joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a4859
Capabilities:
Set thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x88912368
pushf
not eax
add eax, 0x4e65945e
xor eax, 0x30beb5e7
rol eax, 0x6e
popf
pushf
not eax
add eax, 0x567840b
xor eax, 0x5422c6b0
rol eax, 0x27
popf
cmp eax, 1
jne 0x1400a4896
popf
pop rax
jmp 0x1400a49ad
cmp eax, 2
jne 0x1400a48a5
popf
pop rax
jmp 0x1400a4a12
cmp eax, 0
jne 0x1400a48b4
popf
pop rax
jmp 0x1400a48c3
cmp eax, 3
jne 0x1400a48c3
popf
pop rax
jmp 0x1400a4a71
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x184b42dc0]
pushf
sub r9, 0x44b10db0
popf
mov edi, ecx
lea rdx, [0x183fd4394]
pushf
sub rdx, 0x43fa2384
popf
mov ecx, 0x76a344c2
pushf
not ecx
add ecx, 0x326419e1
xor ecx, 0x7a93450a
rol ecx, 0x54
popf
pushf
not ecx
add ecx, 0x218d0c90
xor ecx, 0x20417756
rol ecx, 0x71
popf
lea r8, [0x19b35547a]
pushf
sub r8, 0x5b323472
popf
call fcn.14000dd38
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x1400a4979
push rax
pushf
mov eax, 0x43fea279
pushf
not eax
add eax, 0x13992b58
xor eax, 0x75fdeb4d
rol eax, 0x31
popf
pushf
not eax
add eax, 0x30b4422d
xor eax, 0x698cc55e
rol eax, 0xb5
popf
jmp 0x1400a4887
push rax
pushf
mov eax, 0x4bdae91f
pushf
not eax
add eax, 0x386dbd3
xor eax, 0x6371bd24
rol eax, 0x1c
popf
pushf
not eax
add eax, 0x6c3e9df3
xor eax, 0x6ef0f8f9
rol eax, 0xe2
popf
jmp 0x1400a4887
call qword [0x14002b4b0]
jmp 0x1400a4a71
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
push rax
pushf
mov eax, 0x26193f53
pushf
not eax
add eax, 0x7fd808a2
xor eax, 0x5dbac649
rol eax, 0x16
popf
pushf
not eax
add eax, 0x292ad68c
xor eax, 0x25382e21
rol eax, 2
popf
pushf
not eax
add eax, 0xa6e4608
xor eax, 0x6d018f14
rol eax, 0xd6
popf
pushf
not eax
add eax, 0x4f23d31a
xor eax, 0x5188c923
rol eax, 0x23
popf
jmp 0x1400a4887
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400a721f
Capabilities:
Hash data using murmur3
Parse pe header

Disassembly:
push rax
pushf
mov eax, 0x6544022f
pushf
not eax
add eax, 0x4d74675a
xor eax, 0x6a4219dc
rol eax, 0x1e
popf
pushf
not eax
add eax, 0x1c05539c
xor eax, 0x4ee2d90e
rol eax, 0x94
popf
pushf
not eax
add eax, 0x51f6a9bf
xor eax, 0x7cf35118
rol eax, 0x78
popf
cmp eax, 0
jne 0x1400a726f
popf
pop rax
jmp 0x1400a726f
mov r8, qword [rdx]
jmp fcn.1400a7277
Function at 0x1400e56e0
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0xf06668f7
pushf
not eax
add eax, 0x758bf0fa
xor eax, 0xe9ef481
rol eax, 0x64
popf
pushf
not eax
add eax, 0x2aad3559
xor eax, 0x4f1fd1eb
rol eax, 0xdd
popf
pushf
not eax
add eax, 0x7d1baff6
xor eax, 0x25dd776b
rol eax, 0xa
popf
pushf
not eax
add eax, 0x63e2f2d7
xor eax, 0x572615e2
rol eax, 0x8a
popf
cmp eax, 0
jne 0x1400e5743
popf
pop rax
jmp 0x1400e5743
jmp fcn.140136acd
Function at 0x1400fda3d
Capabilities:
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0xed7200c
pushf
not eax
add eax, 0x17eb9187
xor eax, 0x3798d3a2
rol eax, 0xc3
popf
pushf
not eax
add eax, 0x74846662
xor eax, 0x5ec6101
rol eax, 0x10
popf
pushf
not eax
add eax, 0x4b978b8f
xor eax, 0x39aafac4
rol eax, 0xd
popf
pushf
not eax
add eax, 0x934254b
xor eax, 0x6948409f
rol eax, 0xf6
popf
cmp eax, 0
jne 0x1400fdaa0
popf
pop rax
jmp 0x1400fdaa0
jmp fcn.1400fbabd
Function at 0x1401115b3
Capabilities:
Parse pe header

Disassembly:
push rax
pushf
mov eax, 0x3980cde2
pushf
not eax
add eax, 0x69cbd356
xor eax, 0x3c61c04f
rol eax, 0xc2
popf
pushf
not eax
add eax, 0x4949e063
xor eax, 0x189ecb72
rol eax, 0xa8
popf
cmp eax, 0
jne 0x1401115f0
popf
pop rax
jmp 0x1401115f0
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x1400199d8
Function at 0x14014638e
Capabilities:
Set environment variable

Disassembly:
push rax
pushf
mov eax, 0x7d408b4a
pushf
not eax
add eax, 0x12b642f2
xor eax, 0x7d321b02
rol eax, 0
popf
pushf
not eax
add eax, 0x46772b5b
xor eax, 0x5e2f7eb5
rol eax, 0x70
popf
cmp eax, 0
jne 0x1401463cb
popf
pop rax
jmp 0x1401463cb
jmp 0x140020c90
Function at 0x14014a1de
Capabilities:
Enumerate files on windows

Disassembly:
push rax
pushf
mov eax, 0xcb483193
pushf
not eax
add eax, 0x57c26f7f
xor eax, 0x6bd926ea
rol eax, 0x45
popf
pushf
not eax
add eax, 0x6a67e55e
xor eax, 0x76048521
rol eax, 0x97
popf
cmp eax, 0
jne 0x14014a21b
popf
pop rax
jmp 0x14014a21b
jmp 0x1400218e4
Function at 0x14017d9e8
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0x94723ada
pushf
not eax
add eax, 0x596a2da3
xor eax, 0x3b85c239
rol eax, 0x69
popf
pushf
not eax
add eax, 0x2ea02314
xor eax, 0x5663d659
rol eax, 0xc6
popf
pushf
not eax
add eax, 0x4357cdcb
xor eax, 0x1baca493
rol eax, 4
popf
pushf
not eax
add eax, 0x28b7d872
xor eax, 0x2199f36e
rol eax, 0xbc
popf

Function at 0x14017f42a
Capabilities:
Clear file content

Disassembly:
push rax
pushf
mov eax, 0x737efc74
pushf
not eax
add eax, 0x2b7a88c8
xor eax, 0x71b3e8f1
rol eax, 0xcf
popf
pushf
not eax
add eax, 0x357a216c
xor eax, 0x328be47
rol eax, 0x53
popf

Function at 0x14018087f
Capabilities:
Authenticate hmac
Parse credit card information

Disassembly:
push rax
pushf
mov eax, 0xaa80524b
pushf
not eax
add eax, 0x462564e0
xor eax, 0x2dc0597e
rol eax, 0xf9
popf
pushf
not eax
add eax, 0x1628e1ed
xor eax, 0x40bc1755
rol eax, 0xdf
popf

Function at 0x140183833
Capabilities:
Encrypt data using speck
Parse pe header

Disassembly:
push rax
pushf
mov eax, 0x379d1f43
pushf
not eax
add eax, 0xbe001c9
xor eax, 0xeb5535d
rol eax, 0x1d
popf
pushf
not eax
add eax, 0x66442e00
xor eax, 0x4ae537c4
rol eax, 0xcd
popf
Function at 0x140003f90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140003fed
lea rbx, [0x1400f3800]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003fd4
cmp r10, 2
jb 0x140003fd4
cmp byte [r9], r8b
jne 0x140003fd4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003fb0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000402f
lea rbx, [0x1400f3800]
cmp r8b, 0x23
jne 0x140004013
cmp byte [r9], r8b
jne 0x140004013
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140004000
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1400041f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x14000421f
mov r8d, 0x791
lea rdx, [0x1400edfe0]
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x14000422b
mov qword [rdi], 0
lea rdx, [0x1400f3038]
mov rcx, rbx
call fcn.140004040
mov rbx, rax
test rax, rax
jne 0x14000424d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140004326
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004326
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140004326
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004326
cmp rsi, 0xffffffffffffffff
je 0x140004326
mov rax, qword [0x140265040]
test rax, rax
je 0x1400042c3
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140004326
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140004313
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140265040]
test rax, rax
je 0x140004308
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000432f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140004321
mov qword [rdi], rsi
mov rax, rbp
jmp 0x140004331
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140007f50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xe8], 0
mov rbx, rcx
movsxd rdi, edx
jg 0x140007f87
mov r8d, 0x715
lea rdx, [0x1400edda0]
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0xf0]
lea rdx, [0x1400f3800]
movsxd r8, dword [rbx + 0xe8]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [0x140265040]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x140008006
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.14001f560
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140008020
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xe8], 0
mov rdi, rdx
mov rbx, rcx
jg 0x140008053
mov r8d, 0x715
lea rdx, [0x1400edda0]
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movss xmm0, dword [rbx + 0x108]
lea r10, [0x1400f3800]
movsxd rcx, dword [rbx + 0xe8]
mov rax, qword [rbx + 0xf0]
movss xmm2, dword [rdi]
movss xmm1, dword [rbx + 0x10c]
subss xmm2, xmm0
movss xmm3, dword [rdi + 4]
mov r9d, dword [rax + rcx*4 - 4]
subss xmm3, xmm1
movss xmm4, dword [rdi + 8]
not r9d
movzx ecx, r9b
subss xmm4, xmm0
movss xmm0, dword [rdi + 0xc]
shr r9d, 8
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp + 0x20], xmm2
movzx eax, byte [rsp + 0x20]
xor rcx, rax
movss dword [rsp + 0x24], xmm3
mov eax, r8d
movss dword [rsp + 0x28], xmm4
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 0x2c], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x24]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x28]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
mov rbx, qword [rsp + 0x40]
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x2c]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x30
pop rdi
ret
Function at 0x140017b80
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x140265040]
mov edi, ecx
cmp byte [rbx + 0x4a75], 0
jne 0x140017bd2
cmp byte [rbx + 0x4a76], 0
jne 0x140017bd2
movsx r9d, word [rbx + 0x5b8a]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140003e50
test dil, 1
je 0x140017cf8
jmp 0x140017c5d
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400fd3d0]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400fd3b4]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x47d8], rax
mov dword [rbx + 0x47c4], 1
movss dword [rbx + 0x47d0], xmm0
movss dword [rbx + 0x47d4], xmm1
movss xmm0, dword [rbx + 0x3900]
mulss xmm0, dword [0x1400fd308]
or dword [rbx + 0x47c0], 0x41
movss dword [rbx + 0x4820], xmm0
movsx r9d, word [rbx + 0x5b8a]
call fcn.140003e50
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140017cb0
lea r11, [0x1400f3800]
nop dword [rax]
cmp r9b, 0x23
jne 0x140017c93
cmp byte [r8], r9b
jne 0x140017c93
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140017c80
not ecx
call fcn.14000cab0
test rax, rax
je 0x140017cf8
cmp byte [rax + 0xae], 0
je 0x140017cf8
mov byte [rax + 0xb5], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b8a]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x5b8a]
call fcn.140003e50
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000f5d0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14001db80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c70], 0
lea rbx, [rcx + 0x5c78]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001dc27
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001dbda
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1400204a0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400049f0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c70]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c80]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140265038]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001dc2f
mov rcx, rbx
call fcn.1400049f0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001e2d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x140265040]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x14001e334
lea r10, [0x1400f3800]
cmp r8b, 0x23
jne 0x14001e317
cmp byte [rdx], r8b
jne 0x14001e317
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14001e304
mov eax, dword [r14 + 0x5be8]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x14001e395
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x14001e35a
cmp edi, eax
jl 0x14001e374
mov r8d, 0x70c
lea rdx, [0x1400edda0]
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [r14 + 0x5bf0]
cmp dword [rax + rbp + 8], ebx
je 0x14001e3b2
mov eax, dword [r14 + 0x5be8]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x14001e351
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x14001e3bf
cmp edi, dword [r14 + 0x5be8]
jl 0x14001e3d9
mov r8d, 0x70c
lea rdx, [0x1400edda0]
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5bf0]
lea rax, [rax + rcx*8]
jmp 0x14001e397
Function at 0x140054f50
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x210
call fcn.1400133d0
cmp byte [rax], 0
je 0x140054fe9
mov ecx, 0x210
call fcn.140002f00
cmp byte [rax + 8], 0
jne 0x140054fe9
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x140054fe9
mov rbx, qword [0x140265040]
test rbx, rbx
jne 0x140054fb8
mov r8d, 0x1032
lea rdx, [0x1400edfe0]
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140265040]
cmp byte [rbx + 0x37a9], 0
je 0x140054fd5
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.140003670
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov ecx, 0x214
call fcn.1400133d0
cmp byte [rax], 0
je 0x14005507c
mov ecx, 0x214
call fcn.140002f00
cmp byte [rax + 8], 0
jne 0x14005507c
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14005507c
mov rbx, qword [0x140265040]
test rbx, rbx
jne 0x14005504b
mov r8d, 0x1032
lea rdx, [0x1400edfe0]
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140265040]
cmp byte [rbx + 0x37a9], 0
je 0x140055068
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.140003670
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov ecx, 0x212
call fcn.1400133d0
cmp byte [rax], 0
je 0x14005510f
mov ecx, 0x212
call fcn.140002f00
cmp byte [rax + 8], 0
jne 0x14005510f
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14005510f
mov rbx, qword [0x140265040]
test rbx, rbx
jne 0x1400550de
mov r8d, 0x1032
lea rdx, [0x1400edfe0]
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140265040]
cmp byte [rbx + 0x37a9], 0
je 0x1400550fb
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.140003670
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov ecx, 0x216
call fcn.1400133d0
cmp byte [rax], 0
je 0x1400551a2
mov ecx, 0x216
call fcn.140002f00
cmp byte [rax + 8], 0
jne 0x1400551a2
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1400551a2
mov rbx, qword [0x140265040]
test rbx, rbx
jne 0x140055171
mov r8d, 0x1032
lea rdx, [0x1400edfe0]
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140265040]
cmp byte [rbx + 0x37a9], 0
je 0x14005518e
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.140003670
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x140057630
Capabilities:
Check for debugger via api

Disassembly:
sub rsp, 0x28
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov eax, dword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x140059fd0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x170
mov rbx, rcx
xor edi, edi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WLDAP32.dll_Ordinal_26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
test eax, eax
jne 0x14005a0c1
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x14005a024
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140052920
nop
mov r8d, Ordinal_32
lea rdx, str.NINJA_HEX_V1login_data1.txt
lea rcx, [rsp + 0x38]
call fcn.140051cb0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14005a0d3
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a0ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005a0ba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d8700
jmp 0x14005a0d3
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dil
mov rax, rbx
mov rbx, qword [rsp + 0x180]
add rsp, 0x170
pop rdi
ret

Function at 0x14005a440
Capabilities:
Enumerate processes

Disassembly:
push rsi
sub rsp, 0x150
mov rsi, rdx
test rdx, rdx
jne 0x14005a45c
xor eax, eax
add rsp, 0x150
pop rsi
ret
mov qword [rsp + 0x160], rbx
xor edx, edx
mov qword [rsp + 0x168], rbp
mov ecx, 2
mov qword [rsp + 0x170], rdi
xor edi, edi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005a4e2
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14005a4d0
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x14005a4d0
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005a4b0
mov rbp, qword [rsp + 0x168]
mov eax, edi
mov rdi, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rsi
ret
Function at 0x14005e970
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x150
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x14005ea49
mov qword [rax + 8], rbx
xor r15d, r15d
xor edx, edx
mov qword [rax + 0x10], rbp
mov ecx, 2
mov edi, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14005ea12
nop dword [rax + rax]
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14005ea00
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x14005ea00
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005e9e0
mov rbp, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x170]
test edi, edi
je 0x14005ea49
mov r8d, edi
mov dword [r14], edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov qword [r14 + 8], rax
setne r15b
mov eax, r15d
jmp 0x14005ea4b
xor eax, eax
mov rsi, qword [rsp + 0x180]
add rsp, 0x150
pop r15
pop r14
pop rdi
ret