joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140017360
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x100]
lea r11, [0x140072b50]
mov rax, qword [rcx + 0x108]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x4054], ebx
jne 0x1400173f6
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.14002bfd0
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140017400
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0x108]
lea r9, [0x140072b50]
movss xmm2, dword [rcx + 0x120]
movss xmm3, dword [rcx + 0x124]
movsxd rcx, dword [rcx + 0x100]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x14001adb0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x140086040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, qword [0x140086cf0]
mov r11d, 1
mov r15d, dword [rsp + 0x90]
mov r14d, edx
mov r9d, r15d
mov r10, rcx
mov rbx, qword [rsi + 0x4008]
mov eax, dword [rbx + 0x14]
and eax, 4
or eax, 0x1000103
or r15d, eax
mov eax, 3
bt r9d, 0x1e
mov r9d, dword [rsi + 0x49f8]
cmovae eax, r11d
bts r9d, 8
mov dword [rsi + 0x49f8], r9d
mov dword [rsi + 0x4a30], eax
cmp qword [rbx + 0x1b8], 0
jne 0x14001ae4f
cmp qword [rsi + 0x4df8], 0
mov eax, 0x260
je 0x14001ae54
mov eax, 0x230
movss xmm2, dword [rbx + rax]
lea rcx, [rsp + 0x30]
movss xmm3, dword [rbx + rax + 4]
subss xmm3, dword [rbx + 0x114]
subss xmm2, dword [rbx + 0x110]
mov rdx, qword [r8]
call fcn.140023de0
movsd xmm0, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
or r9d, 2
movsd qword [rsi + 0x4a18], xmm0
xor edx, edx
mov dword [rsi + 0x49f8], r9d
mov dword [rsi + 0x4a00], r11d
mov r9, qword [rbx + 8]
test r10, r10
je 0x14001aec4
mov dword [rsp + 0x28], r14d
lea r8, str._s__s__08X
mov qword [rsp + 0x20], r10
call fcn.1400134c0
jmp 0x14001aed5
lea r8, str._s__08X
mov dword [rsp + 0x20], r14d
call fcn.1400134c0
mov rcx, qword [rsp + 0x30]
mov r8d, r15d
movss xmm6, dword [rsi + 0x3920]
xor edx, edx
call fcn.14001e070
mov rdi, qword [rsi + 0x4008]
movzx ebp, al
movss dword [rsi + 0x3920], xmm6
cmp word [rdi + 0xcc], 1
mov dword [rdi + 0x88], r14d
jne 0x14001af1c
movsd xmm0, qword [rdi + 0x28]
movsd qword [rbx + 0x110], xmm0
mov r9d, r14d
lea rdx, [0x140071af1]
not r9d
lea r10, [0x140072b50]
mov ebx, r9d
mov r8b, 0x23
cmp r8b, 0x23
jne 0x14001af49
cmp byte [rdx], r8b
jne 0x14001af49
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14001af36
not ebx
cmp dword [rsi + 0x406c], ebx
jne 0x14001af79
xor edx, edx
xor ecx, ecx
call fcn.1400175c0
cmp dword [rsi + 0x4b28], r14d
jne 0x14001afc6
bt r15d, 0x17
jb 0x14001afc6
cmp word [rdi + 0x16c], 0
jne 0x14001af9c
cmp byte [rdi + 0x172], 0
je 0x14001afc6
xor edx, edx
mov rcx, rdi
call fcn.140020630
xor edx, edx
mov rcx, rdi
call fcn.140026c00
mov rdx, rdi
mov ecx, ebx
call fcn.1400175c0
mov eax, dword [rsi + 0x4b4c]
mov dword [rsi + 0x40a0], eax
movzx eax, bpl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14006bfe0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x140024b00
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140086040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140086cf0]
mov edi, ecx
cmp byte [rbx + 0x4d31], 0
jne 0x140024b61
cmp byte [rbx + 0x4d32], 0
jne 0x140024b61
movsx r9d, word [rbx + 0x5e88]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140013440
test dil, 2
je 0x140024c8f
jmp 0x140024bea
movss xmm1, dword [rbx + 0x39c4]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5e88]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x14007a2e8]
mulss xmm1, dword [0x14007a2d4]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe48]
addss xmm1, dword [rbx + 0xe4c]
mov qword [rbx + 0x4a10], rax
mov dword [rbx + 0x49fc], 1
movss dword [rbx + 0x4a08], xmm0
movss dword [rbx + 0x4a0c], xmm1
movss xmm0, dword [rbx + 0x3a20]
mulss xmm0, dword [0x140079f9c]
or dword [rbx + 0x49f8], 0x41
movss dword [rbx + 0x4a58], xmm0
call fcn.140013440
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140024c40
lea r11, [0x140072b50]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140024c23
cmp byte [r8], r9b
jne 0x140024c23
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140024c10
not ecx
call fcn.14001b2e0
test rax, rax
je 0x140024c8f
cmp byte [rax + 0xbe], 0
je 0x140024c8f
mov byte [rax + 0xc3], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xc5], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xe4], 1
mov edx, 0x10
inc word [rbx + 0x5e88]
movsx r9d, word [rbx + 0x5e88]
call fcn.140013440
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.14001e070
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14006bfe0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14002a800
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5fe0], 0
lea rbx, [rcx + 0x5fe8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14002a8a7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14002a85a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14002d1b0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140013ff0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5fe0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5ff0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140086ce8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14002a8af
mov rcx, rbx
call fcn.140013ff0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14002abd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x140086cf0]
xor ebp, ebp
cmp byte [rbx + 0x5f38], bpl
jne 0x14002acaf
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14002aca8
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.140013800
mov rsi, rax
test rax, rax
je 0x14002aca8
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x14002ac34
mov rcx, rax
call fcn.14002ae00
mov r8, qword [0x140086cf0]
test r8, r8
je 0x14002ac9f
movsx rdx, word [r8 + 0x60b8]
lea rcx, [r8 + 0x60bc]
mov r9d, dword [r8 + 0x3f60]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x14002ac94
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60b8], cx
movsx rax, cx
lea rcx, [r8 + 0x60bc]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x60b4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x5f38], 1
movss xmm0, dword [rbx + 0x5f3c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14002ad3e
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5f3c], xmm0
jb 0x14002ad3e
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x14002ad31
mov rax, qword [0x140086cf0]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5f3c], ebp
call fcn.14002b060
lea rdx, [0x14007267c]
mov rcx, rdi
mov rsi, rax
call fcn.140013710
mov rdi, rax
test rax, rax
je 0x14002ad38
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14002ad38
mov byte [rbx + 0xce], 1
mov dword [rbx + 0x5f3c], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14002ad60
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140086cf0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14002adc3
mov qword [rsp], rbx
lea rbx, [0x140072b50]
nop dword [rax]
cmp r9b, 0x23
jne 0x14002ada3
cmp byte [r8], r9b
jne 0x14002ada3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14002ad90
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f50]
not eax
mov r8, qword [r10 + 0x5f58]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x14002adef
cmp dword [r8 + 8], eax
je 0x14002adf6
add r8, 0x48
cmp r8, rcx
jne 0x14002ade0
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x140040450
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x140086040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x140086cf0]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14004066e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14004066e
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x140086cf0]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x140040524
movsx rdx, word [r8 + 0x60b8]
lea rax, [r8 + 0x60bc]
mov r9d, dword [r8 + 0x3f60]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x140040519
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60b8], cx
movsx rax, cx
lea rax, [rax*8 + 0x60bc]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x60b0]
test rdi, rdi
je 0x140040541
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x140040544
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, str.imgui_impl_win32
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x140040587
mov rsi, qword [r8 + 0x90]
jmp 0x14004058a
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1400405b5
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x140086cf0]
mov rcx, qword [rax + 0x4b10]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x14004062e
inc rbx
cmp rbx, 5
jl 0x140040610
jmp 0x14004065a
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x140040670
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14006bfe0
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x14005ed80
Capabilities:
Create thread
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140086040]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor ebx, ebx
lea ecx, [rbx + 8]
call fcn.14006c000
lea rcx, [0x14006aaa0]
mov qword [rax], rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140010c00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14005ef4f
cmp dword [rsp + 0x38], ebx
je 0x14005ef43
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14005ef43
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
call fcn.14005fd40
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x14005ee54
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
xor r8d, r8d
lea rdx, [0x140070f31]
jmp 0x14005ee9d
mov edx, 0x5c
lea rcx, [rsp + 0x60]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
test rax, rax
je 0x14005ee6e
inc rax
jmp 0x14005ee73
lea rax, [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14005ee90
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000ea90
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14005eee7
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005eee2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005eee2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006c27c
call fcn.14005dff0
test al, al
je 0x14005ef3a
mov ecx, 0xdcf
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14005fb90
lea rdx, [0x140068710]
lea rcx, [rsp + 0x30]
call fcn.140010b50
nop
mov rcx, rax
call fcn.14000f0c0
nop
lea rcx, [rsp + 0x30]
call fcn.14000f0a0
call fcn.14000f100
call fcn.140008630
call fcn.140004050
call fcn.14006bd70
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14005fb90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140086040]
xor rax, rsp
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
cmp byte [0x1400787a7], 0
mov rbx, rax
mov rcx, qword [0x1400787a0]
mov qword [rsp + 0x20], rcx
je 0x14005fd0f
xor ecx, ecx
cmp dword [0x140086088], 2
jl 0x14005fcd4
movdqa xmm2, xmmword [0x14007a5a0]
movdqa xmm3, xmmword [0x14007a5b0]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x14007a7b0]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14007a5f0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x20]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14007a630]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14007a650]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x20], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14007a5f0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x24]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14007a630]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14007a650]
xorps xmm2, xmm0
movd dword [rsp + 0x24], xmm2
jmp 0x14005fd0f
lea r8, [rsp + 0x20]
nop dword [rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8 - 1], al
cmp ecx, 8
jl 0x14005fce0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowTextA]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14006bfe0
add rsp, 0x30
pop rbx
ret
Function at 0x14006bd70
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
movsd xmm6, qword [0x14007a000]
movaps xmmword [rsp + 0x30], xmm7
movsd xmm7, qword [0x140079fd8]
movaps xmmword [rsp + 0x20], xmm8
xorps xmm8, xmm8
xor ebx, ebx
cmp byte [0x140086e7f], 0
je 0x14006bf1b
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006bde3
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006bde3
cmp dword [0x140086e90], 0
je 0x14006bde3
cmp byte [0x1400860fc], 0
je 0x14006be82
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006be20
cmp dword [0x140086e90], 0
je 0x14006be20
cmp byte [0x1400860fc], 0
jne 0x14006be20
cmp byte [0x140086d99], 0
je 0x14006be20
cmp byte [0x140086e8c], 0
jne 0x14006be20
cmp byte [0x140086d9a], 0
je 0x14006be82
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006bd9e
cmp dword [0x140086e90], 0
je 0x14006bd9e
cmp byte [0x1400860fc], 0
jne 0x14006bd9e
cmp byte [0x140086d99], 0
je 0x14006bd9e
cmp byte [0x140086e8c], 0
jne 0x14006bd9e
cmp byte [0x140086d9a], 0
je 0x14006bd9e
cmp byte [0x140086e9e], 0
je 0x14006bd9e
call fcn.14006b8d0
cmp ebx, eax
jge 0x14006bda0
mov ecx, ebx
call fcn.14006b4d0
movd xmm1, dword [0x1400860cc]
cvtdq2pd xmm1, xmm1
mulsd xmm1, xmm7
mulsd xmm0, xmm1
comisd xmm0, xmm8
jb 0x14006bebc
addsd xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_floor
jmp 0x14006bec5
subsd xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
mov ecx, ebx
cvttsd2si edi, xmm0
call fcn.14006b260
movd xmm1, dword [0x1400860e0]
cvtdq2pd xmm1, xmm1
mulsd xmm1, xmm7
mulsd xmm0, xmm1
comisd xmm0, xmm8
jb 0x14006bef6
addsd xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_floor
jmp 0x14006beff
subsd xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
cvttsd2si edx, xmm0
call fcn.14006b740
mov r8d, edi
cvttsd2si ecx, xmm0
call fcn.14006ba30
inc ebx
jmp 0x14006bda0
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14006bda0

Function at 0x14006cbb8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006cc02
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006cc02
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006cc02
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006cc02
cmp dword [rcx + 0x84], 0xe
jbe 0x14006cc02
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006cc04
xor al, al
add rsp, 0x28
ret
Function at 0x140001030
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx], 0x19119111
mov rbx, rcx
jne 0x140001087
movsxd rax, dword [rcx + 4]
test eax, eax
je 0x140001087
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001087
call sub.ntoskrnl.exe_PsGetProcessSectionBaseAddress
test rax, rax
je 0x140001087
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
jmp 0x14000108c
mov eax, 0xc0000001
add rsp, 0x20
pop rbx
ret

Function at 0x140001094
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx], 0x19119111
mov rsi, rcx
je 0x1400010b8
mov eax, 0xc0000001
jmp 0x14000116d
xor ebx, ebx
lea r9, [rsp + 0x20]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
lea rdx, [rsp + 0x20]
mov edi, ebx
lea ecx, [rbx + 0x42]
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x14000116b
test rdi, rdi
je 0x1400010f0
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0x42
mov rdi, rax
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
je 0x1400010e0
test rdi, rdi
je 0x14000116b
mov r8d, dword [rdi]
test r8d, r8d
je 0x140001160
lea rdx, [rdi + 0x18]
test byte [rdx - 8], 1
je 0x140001155
cmp qword [rdx], 0x200000
jne 0x140001155
mov ecx, dword [0x140001dc0]
mov r9b, byte [0x140001dc4]
cmp dword [rdx + 8], ecx
jne 0x140001155
cmp byte [rdx + 0xc], r9b
je 0x14000117d
inc ebx
add rdx, 0x20
cmp ebx, r8d
jb 0x14000112e
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsi + 8]
mov rax, qword [rdx - 0x10]
mov qword [rcx], rax
jmp 0x14000116b