joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14015f683
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl dx, 0x84
movsxd rax, eax
xadd si, dx
call fcn.14016e93d
mov qword [rsp + r8 - 0x22], rdx
movsx ebp, byte [rsp + r8*2 - 0x44]
neg eax
xor eax, 0xbe006b10
add qword [rsp + rdx*8], rbp
movzx esi, bpl
pop rdi
mov qword [rsp + r8 - 0x22], rbx
and dil, r8b
movsx ecx, sil
xor dword [rsp + r8 - 0x22], eax
btc rdi, 0xa7
pop rbx
jae 0x14015ed2a

Function at 0x14016219c
Capabilities:
Execute anti-debugging instructions

Disassembly:
and esi, 0x202ad297
lea r10, [r10 + rdi*2 - 0x1297074]
push rcx
lea rdx, [rbp + rsi*4 - 0x677a825a]
bt rdi, rdi
mov eax, dword [r10 + rdi*2 - 0x1297070]
shr rdi, cl
btr bp, 0x2a
xchg rbp, r8
xor eax, ebx
dec eax
shl rbp, cl
sar byte [rsp + r8*2 - 0x16f], 0xe5
ror si, 0xea
ror eax, 1
call fcn.14015235c
xor eax, ebx
mov r8d, edx
mov edi, edx
neg eax
inc eax
inc dx
neg rcx
mov qword [rsp + rbp - 0x4b0a3000], 0xffffffffe803d094
xor eax, 0x8eaa3b1a
bts di, r8w
inc eax
dec r8b
mov qword [rsp + rbp - 0x4b0a3000], rbx
movsx ebx, cl
sal di, cl
bswap edx
xor dword [rsp + rbp - 0x4b0a3000], eax
bts rdx, rdi
pop rbx
lea rsi, [rdx - 0x1977945d]
movsxd rax, eax
jb 0x14014fa73
xor dx, dx
je 0x140175368
mov r8d, 0x621494b8
mov edi, 0x8b963085
mov eax, dword [r8 + r9 - 0x621494b8]
dec dil
movzx ebp, r8b
je 0x14015007f
mov ecx, dword [r9 + r8 - 0x621494b4]
push rbx
rol r8d, 0x70
cpuid
lea r9, [r9 + rbp*8 - 0x5c8]
bt r8d, edi
sub r8w, 0x293f
push r8
mov dword [r9 + rbp*2 - 0x164], eax
mov esi, r8d
or word [rsp + rbp*2 - 0x170], di
xor word [rsp + rbp*4 - 0x2db], bp
mov dword [r9 + rbp*2 - 0x168], ebx
xadd dword [rsp + rbp*2 - 0x16f], edi
mov dword [rdi + r9 - 0x94b834], ecx
mov dword [rdi + r9 - 0x94b838], edx
pop rcx
pop rbx
shr rsi, 0xce
jb 0x140152053
jne 0x14015880c
mov esi, 0xf0adf198
or esi, esi
movsx edx, si
sbb r10, 4
mov r8d, dword [r10 + riz]
btc si, 0x95
xor r8d, ebx
lea rbp, [rdx + rdx*4 + 0x6884efb4]
xadd rdx, rbp
lea r8d, [r8 + rbp - 0x6f7364eb]
rol r8d, 3
xor r8d, 0x1033af3d
movzx eax, bpl
xor rax, 0x19a2ddb9
not r8d
movsx edi, sil
jbe fcn.14016d9fb
seta sil
lea r8d, [r8 + rax*2 - 0x29a74103]
bswap r8d
movzx ecx, bp
xadd edx, esi
push rbx
ror rsi, cl
rol edi, cl
xor dword [rsp + rax - 0x19a2dd21], r8d
pop rbx
lea rsi, [rax + 0x2cbac0b4]
bts bp, 0xa
movsxd r8, r8d
not eax
btc rdx, 5
cmovae rdi, rcx
adc r11, r8
push rdx
mov rbp, qword [rsi + r9 - 0x465d9dd5]
push rcx
mov r8w, word [rbp + rdx - 0x59328a65]
rol si, 0x6e
mov ebp, ecx
lea r9, [rdx + r9 - 0x59328a5f]
jb 0x1401799a2
call fcn.14015d7b0
xor word [rsp + rsi - 0x465d6775], dx
mov word [r9 + rsi - 0x465d6775], r8w
sbb rdx, rcx
mov qword [rsp + rdx - 0x593198cd], r11
ret 8
Function at 0x1401626c8
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx ebp, dil
bswap ecx
push rdx
sal dx, 0x21
not ecx
mov qword [rsp + r8 + 8], rdx
inc dword [rsp + r8*8 + 9]
cwde
inc ecx
bswap ecx
add ecx, 0xf4a0e32d
rol edi, 0x83
jae 0x140172b65
sub r10, 4
mov esi, 0xc31a8833
movzx ecx, si
mov r8d, dword [r10 + rcx*2 - 0x11066]
xor r8d, ebx
movsx eax, cx
cqo
or cx, cx
ror r8d, 3
cwde
sar edx, 0xee
dec r8d
idiv rax
mov edi, 0xc2230b8e
xadd esi, ecx
bswap r8d
xor r8d, 0x6bbab225
push rbx
xor dword [rsp + rax - 1], r8d
pop rbx
cqo
btc rcx, rax
movsxd r8, r8d
mul al
adc r11, r8
movsx ebp, cl
lea rdi, [rdx + rax*8 + 0x1487072b]
mov al, byte [r9 + rax*8 - 8]
xor ecx, esi
mov sil, byte [r9 + rcx*2 - 0x330ac]
movsx r8d, cx
lea r9, [r9 + rcx*2 - 0x330ac]
sal rbp, 0xcc
adc al, sil
imul bp, bp
btc rbp, r8
mov word [rcx + r9 - 0x19857], ax
neg r8
add rdx, r11
jmp rdx
or r8, 0x72b64e84
mov qword [rsp + rdx + 0x10], rbx
dec eax
xor dword [rsp + r8 - 0x72b64e74], ecx
jmp 0x140164401
Function at 0x1401684a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp ebx, 3
call fcn.14017705c
dec dx
ror bp, 1
lea r8, [rdx + rax - 0x1b64f963]
not bp
ror bp, 1
not bp
xor bx, bp
lea rdi, [rax + rcx + 0x49aa0b8c]
btr ax, di
adc rbp, rsp
not r8b
dec cx
mov dx, word [rbp + rcx*4 - 0x3ec]
call fcn.14016b584
cmp ebx, 2
lea rsp, [rsp + 0x10]
jne 0x1401468b3
mov rdx, rax
jmp 0x1401533cc

Function at 0x1401695eb
Capabilities:
Authenticate hmac

Disassembly:
push 0x3285eeb3
lea rsp, [rsp + 0x10]
jne 0x140150e02

Function at 0x14016b2ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.14015e3e1
mov edi, 0x6abd6485
lea r8, [rdi + 0x2e29339d]
lea r10, [r10 + rdi - 0x6abd6489]
mov eax, 0x959f2539
mov eax, dword [r10 + rdi - 0x6abd6485]
mov ecx, edi
dec rdi
xor eax, ebx
movzx ebp, di
bts rbp, rdi
not eax

Function at 0x140170306
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x1401533cc
mov qword [rsp + rdx*4], r11
ret
push 0x728debaa
shr word [rsp + 5], 0x67
jp 0x14015c932
cqo
mov qword [rsp + rax - 0x5fafd126], rbx
pop rsi
ja 0x140158a8f
mov eax, 0x80b42c39
or eax, 0x740190b0
adc rax, rax
mov rax, qword [rbp + rbx*8]
cmp ebx, 1
jmp 0x140170e5a
ja 0x14016fa42
dec ebx
jmp 0x14015f6bb
call fcn.1401646ae
sub r10, 4
push 0x248fd804
pop r8
mov esi, dword [r10 + r8 - 0x248fd804]
movzx edx, r8b
xor esi, ebx
shr dl, 0xc6
mov ecx, 0x552aaa9f
lea esi, [rsi + rdx*2 + 0x77badabc]
ror esi, 1
lea esi, [r8 + rsi + 0x77035720]
jmp 0x140166bf2
lea rsp, [rsp + 8]
jne 0x140158556
mov eax, 0xf9891ab7
mov rax, qword [rbp + riz]
sub rsp, 0x20
push 0x1c217692
not word [rsp + 6]
call fcn.14017099d
movzx ebp, cl
not esi
not rdx
movzx edi, r8w
imul cx, cx
push rbx
ror rcx, 0x27
or edi, ebp
xor dword [rsp + r8*2 - 0x491fb008], esi
pop rbx
movsx eax, r8w
sub r8d, edx
inc ecx
movsxd rsi, esi
call fcn.14014fbc5
mov rdi, qword [r9]
mov edx, 0x1ba7b18a
mov r8, qword [rdx + r9 - 0x1ba7b182]
movsx ebp, dl
movsx ecx, dl
lea r9, [r9 + rdx*4 - 0x6e9ec618]
inc rdx
movzx eax, dx
mov qword [rdx + rdi - 0x1ba7b18b], r8
lea r10, [r10 + rdx*4 - 0x6e9ec630]
mov r8d, edx
mov esi, dword [r10 + rdx - 0x1ba7b18b]
not rdx
rol rcx, cl
cqo
xor esi, ebx
xadd edx, ecx
ror esi, 2
not esi
imul dl
bswap esi
neg esi
push rbx
or dl, ah
lea r8, [rcx*4 + 0x461e61bc]
lea r8, [rax + rcx*4 - 0x4e703c6f]
xor dword [rsp + rax], esi
bswap rdx
shr eax, 0xf1
je 0x140168d71
pop rbx
movsxd rsi, esi
mul ecx
not al
adc r11, rsi
push rbp
imul qword [rsp + rdx]
jae 0x14014bc35
add byte [rsi + 0x28238c92], bh
movabs byte [0xc304cd82f392548b], al
test dword [rdx + 0x24e156a7], edi
xor dword [rsi - 0x1a], esp
push rbx
mov esi, dword [rdi]
out dx, eax
retf 0x71d
xor dword [rsp + rcx], ebp
movsx ebx, sil
sar r8b, 0xe1
lea rdi, [rdx - 0x4c46bcf3]
pop rbx
mul eax
movsxd rbp, ebp
sar esi, 0x94
sal edi, 0x42
adc r11, rbp
div sil
mov rbp, r9
xadd r8d, edx
lea r9, [r9 + rcx*4 - 8]
setg al
cbw
lea rax, [rcx + 0x4b0d0d1d]
mov qword [rax + r9 - 0x4b0d0d1d], rbp
sal di, 0xcd
ja fcn.14015c1e0
jmp 0x14014618d
jne 0x14015eceb
call fcn.140148051
Function at 0x140170e65
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr qword [rsp + rdx - 0xb3], 0x61
push rsi
adc r11, rdi
mov r8, r9
sal rsi, cl
lea r9, [r9 + rdx*4 - 0x2f0]
je 0x1401721fa
mov dword [r9 + rdx*4 - 0x2ec], r8d
mul ebp
btr ax, 0xae
pop rsi
pop r8
pop rbp
jae fcn.14015c1e0

Function at 0x140176f9b
Capabilities:
Execute anti-debugging instructions

Disassembly:
cwd
movsxd r8, r8d
adc r11, r8
mov qword [rsp + rsi], 0x2eac151c
mov rcx, qword [r9 + rsi*4]
jmp 0x14016b7f6
Function at 0x140002930
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000297a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000297a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000297a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000297a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000297a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000297c
xor al, al
add rsp, 0x28
ret
Function at 0x140010d70
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
movzx eax, byte [0x14021404b]
test eax, eax
jne 0x140010d89
jmp 0x140010e61
mov dword [rsp + 0x24], 0
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140010da8
mov byte [rsp + 0x21], 1
jmp 0x140010dad
mov byte [rsp + 0x21], 0
movzx eax, byte [rsp + 0x21]
mov byte [rsp + 0x20], al
mov rcx, qword [rsp + 0x50]
call fcn.14000ba20
mov byte [rsp + 0x22], al
mov edx, dword [rsp + 0x24]
lea rcx, [0x140213bc0]
call fcn.140014f60
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140010e18
movzx eax, byte [rsp + 0x22]
test eax, eax
je 0x140010e18
mov dword [rsp + 0x28], 5
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.140008770
mov rcx, rax
call fcn.14000a640
mov edx, 0x10001
lea rcx, [0x140213bc0]
call fcn.140014f60
jmp 0x140010e61
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140010e3d
movzx eax, byte [rsp + 0x22]
test eax, eax
jne 0x140010e3d
mov edx, 0x100
lea rcx, [0x140213bc0]
call fcn.140014f60
jmp 0x140010e61
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140010e61
cmp dword [rsp + 0x24], 0x10001
jne 0x140010e61
mov edx, 0x100
lea rcx, [0x140213bc0]
call fcn.140014f60
add rsp, 0x48
ret
Function at 0x140014cd0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x4b0
lea rbp, [rsp + 0x20]
mov dword [rbp + 0x50], 0x438
mov rax, qword [rbp + 0x4a0]
mov edx, dword [rax + 0x10]
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 8], rax
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 8]
call sub.KERNEL32.dll_Module32FirstW
call fcn.1400150a0
mov dword [rbp + 0x10], eax
mov rcx, qword [rbp + 0x4a8]
call fcn.140004f30
mov qword [rbp + 0x38], rax
lea rax, [rbp + 0x80]
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x18], 0
jne 0x140014d4a
mov qword [rbp + 0x28], 0
jmp 0x140014dca
mov rcx, qword [rbp + 0x18]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x140014d6b
mov qword [rbp + 0x20], 0
jmp 0x140014dc2
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x30], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x140014d93
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.1400fca20
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x10]
mov rcx, qword [rbp + 0x30]
mov r8d, ecx
mov rdx, qword [rbp + 0x18]
mov rcx, rax
call fcn.140014c10
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x28], rax
mov rdx, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x28]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140014dff
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x78]
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x4a8]
call fcn.140004260
mov rax, qword [rbp + 0x40]
jmp 0x140014e36
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 8]
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x140014d1b
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x48], 0
mov rcx, qword [rbp + 0x4a8]
call fcn.140004260
mov rax, qword [rbp + 0x48]
lea rsp, [rbp + 0x490]
pop rbp
ret
Function at 0x1400192e0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x2b0
lea rbp, [rsp + 0x20]
mov dword [rbp + 0x50], 0x238
xor edx, edx
mov ecx, 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 8], rax
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 8]
call sub.KERNEL32.dll_Process32FirstW
call fcn.1400150a0
mov dword [rbp + 0x10], eax
mov rcx, qword [rbp + 0x2a8]
call fcn.140004f30
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x7c]
mov qword [rbp + 0x20], rax
cmp qword [rbp + 0x20], 0
jne 0x14001934f
mov qword [rbp + 0x30], 0
jmp 0x1400193cf
mov rcx, qword [rbp + 0x20]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x140019370
mov qword [rbp + 0x28], 0
jmp 0x1400193c7
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x38], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x140019398
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.1400fca20
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x10]
mov rcx, qword [rbp + 0x38]
mov r8d, ecx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call fcn.140014c10
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x30], rax
mov rdx, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140019401
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x58]
mov dword [rbp + 0x14], eax
mov rcx, qword [rbp + 0x2a8]
call fcn.140004260
mov eax, dword [rbp + 0x14]
jmp 0x140019436
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 8]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140019323
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x18], 0
mov rcx, qword [rbp + 0x2a8]
call fcn.140004260
mov eax, dword [rbp + 0x18]
lea rsp, [rbp + 0x290]
pop rbp
ret
Function at 0x140095170
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add rsp, 0x28
ret

Function at 0x1400951b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add rsp, 0x28
ret

Function at 0x1400955d0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14017a820]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x14009565e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x140095602
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret
Function at 0x140095670
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14017a820]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x140095774
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x14009576f
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x140095744
cmp qword [rsp + 0x38], 2
jb 0x140095744
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140095744
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140095744
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x1400956b7
jmp 0x140095806
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x140095806
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x1400957dc
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400957dc
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400957dc
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140095774
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x1400c1110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x5c], 0
xorps xmm0, xmm0
movss dword [rsp + 0x60], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x64], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x68], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x6c], xmm0
mov dword [rsp + 0x70], 0
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x7c], 0
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x88], 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
xorps xmm0, xmm0
movss dword [rsp + 0x28], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x2c], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x30], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x34], xmm0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
lea r8, [rsp + 0x58]
mov edx, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
call fcn.1400c63d0
test eax, eax
je 0x1400c1296
movsxd rax, dword [rsp + 0x88]
imul rax, rax, 0xe
mov rcx, rax
call fcn.140099080
mov rcx, qword [rsp + 0xb0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x20]
mov edx, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
call fcn.1400c63d0
test eax, eax
je 0x1400c1296
mov eax, dword [rsp + 0x88]
cmp dword [rsp + 0x50], eax
je 0x1400c128a
mov r8d, 0x8eb
lea rdx, [0x140190ed0]
lea rcx, str.output_ctx.num_vertices__count_ctx.num_vertices
call sub.api_ms_win_crt_runtime_l1_1_0.dll__wassert
xor eax, eax
xor eax, eax
test eax, eax
jne 0x1400c1262
mov eax, dword [rsp + 0x50]
jmp 0x1400c12a7
mov rax, qword [rsp + 0xb0]
mov qword [rax], 0
xor eax, eax
add rsp, 0x98
ret
Function at 0x1400cf8d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400cf8f6
mov dword [rsp + 0x20], 1
jmp 0x1400cf8fe
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x1400f8d60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x1400f8d8b
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400f8d92
mov al, 1
jmp 0x1400f8eea
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.14001d500
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.14001d500
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x40]
call fcn.14001d510
movzx eax, al
test eax, eax
je 0x1400f8de9
xor al, al
jmp 0x1400f8eea
mov qword [rsp + 0x68], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call fcn.1400fbf70
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1400f8e58
cmp dword [rsp + 0x30], 1
je 0x1400f8e64
cmp dword [rsp + 0x30], 3
je 0x1400f8ed8
jmp 0x1400f8ee8
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x1400f8eaf
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp qword [rsp + 0x48], rax
je 0x1400f8eaf
xor al, al
jmp 0x1400f8eea
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400f8ec9
mov dword [rsp + 0x34], 1
jmp 0x1400f8ed1
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x1400f8eea
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400f8eea
xor al, al
add rsp, 0xa8
ret
Function at 0x1400fb130
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
call fcn.14001d500
mov dword [rsp + 0x50], eax
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x50]
call fcn.14001d510
movzx eax, al
test eax, eax
je 0x1400fb174
lea rcx, [rsp + 0xd8]
call fcn.1400fb060
jmp 0x1400fb3d6
mov rcx, qword [rsp + 0xd0]
call fcn.1400fb5e0
test rax, rax
je 0x1400fb1e0
mov rcx, qword [rsp + 0xd0]
call fcn.1400fb5e0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0xd0]
call fcn.1400fadf0
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
jae 0x1400fb1e0
lea rcx, [rsp + 0xd8]
call fcn.14001d6d0
mov byte [rsp + 0x42], al
mov rcx, qword [rsp + 0xd0]
call fcn.14001b530
movzx ecx, byte [rsp + 0x42]
mov byte [rax], cl
mov eax, dword [rsp + 0xd8]
jmp 0x1400fb3d6
mov rax, qword [rsp + 0xd0]
cmp qword [rax + 0x80], 0
jne 0x1400fb1fc
call fcn.14001d500
jmp 0x1400fb3d6
mov rcx, qword [rsp + 0xd0]
call fcn.1400f9730
mov rax, qword [rsp + 0xd0]
cmp qword [rax + 0x68], 0
jne 0x1400fb272
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax + 0x80]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0xd8]
call fcn.14001d6d0
mov byte [rsp + 0x43], al
mov rdx, qword [rsp + 0x68]
movzx ecx, byte [rsp + 0x43]
call fcn.1400f63e0
movzx eax, al
test eax, eax
je 0x1400fb260
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x48], eax
jmp 0x1400fb269
call fcn.14001d500
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
jmp 0x1400fb3d6
mov qword [rsp + 0x88], 0x20
lea rcx, [rsp + 0xd8]
call fcn.14001d6d0
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0xb0]
lea rcx, [rsp + 0x41]
mov rdx, qword [rsp + 0xd0]
add rdx, 0x74
lea r8, [rsp + 0x78]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, rcx
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
call fcn.1400fb0b0
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400fb316
cmp dword [rsp + 0x44], 1
je 0x1400fb316
cmp dword [rsp + 0x44], 3
je 0x1400fb395
jmp 0x1400fb3d1
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x1400fb36a
mov rax, qword [rsp + 0xd0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x58]
mov edx, 1
lea rcx, [rsp + 0x90]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp qword [rsp + 0x58], rax
je 0x1400fb36a
call fcn.14001d500
jmp 0x1400fb3d6
mov rax, qword [rsp + 0xd0]
mov byte [rax + 0x71], 1
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x80], rax
je 0x1400fb38e
mov eax, dword [rsp + 0xd8]
jmp 0x1400fb3d6
call fcn.14001d500
jmp 0x1400fb3d6
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rax + 0x80]
movzx ecx, byte [rsp + 0x40]
call fcn.1400f63e0
movzx eax, al
test eax, eax
je 0x1400fb3c2
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x4c], eax
jmp 0x1400fb3cb
call fcn.14001d500
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x4c]
jmp 0x1400fb3d6
call fcn.14001d500
add rsp, 0xc8
ret