joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140062f40
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140063115
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
call fcn.14003f2a0
lea rax, [0x140ae528f]
mov ebx, 0xb
call fcn.14003fb20
nop
call fcn.14003f300
mov rax, qword [rsp + 0x40]
test rax, rax
jne 0x140062f95
xor ebx, ebx
xor ecx, ecx
jmp 0x140062fa8
mov ebx, dword [rax + 4]
mov rax, qword [rsp + 0x48]
nop dword [rax]
call fcn.14005a020
mov rcx, rax
mov rax, rcx
call fcn.140062d80
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140062fea
nop dword [rax]
call fcn.14003f2a0
lea rax, [0x140ae9681]
mov ebx, 0xe
call fcn.14003fb20
mov rax, qword [rsp + 0x80]
nop
call fcn.14003f860
call fcn.14003f300
call fcn.14003f2a0
call fcn.14003f4e0
call fcn.14003f300
mov rax, qword [rsp + 0x78]
lea rcx, [rax - 1]
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x40]
mov ebx, dword [rdx]
mov rax, qword [rsp + 0x48]
call fcn.140059f00
mov rcx, qword [rsp + 0x78]
cmp rax, rcx
mov rax, qword [rsp + 0x30]
mov rdx, rcx
cmovb rdx, rax
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov edi, 1
mov rcx, rdx
nop
call fcn.14005ae80
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x24], ecx
mov qword [rsp + 0x38], rbx
call fcn.14003f2a0
lea rax, [0x141031a78]
mov ebx, 1
call fcn.14003fb20
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x38]
call fcn.14003fb20
lea rax, [0x141031ef8]
mov ebx, 1
call fcn.14003fb20
mov eax, dword [rsp + 0x24]
movsxd rax, eax
call fcn.14003f940
call fcn.14003f300
mov rax, qword [rsp + 0x40]
mov ebx, dword [rax]
mov rax, qword [rsp + 0x48]
call fcn.140059f00
mov rcx, qword [rsp + 0x78]
cmp rax, rcx
jae 0x140063100
mov rcx, qword [rsp + 0x40]
mov ebx, dword [rcx]
mov rax, qword [rsp + 0x48]
call fcn.140059f00
mov qword [rsp + 0x28], rax
call fcn.14003f2a0
lea rax, [0x140ada3cb]
mov ebx, 2
nop dword [rax]
call fcn.14003fb20
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x28]
sub rax, rcx
call fcn.14003f9a0
call fcn.14003f300
nop dword [rax]
call fcn.14003f2a0
call fcn.14003f4e0
call fcn.14003f300
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.14006f0a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.140062f40
Function at 0x1400643e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14006448f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x1400644e0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.14006ef80
xorps xmm15, xmm15
mov r14, qword [0x1416f9498]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.14006f0a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.1400643e0
Function at 0x140065780
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400659c6
push rbp
mov rbp, rsp
sub rsp, 0x48
test ebx, ebx
je 0x1400657a3
mov dword [rsp + 0x60], ebx
lea rcx, [0x1408b9a80]
jmp 0x1400657b2
xor eax, eax
add rsp, 0x48
pop rbp
ret
mov rcx, qword [rcx + 0x248]
test rcx, rcx
je 0x1400657ef
mov rdx, qword [rcx + 0x128]
nop
cmp rax, rdx
jb 0x1400657ab
mov rsi, qword [rcx + 0x130]
cmp rax, rsi
jae 0x1400657ab
movsxd rcx, ebx
lea rax, [rdx + rcx]
nop dword [rax + rax]
cmp rsi, rax
jb 0x14006593b
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 0x28], rax
nop
nop
nop
lea rax, [0x141671720]
nop
call fcn.1400104a0
mov rbx, qword [0x141671730]
lea rax, [0x1409de120]
mov ecx, dword [rsp + 0x60]
call fcn.140015960
mov byte [rsp + 0x1f], bl
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
nop
nop
nop
lea rax, [0x141671720]
call fcn.140010700
movzx ecx, byte [rsp + 0x1f]
nop dword [rax]
test cl, cl
jne 0x1400658a7
call fcn.14003f2a0
lea rax, [0x140aed7e1]
mov ebx, 0x11
call fcn.14003fb20
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.14003f9a0
lea rax, [0x140add92f]
mov ebx, 6
call fcn.14003fb20
mov rax, qword [rsp + 0x28]
nop dword [rax]
call fcn.14003f9a0
lea rax, [0x140aec2cf]
mov ebx, 0x10
call fcn.14003fb20
call fcn.14003f300
lea rax, [0x1408b9a80]
jmp 0x140065925
mov rax, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 0x128]
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x130]
mov qword [rsp + 0x30], rdx
call fcn.14003f2a0
lea rax, [0x140adf66a]
mov ebx, 7
call fcn.14003fb20
mov rax, qword [rsp + 0x38]
call fcn.14003f9a0
lea rax, [0x140ae1250]
mov ebx, 8
nop dword [rax + rax]
call fcn.14003fb20
mov rax, qword [rsp + 0x30]
call fcn.14003f9a0
call fcn.14003f4e0
call fcn.14003f300
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x248]
test rax, rax
jne 0x1400658b2
lea rax, [0x140b1e581]
mov ebx, 0x2e
call fcn.14003d800
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rsi
call fcn.14003f2a0
lea rax, [0x140aed7e1]
mov ebx, 0x11
call fcn.14003fb20
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.14003f9a0
lea rax, [0x140ae9649]
mov ebx, 0xe
call fcn.14003fb20
mov rax, qword [rsp + 0x38]
nop dword [rax]
call fcn.14003f9a0
lea rax, [0x140ada8b5]
mov ebx, 3
call fcn.14003fb20
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call fcn.14003f9a0
call fcn.14003f4e0
call fcn.14003f300
lea rax, [0x140b069e8]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.14003d800
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.14006f0a0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop dword [rax]
jmp fcn.140065780
Function at 0x140065a00
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140065c86
push rbp
mov rbp, rsp
sub rsp, 0x48
test ebx, ebx
je 0x140065a24
cmp ebx, 0xffffffff
je 0x140065a24
lea rcx, [0x1408b9a80]
jmp 0x140065a33
xor eax, eax
add rsp, 0x48
pop rbp
ret
mov rcx, qword [rcx + 0x248]
test rcx, rcx
je 0x140065a54
nop dword [rax + rax]
cmp qword [rcx + 0x128], rax
ja 0x140065a2c
cmp qword [rcx + 0x130], rax
jbe 0x140065a2c
jmp 0x140065a56
xor ecx, ecx
mov dword [rsp + 0x60], ebx
test rcx, rcx
je 0x140065ab9
mov qword [rsp + 0x20], rcx
mov rdx, qword [rcx + 0x238]
lea rax, [0x1409de060]
mov esi, ebx
mov rbx, rdx
mov ecx, esi
call fcn.1400157e0
mov rax, qword [rax]
test rax, rax
jne 0x140065ab3
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x128]
mov ebx, dword [rsp + 0x60]
movsxd rsi, ebx
lea rax, [rdx + rsi]
mov rcx, qword [rcx + 0x130]
cmp rcx, rax
jb 0x140065bf6
add rsp, 0x48
pop rbp
ret
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 0x28], rax
nop
nop
nop
lea rax, [0x141671720]
call fcn.1400104a0
mov rbx, qword [0x141671730]
lea rax, [0x1409de120]
mov ecx, dword [rsp + 0x60]
nop
call fcn.1400157e0
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
nop
nop
nop
lea rax, [0x141671720]
call fcn.140010700
mov rax, qword [rsp + 0x40]
test rax, rax
jne 0x140065b64
call fcn.14003f2a0
lea rax, [0x140aed7f2]
mov ebx, 0x11
call fcn.14003fb20
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.14003f9a0
lea rax, [0x140add92f]
mov ebx, 6
call fcn.14003fb20
mov rax, qword [rsp + 0x28]
nop
call fcn.14003f9a0
lea rax, [0x140aec2cf]
mov ebx, 0x10
call fcn.14003fb20
call fcn.14003f300
lea rax, [0x1408b9a80]
jmp 0x140065be0
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 0x18], rax
mov rcx, qword [rax + 0x128]
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x130]
mov qword [rsp + 0x30], rdx
call fcn.14003f2a0
lea rax, [0x140adf66a]
mov ebx, 7
call fcn.14003fb20
mov rax, qword [rsp + 0x38]
call fcn.14003f9a0
lea rax, [0x140ae1250]
mov ebx, 8
call fcn.14003fb20
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.14003f9a0
call fcn.14003f4e0
call fcn.14003f300
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x248]
nop dword [rax + rax]
test rax, rax
jne 0x140065b6a
lea rax, [0x140b1e5af]
mov ebx, 0x2e
call fcn.14003d800
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
call fcn.14003f2a0
lea rax, [0x140aed7f2]
mov ebx, 0x11
call fcn.14003fb20
mov eax, dword [rsp + 0x60]
movsxd rax, eax
nop dword [rax]
call fcn.14003f9a0
lea rax, [0x140ae9649]
mov ebx, 0xe
call fcn.14003fb20
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.14003f9a0
lea rax, [0x140ada8b5]
mov ebx, 3
call fcn.14003fb20
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call fcn.14003f9a0
call fcn.14003f4e0
call fcn.14003f300
lea rax, [0x140b06a09]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.14003d800
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.14006f0a0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop dword [rax]
jmp fcn.140065a00
Function at 0x14089fdb0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1416382e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14089fdd0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14089fdd8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14089fdd0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x14089fe25
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14089fe1c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14089fdd0
add rax, 0x28
cmp rax, r9
jne 0x14089fe08
xor eax, eax
ret

Function at 0x14089fe30
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1416382e0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14089fe50
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14089fe58
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x14089fe50
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x14089fee0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1416382e0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14089ff00
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x14089ff08
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x14005ea90
Capabilities:
Inspect section memory permissions

Disassembly:
mov r8d, ecx
mov r9d, ecx
xor ecx, ecx
and r8d, 0xe0000000
cmp r8d, 0xe0000000
mov eax, 0x40
cmovne eax, ecx
mov edx, eax
bts edx, 7
cmp r8d, 0xa0000000
cmovne edx, eax
mov eax, edx
or eax, 0x20
cmp r8d, 0x60000000
cmovne eax, edx
mov ecx, eax
or ecx, 0x10
cmp r8d, 0x20000000
cmovne ecx, eax
mov eax, ecx
or eax, 4
cmp r8d, 0xc0000000
cmovne eax, ecx
mov ecx, eax
or ecx, 8
cmp r8d, 0x80000000
cmovne ecx, eax
mov eax, ecx
or eax, 2
cmp r8d, 0x40000000
cmovne eax, ecx
mov ecx, eax
or ecx, 1
test r8d, r8d
cmovne ecx, eax
mov eax, ecx
bts eax, 9
bt r9d, 0x1a
cmovae eax, ecx
ret
Function at 0x140002930
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x1400cfb34], 0
lea rdi, [0x1400cfb30]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x140002a08
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x140002960
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x140002a3e
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x140002a20
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x140002a7f
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x140002a63
cmp byte [r8], r9b
jne 0x140002a63
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x140002a50
not eax
pop rdi
ret

Function at 0x140002c60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
test r8, r8
je 0x140002c79
mov qword [r8], 0
lea rdx, [0x140091df4]
call fcn.140002a90
mov rbx, rax
test rax, rax
jne 0x140002c98
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
xor edx, edx
mov r8d, 2
mov qword [rsp + 0x38], rsi
mov rcx, rbx
call fcn.14005a940
test eax, eax
jne 0x140002d52
mov rcx, rbx
call fcn.140059d68
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140002d52
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14005a940
test eax, eax
jne 0x140002d52
mov rax, qword [0x1400cf950]
mov rbp, rsi
test rax, rax
je 0x140002cf4
inc dword [rax + 0x3c8]
mov rcx, rbp
call fcn.140064090
mov rsi, rax
test rax, rax
je 0x140002d52
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call fcn.14005ea28
mov rcx, rbx
cmp rax, rbp
je 0x140002d40
call fcn.14005a5a0
mov rax, qword [0x1400cf950]
test rax, rax
je 0x140002d36
dec dword [rax + 0x3c8]
mov rcx, rsi
call fcn.14005e7b4
jmp 0x140002d5a
call fcn.14005a5a0
test rdi, rdi
je 0x140002d4d
mov qword [rdi], rbp
mov rax, rsi
jmp 0x140002d5c
mov rcx, rbx
call fcn.14005a5a0
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001f2c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14001f479
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14001f356
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001ec30
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001e260
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14001f347
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140013cc0
mov dword [rbx + 0x80], 0
jmp 0x14001f465
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
mov r8d, 4
call fcn.14001d180
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14003ab60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov r14d, dword [0x1400cfaf4]
movsxd rax, dword [0x1400a7d18]
xor edx, edx
cmp eax, 0x7b
ja 0x14003ab9a
lea rdx, [0x1400cd4d0]
mov rdx, qword [rdx + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
mov edi, 0xf
mov qword [rbp - 8], rdi
mov byte [rbp - 0x20], 0
test rdx, rdx
jne 0x14003abe0
mov qword [rbp - 0x10], 0xa
movsd xmm0, qword [str.Select_Key]
movsd qword [rbp - 0x20], xmm0
movzx eax, word [0x140096260]
mov word [rbp - 0x18], ax
mov byte [rbp - 0x16], dl
jmp 0x14003ac07
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14003abf0
lea rcx, [rbp - 0x20]
call fcn.14004e9d0
mov rdi, qword [rbp - 8]
cmp r14d, 1
jne 0x14003ad33
cmp rdi, 0x11
jb 0x14003ac4a
lea rbx, [rbp - 0x20]
cmp rdi, 0xf
cmova rbx, qword [rbp - 0x20]
mov qword [rbp - 0x10], 0x11
mov r8d, 0x11
lea rdx, str.Press_key_to_bind
mov rcx, rbx
call fcn.140083950
mov byte [rbx + 0x11], 0
jmp 0x14003ad2f
mov rcx, rdi
shr rcx, 1
movabs rsi, 0x7fffffffffffffff
mov rax, rsi
sub rax, rcx
cmp rdi, rax
jbe 0x14003ac92
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140052b14
test rax, rax
je 0x14003addc
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14003accf
lea rax, [rcx + rdi]
mov esi, 0x1f
cmp rax, rsi
cmova rsi, rax
lea rcx, [rsi + 1]
test rcx, rcx
jne 0x14003acaf
xor ebx, ebx
jmp 0x14003accf
cmp rcx, 0x1000
jb 0x14003acc7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003add6
jmp 0x14003ac73
call fcn.140052b14
mov rbx, rax
mov qword [rbp - 0x10], 0x11
mov qword [rbp - 8], rsi
movups xmm0, xmmword [str.Press_key_to_bind]
movups xmmword [rbx], xmm0
movzx ecx, byte [0x140096278]
mov byte [rbx + 0x10], cl
mov byte [rbx + 0x11], 0
cmp rdi, 0xf
jbe 0x14003ad2b
lea rdx, [rdi + 1]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ad26
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003addc
call fcn.140052a9c
mov qword [rbp - 0x20], rbx
mov rdi, qword [rbp - 8]
mov dword [rbp + 0x28], 0x42fa0000
mov dword [rbp + 0x2c], 0x41a00000
lea rcx, [rbp - 0x20]
cmp rdi, 0xf
cmova rcx, qword [rbp - 0x20]
lea rdx, [rbp + 0x28]
call fcn.140025a20
test al, al
je 0x14003ad83
test r14d, r14d
jne 0x14003ad83
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x14003adf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14003adba
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003adb5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003add0
call fcn.140052a9c
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
call fcn.1400667d0
nop
call fcn.1400389d0
nop
call fcn.1400667d0
int3
Function at 0x14003ae40
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rsi, rcx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor ebx, ebx
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14003ae74
xor eax, eax
jmp 0x14003af01
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
call fcn.140083590
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003aef6
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call fcn.140065320
test eax, eax
jne 0x14003aeb7
mov ebx, dword [rsp + 0x28]
jmp 0x14003aef6
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003aef6
nop dword [rax]
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call fcn.140065320
test eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rdi
cmove ebx, dword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003aed0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14003e290
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x13b0
call fcn.14007e430
sub rsp, rax
mov ebx, edx
mov edi, ecx
call fcn.140053f34
mov dword [rsp + 0x24], eax
mov r8d, 1
mov r10d, 0x270
mov dword [rsp + 0x13a4], 0xffffffff
nop word [rax + rax]
mov r9d, eax
shr r9d, 0x1e
xor r9d, eax
imul eax, r9d, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x24], eax
inc r8
cmp r8, r10
jb 0x14003e2d0
mov dword [rsp + 0x20], r10d
lea r8, [rsp + 0x28]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14003e300
mov eax, dword [rsp + 0x20]
sub ebx, edi
inc ebx
xor edx, edx
mov ecx, dword [rsp + rax*4 + 0x24]
mov eax, ecx
shr eax, 0xb
and eax, dword [rsp + 0x13a4]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
div ebx
mov rbx, qword [rsp + 0x13c0]
lea eax, [rdi + rdx]
add rsp, 0x13b0
pop rdi
ret