x70]
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.68109a70
mov rcx, rdx
cvtss2sd xmm6, xmm6
xorps xmm8, xmm8
cvtss2sd xmm11, xmm11
call fcn.68132e40
mov rcx, r13
mov r13d, 1
cvtss2sd xmm10, xmm10
movzx esi, word [rax]
call fcn.68132e50
mov rcx, r12
cvtsi2sd xmm7, esi
movzx eax, word [rax]
cvtsi2sd xmm9, eax
movupd xmm1, xmm7
addsd xmm1, xmm6
movupd xmm2, xmm9
call fcn.6822aa90
movupd xmm2, xmm9
movupd xmm1, xmm7
mov rcx, r12
inc r13d
addsd xmm2, xmm8
addsd xmm1, xmm6
call fcn.68229420
movupd xmm2, xmm11
movupd xmm0, xmm6
movupd xmm1, xmm10
mulsd xmm2, xmm6
mulsd xmm1, xmm8
mulsd xmm0, xmm10
mulsd xmm8, xmm11
movupd xmm6, xmm2
subsd xmm6, xmm1
addsd xmm8, xmm0
cmp ebx, r13d
ja 0x68125f44
addsd xmm7, xmm6
movupd xmm2, xmm9
mov rcx, r12
addsd xmm2, xmm8
movupd xmm1, xmm7
call fcn.68229420
mov rcx, r12
test dil, dil
je 0x68125fe8
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
movups xmm8, xmmword [rsp + 0x40]
movups xmm9, xmmword [rsp + 0x50]
movups xmm10, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x70]
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.6822e450
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
movups xmm8, xmmword [rsp + 0x40]
movups xmm9, xmmword [rsp + 0x50]
movups xmm10, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x70]
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.68227e60
Function at 0x68126020
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.68132be0
test al, al
jne 0x68126075
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.68109a70
mov rdx, r14
mov rcx, r13
call fcn.68132be0
test al, al
je 0x6812604f
mov rcx, r13
call fcn.68132b70
mov rcx, r13
movsd xmm2, qword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.68132b60
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsd xmm1, qword [rax]
call fcn.6822aa90
mov rcx, r15
call fcn.68132b70
mov rcx, r15
movsd xmm2, qword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.68132b60
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsd xmm1, qword [rax]
call fcn.68229420
mov rcx, r14
call fcn.68132b70
mov rcx, r14
movsd xmm2, qword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.68132b60
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsd xmm1, qword [rax]
call fcn.68229420
mov rcx, r13
call fcn.68132b70
mov rcx, r13
movsd xmm2, qword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.68132b60
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsd xmm1, qword [rax]
call fcn.68229420
mov rcx, r12
test bl, bl
je 0x6812614d
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6822e450
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.68227e60

Function at 0x68126160
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.68132c80
test al, al
jne 0x681261b5
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.68109a70
mov rdx, r14
mov rcx, r13
call fcn.68132c80
test al, al
je 0x6812618f
mov rcx, r13
call fcn.68132c10
mov rcx, r13
cvtss2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.68132c00
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtss2sd xmm1, dword [rax]
call fcn.6822aa90
mov rcx, r15
call fcn.68132c10
mov rcx, r15
cvtss2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.68132c00
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtss2sd xmm1, dword [rax]
call fcn.68229420
mov rcx, r14
call fcn.68132c10
mov rcx, r14
cvtss2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.68132c00
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtss2sd xmm1, dword [rax]
call fcn.68229420
mov rcx, r13
call fcn.68132c10
mov rcx, r13
cvtss2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.68132c00
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtss2sd xmm1, dword [rax]
call fcn.68229420
mov rcx, r12
test bl, bl
je 0x6812628d
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6822e450
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.68227e60
Function at 0x681262a0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.68132d00
test al, al
jne 0x681262f5
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.68109a70
mov rdx, r14
mov rcx, r13
call fcn.68132d00
test al, al
je 0x681262cf
mov rcx, r13
call fcn.68132cb0
mov rcx, r13
cvtsi2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.68132ca0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtsi2sd xmm1, dword [rax]
call fcn.6822aa90
mov rcx, r15
call fcn.68132cb0
mov rcx, r15
cvtsi2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.68132ca0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtsi2sd xmm1, dword [rax]
call fcn.68229420
mov rcx, r14
call fcn.68132cb0
mov rcx, r14
cvtsi2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.68132ca0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtsi2sd xmm1, dword [rax]
call fcn.68229420
mov rcx, r13
call fcn.68132cb0
mov rcx, r13
cvtsi2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.68132ca0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtsi2sd xmm1, dword [rax]
call fcn.68229420
mov rcx, r12
test bl, bl
je 0x681263cd
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6822e450
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.68227e60

Function at 0x681263e0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.68132d80
test al, al
jne 0x68126435
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.68109a70
mov rdx, r14
mov rcx, r13
call fcn.68132d80
test al, al
je 0x6812640f
mov rcx, r13
call fcn.68132d30
mov rcx, r13
mov eax, dword [rax]
cvtsi2sd xmm2, rax
movsd qword [rsp + 0x28], xmm2
call fcn.68132d20
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
mov eax, dword [rax]
cvtsi2sd xmm1, rax
call fcn.6822aa90
mov rcx, r15
call fcn.68132d30
mov rcx, r15
mov eax, dword [rax]
cvtsi2sd xmm2, rax
movsd qword [rsp + 0x28], xmm2
call fcn.68132d20
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
mov eax, dword [rax]
cvtsi2sd xmm1, rax
call fcn.68229420
mov rcx, r14
call fcn.68132d30
mov rcx, r14
mov eax, dword [rax]
cvtsi2sd xmm2, rax
movsd qword [rsp + 0x28], xmm2
call fcn.68132d20
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
mov eax, dword [rax]
cvtsi2sd xmm1, rax
call fcn.68229420
mov rcx, r13
call fcn.68132d30
mov rcx, r13
mov eax, dword [rax]
cvtsi2sd xmm2, rax
movsd qword [rsp + 0x28], xmm2
call fcn.68132d20
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
mov eax, dword [rax]
cvtsi2sd xmm1, rax
call fcn.68229420
mov rcx, r12
test bl, bl
je 0x68126525
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6822e450
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.68227e60
Function at 0x68126540
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.68132e20
test al, al
jne 0x68126595
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.68109a70
mov rdx, r14
mov rcx, r13
call fcn.68132e20
test al, al
je 0x6812656f
mov rcx, r13
call fcn.68132db0
mov rcx, r13
movsx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.68132da0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.6822aa90
mov rcx, r15
call fcn.68132db0
mov rcx, r15
movsx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.68132da0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.68229420
mov rcx, r14
call fcn.68132db0
mov rcx, r14
movsx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.68132da0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.68229420
mov rcx, r13
call fcn.68132db0
mov rcx, r13
movsx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.68132da0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.68229420
mov rcx, r12
test bl, bl
je 0x68126685
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6822e450
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.68227e60
Function at 0x681266a0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.68132ec0
test al, al
jne 0x681266f5
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.68109a70
mov rdx, r14
mov rcx, r13
call fcn.68132ec0
test al, al
je 0x681266cf
mov rcx, r13
call fcn.68132e50
mov rcx, r13
movzx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.68132e40
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movzx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.6822aa90
mov rcx, r15
call fcn.68132e50
mov rcx, r15
movzx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.68132e40
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movzx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.68229420
mov rcx, r14
call fcn.68132e50
mov rcx, r14
movzx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.68132e40
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movzx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.68229420
mov rcx, r13
call fcn.68132e50
mov rcx, r13
movzx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.68132e40
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movzx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.68229420
mov rcx, r12
test bl, bl
je 0x681267e5
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6822e450
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.68227e60

Function at 0x68126800
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x10
call rsi
mov ecx, 0x11
movsx ebx, ax
call rsi
shr ebx, 0x1f
mov ecx, 0x12
shr eax, 0xe
and eax, 2
or ebx, eax
call rsi
mov ecx, 0x5b
shr eax, 0xd
and eax, 4
or ebx, eax
call rsi
mov ecx, 0x5c
shr eax, 0xc
and eax, 8
or ebx, eax
call rsi
mov ecx, 0x90
shr eax, 0xc
and eax, 8
or ebx, eax
call rsi
mov ecx, 0x91
shl eax, 4
and eax, 0x10
or ebx, eax
call rsi
mov ecx, 0x14
shl eax, 5
and eax, 0x20
or ebx, eax
call rsi
shl eax, 6
and eax, 0x40
or eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x68126f90
Capabilities:
Query environment variable

Disassembly:
xorps xmm1, xmm1
mov rax, qword [rcx + 0x10]
movsd xmm0, qword [rax + 0xd8]
comisd xmm0, xmm1
ja 0x6811793a
jmp fcn.68127890
ret
push r12
sub rsp, 0x20
mov r12, rcx
lea rcx, str.DPF_SCALE_FACTOR
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x68126fbc
call sub.msvcrt.dll_atof
maxsd xmm0, qword [0x68322c48]
jmp 0x68126fd7
test r12, r12
je 0x68126fcf
mov rcx, r12
add rsp, 0x20
pop r12
jmp 0x68117920
movsd xmm0, qword [0x68322c48]
add rsp, 0x20
pop r12
ret

Function at 0x681271d0
Capabilities:
Query environment variable

Disassembly:
lea rcx, str.Window::PrivateData::renderToPicture
jmp 0x681271d0
mov rdx, rcx
lea rcx, str.cairo_function_not_implemented:__s
jmp fcn.6810aa90
Function at 0x6812b900
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
movups xmmword [rsp + 0x60], xmm6
movups xmmword [rsp + 0x70], xmm7
movups xmmword [rsp + 0x80], xmm8
mov r13, qword [0x683124b0]
movsd xmm7, qword [0x68322340]
movq xmm8, qword [0x68322330]
movsd xmm6, qword [r13 + 0x38]
movupd xmm0, xmm6
andps xmm0, xmm8
comisd xmm0, xmm7
mov rdi, rcx
mov ebx, edx
mov esi, r8d
jae 0x6812ba42
lea rcx, [0x683222da]
mov r15, qword [r13 + 0x40]
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x6812b98c
call sub.msvcrt.dll_atof
movsd xmm6, qword [0x68322328]
maxsd xmm6, xmm0
jmp 0x6812ba42
lea rcx, [0x683222eb]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movsd xmm6, qword [0x68322328]
mov r12, rax
test rax, rax
je 0x6812ba42
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x683222f6]
mov rcx, rax
call rbp
lea rdx, [0x6832230d]
mov rcx, r12
mov r14, rax
call rbp
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x5c], 0x64
mov rbp, rax
test r14, r14
je 0x6812ba28
test rax, rax
je 0x6812ba28
xor ecx, ecx
lea rdx, [rsp + 0x58]
call r14
test eax, eax
jne 0x6812ba28
cmp dword [rsp + 0x58], 0
je 0x6812ba28
mov edx, 1
test r15, r15
je 0x6812ba16
mov rcx, r15
call qword [sym.imp.USER32.dll_MonitorFromWindow]
jmp 0x6812ba1e
xor ecx, ecx
call qword [sym.imp.USER32.dll_MonitorFromPoint]
mov rcx, rax
lea rdx, [rsp + 0x5c]
call rbp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x5c]
cvtsi2sd xmm6, rax
mulsd xmm6, qword [0x68322348]
movupd xmm0, xmm6
andps xmm0, xmm8
comisd xmm0, xmm7
jb 0x6812ba82
movupd xmm0, xmm6
subsd xmm0, qword [0x68322328]
andps xmm0, xmm8
comisd xmm0, xmm7
jb 0x6812ba82
cvtsi2sd xmm0, rbx
mulsd xmm0, xmm6
cvttsd2si rbx, xmm0
cvtsi2sd xmm0, rsi
mulsd xmm0, xmm6
cvttsd2si rsi, xmm0
movq r9, xmm6
mov r8d, esi
movupd xmm3, xmm6
mov edx, ebx
lea rcx, str.createNextWindow__u__u__f
call fcn.6810a1c0
mov ecx, 0x20
call fcn.681c7e20
mov r8, qword [r13 + 0x40]
mov dword [rsp + 0x20], esi
mov r9d, ebx
mov dword [rsp + 0x48], 0
mov rdx, r13
mov rcx, rax
mov r12, rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
movsd qword [rsp + 0x28], xmm6
call fcn.68120a30
mov rcx, qword [r12 + 8]
lea rax, fcn.68128f90
mov qword [r12 + 0x10], rdi
mov qword [r12], rax
cmp qword [rcx + 0x20], 0
mov word [r12 + 0x18], 1
je 0x6812bb20
call fcn.6811f580
test al, al
je 0x6812bb20
mov rax, qword [r12 + 8]
mov rcx, qword [rax + 0x20]
call fcn.681168c0
mov rcx, qword [r13 + 0x10]
cmp r12, rcx
jne 0x6812bb38
jmp 0x6812bb47
mov qword [r13 + 0x10], r12
test rcx, rcx
je 0x6812bb47
mov rax, qword [rcx]
call qword [rax + 8]
cmp qword [r13 + 0x58], 0
mov rax, qword [r13 + 0x10]
jne 0x6812bb70
mov rdx, qword [rax + 8]
mov byte [rdx + 0x71], 1
jmp 0x6812bb70
movups xmm6, xmmword [rsp + 0x60]
movups xmm7, xmmword [rsp + 0x70]
movups xmm8, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x6812cd20
Capabilities:
Query environment variable

Disassembly:
mov r8, qword [rcx]
test r8, r8
jne 0x6812cd48
mov r9d, 0xf2
lea r8, [0x683204d8]
lea rdx, [0x683204fb]
lea rcx, [0x6832050e]
jmp fcn.6810a4e0
cmp byte [rcx + 0x10], 0
je 0x6812cd56
mov rcx, r8
jmp sub.msvcrt.dll_free
ret

Function at 0x6812cd90
Capabilities:
Query environment variable

Disassembly:
mov r8, qword [rcx]
test r8, r8
jne 0x6812cdb8
mov r9d, 0xf2
lea r8, str.src_.._.._distrho_extra_String.hpp
lea rdx, str.fBuffer___nullptr
lea rcx, [0x68323201]
jmp fcn.6810abd0
cmp byte [rcx + 0x10], 0
je 0x6812cdc6
mov rcx, r8
jmp sub.msvcrt.dll_free
ret
Function at 0x6818e750
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x6818e777
call rbp
cmp dword [rax], 4
jne 0x6818e794
mov rcx, rdi
call fcn.6818e550
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sub.msvcrt.dll__read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x6818e770
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x681e2590
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
test rcx, rcx
je 0x681e25b2
movsx edx, byte [rcx]
test dl, dl
je 0x681e25b2
mov r8d, eax
inc rcx
shl r8d, 5
add edx, r8d
add eax, edx
jmp 0x681e2595
ret

Function at 0x681f1bd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor eax, eax
mov rdx, rcx
mov ecx, 0x811c9dc5
imul ecx, ecx, 0x1000193
movzx r8d, byte [rdx + rax + 0x38]
inc rax
xor ecx, r8d
cmp rax, 0x30
jne 0x681f1be0
xor eax, eax
imul ecx, ecx, 0x1000193
movzx r8d, byte [rdx + rax + 0x68]
inc rax
xor ecx, r8d
cmp rax, 0x30
jne 0x681f1bfa
call fcn.68207d60
lea rcx, [rdx + 0x98]
mov rsi, qword [rdx + 0x28]
mov ebx, eax
call fcn.68228280
xor ebx, eax
mov ecx, ebx
xor ecx, esi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.68207d60

Function at 0x682028d0
Capabilities:
Check os version

Disassembly:
push r13
push r12
sub rsp, 0xc8
mov rax, qword [str._81h]
cmp dword [rax], 0
jne 0x682028ec
call fcn.681e6f00
mov r12, qword [0x683136a0]
mov rcx, r12
test r12, r12
jne 0x682029a0
mov ecx, 0x70
call sub.msvcrt.dll_malloc
lea rdx, [0x683417e0]
mov rcx, rax
mov r13, rax
call fcn.681db050
call fcn.68204230
mov qword [r13 + 0x58], 0
lea rcx, [rsp + 0x2c]
mov qword [r13 + 0x60], rax
mov dword [rsp + 0x2c], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x3c], 1
jne 0x68202954
cmp dword [rsp + 0x30], 4
jne 0x68202954
cmp dword [rsp + 0x34], 0xa
je 0x68202980
lea rcx, str.msimg32
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [r13 + 0x58], rax
mov r12, rax
test rax, rax
je 0x68202980
lea rdx, str.AlphaBlend
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
xor eax, eax
mov qword [r13 + 0x68], r12
lock cmpxchg qword [0x683136a0], r13
mov rcx, r13
je 0x682029a0
call sub.msvcrt.dll_free
mov rcx, qword [0x683136a0]
call fcn.68227d10
add rsp, 0xc8
pop r12
pop r13
ret

Function at 0x68207d80
Capabilities:
Check os version

Disassembly:
push r12
sub rsp, 0xc0
mov dword [rsp + 0x2c], 0x94
lea rcx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov r12d, eax
test eax, eax
jne 0x68207db1
lea rcx, str._have_cleartype_quality
call fcn.68204610
jmp 0x68207dd2
cmp dword [rsp + 0x30], 5
mov r12d, 1
ja 0x68207dd2
mov r12d, 0
jne 0x68207dd2
xor r12d, r12d
cmp dword [rsp + 0x34], 0
setne r12b
mov eax, r12d
add rsp, 0xc0
pop r12
ret
Function at 0x68209ec0
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, rcx
lea rcx, str.PIXMAN_DISABLE
call sub.msvcrt.dll_getenv
mov r14, rax
xor eax, eax
test r14, r14
je 0x68209f6b
or rcx, 0xffffffffffffffff
mov rdi, r12
or rbp, 0xffffffffffffffff
xor r13d, r13d
repne scasb al, byte [rdi]
not rcx
lea rsi, [rcx - 1]
mov edx, 0x20
mov rcx, r14
call sub.msvcrt.dll_strchr
mov rbx, rax
test rax, rax
je 0x68209f1c
sub ebx, r14d
jmp 0x68209f2d
mov rcx, rbp
mov rdi, r14
mov eax, r13d
repne scasb al, byte [rdi]
not rcx
lea ebx, [rcx - 1]
movsxd rbx, ebx
cmp rsi, rbx
jne 0x68209f5d
mov r8, rsi
mov rdx, r14
mov rcx, r12
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x68209f5d
mov rdx, r12
lea rcx, str.pixman:_Disabled__s_implementation_n
call fcn.682d51d0
mov eax, 1
jmp 0x68209f6b
add rbx, r14
cmp byte [rbx], 0
lea r14, [rbx + 1]
jne 0x68209f02
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140001910
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000195a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000195a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000195a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000195a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000195a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000195c
xor al, al
add rsp, 0x28
ret
Function at 0x1400025f0
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1258
call fcn.14000c7a0
sub rsp, rax
mov rax, qword [0x140013040]
xor rax, rsp
mov qword [rsp + 0x1250], rax
lea rcx, [rsp + 0x250]
lea r8, [rsp + 0x3c]
mov edx, 0x1000
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x140002651
mov ecx, dword [rsp + 0x3c]
mov eax, ecx
shr eax, 2
mov dword [rsp + 0x3c], eax
cmp ecx, 4
jae 0x140002664
lea rcx, str.Virtual_machine_not_detected.
jmp 0x140002658
lea rcx, [0x14000fb90]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_puts
xor esi, esi
jmp 0x1400027ea
xor r13d, r13d
lea rsi, [0x14000f390]
lea rdi, [rsp + 0x40]
mov rbx, qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r14, [rsp + 0x2c]
lea r15, str.vmware.exe
mov r12, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
jmp 0x14000269e
mov eax, dword [rsp + 0x3c]
inc r13
mov ecx, eax
cmp r13, rcx
jae 0x140002648
mov ebp, dword [rsp + r13*4 + 0x250]
test ebp, ebp
je 0x140002694
mov r8d, 0x208
mov rcx, rdi
mov rdx, rsi
call fcn.1400037a0
mov ecx, 0x410
xor edx, edx
mov r8d, ebp
call rbx
test rax, rax
je 0x140002690
mov rbp, rax
mov rcx, rax
lea rdx, [rsp + 0x30]
mov r8d, 8
mov r9, r14
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1400026ff
mov rdx, qword [rsp + 0x30]
mov rcx, rbp
mov r8, rdi
mov r9d, 0x104
call sub.KERNEL32.dll_K32GetModuleBaseNameW
mov rcx, r15
mov rdx, rdi
call r12
test eax, eax
je 0x14000275e
lea rcx, str.vboxservice.exe
mov rdx, rdi
call r12
test eax, eax
je 0x14000275e
lea rcx, str.vboxtray.exe
mov rdx, rdi
call r12
test eax, eax
je 0x14000275e
lea rcx, str.vmtoolsd.exe
mov rdx, rdi
call r12
test eax, eax
je 0x14000275e
lea rcx, str.vmwaretray.exe
mov rdx, rdi
call r12
test eax, eax
je 0x14000275e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002690
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Virtual_machine_detected:__S_n
lea rdx, [rsp + 0x40]
call fcn.140002570
mov esi, 0xa
mov rdi, qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
nop word cs:[rax + rax]
call rdi
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x25
add ecx, edx
imul ecx, ecx, 0x64
sub eax, ecx
mov dword [rsp + 0x24], eax
call rdi
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x26
add ecx, edx
imul ecx, ecx, 0xc8
sub eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x24]
add eax, dword [rsp + 0x20]
mov dword [rsp + 0x28], eax
dec esi
jne 0x140002790
mov esi, 1
mov rcx, qword [rsp + 0x1250]
xor rcx, rsp
call fcn.14000c770
mov eax, esi
add rsp, 0x1258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret