joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f0f80
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f11bd
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x88], rdi
mov rdx, qword [rcx]
mov r10, qword [rdx + 0x10]
mov rdx, qword [rdx + 8]
lea r11, [r10 - 1]
test r11, r11
jl 0x4f0fe2
mov rdx, qword [rdx + r10*8 - 8]
bsr rdx, rdx
mov r10, 0xffffffffffffffff
cmove rdx, r10
shl r11, 6
lea rdx, [rdx + r11]
lea rdx, [rdx + 1]
nop
jmp 0x4f0fe4
xor edx, edx
lea r10, [rdx + 7]
sar r10, 0x3f
shr r10, 0x3d
lea rdx, [r10 + rdx]
lea rdx, [rdx + 7]
sar rdx, 3
nop dword [rax]
cmp rdx, 0xb
jl 0x4f10ef
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
movups xmmword [rsp + 0x50], xmm15
xor eax, eax
xor ebx, ebx
mov rcx, rbx
nop dword [rax]
call fcn.004eb120
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x40], 0
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
lea rdi, [rsp + 0x40]
call fcn.004f1b80
test rbx, rbx
jne 0x4f10d2
mov qword [rsp + 0x38], rax
lea rax, [0x00660640]
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call fcn.00449100
mov rbx, rax
mov rcx, qword [rsp + 0x30]
mov rdi, rcx
mov rax, qword [rsp + 0x38]
call fcn.004e1aa0
test rbx, rbx
jbe 0x4f11b2
movzx edx, byte [rax]
cmp rbx, 1
jbe 0x4f11a5
movzx r10d, byte [rax + 1]
mov esi, 2
xor edi, edi
mov r8d, 1
jmp 0x4f1148
xor eax, eax
mov rdi, rax
mov rsi, rax
mov r8, rbx
mov r9, rcx
xor ebx, ebx
mov rcx, rax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov r8, qword [0x007aeb10]
mov r9, qword [0x007aeb18]
xor eax, eax
xor ebx, ebx
mov rcx, rax
mov rdi, rax
mov rsi, rax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
lea r11, [rsi + 1]
movzx r12d, byte [rax + rsi]
dec r12d
shr r12d, 0x1f
mov r13, r8
and r8, r12
nop
mov r15, r8
neg r8
and r8, rsi
dec r15
and rdi, r15
or rdi, r8
lea r8, [r12 - 1]
and r8, r13
mov rsi, r11
cmp rbx, rsi
jg 0x4f1114
nop
lea esi, [rdx - 1]
shr esi, 0x1f
xor r10d, 2
movzx edx, r10b
dec edx
shr edx, 0x1f
and rsi, rdx
not r8
and rsi, r8
lea edx, [rdi - 9]
neg edx
sar edx, 0x1f
and edx, 1
and rsi, rdx
and rsi, 1
lea rdx, [rdi + 1]
mov r10, rsi
neg rsi
and rsi, rdx
mov rdi, rcx
xor r8d, r8d
xor r9d, r9d
mov rcx, rbx
mov rbx, rax
mov rax, r10
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, 1
mov rcx, rbx
call fcn.004633a0
xor eax, eax
mov rcx, rbx
call fcn.004633a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
nop dword [rax + rax]
call fcn.00460c80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004f0f80
Function at 0x4fcf00
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x4fcf85
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x4fd0e6
cmp rcx, 0xe
jne 0x4fd000
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x4fd0e6
cmp rcx, 0xf
jne 0x4fd077
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x4fd0e6
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x5029a0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x502a8c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rdx, rdi
sar rdi, 0x3f
shr rdi, 0x3d
lea rsi, [rdi + rdx]
sar rsi, 3
shl rsi, 3
sub rdx, rsi
lea rsi, [rdx - 8]
neg rsi
nop
cmp rsi, 8
je 0x502a3b
test rbx, rbx
je 0x502a3b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x30], rax
lea rax, [0x00660640]
mov rcx, rbx
call fcn.00449100
mov rcx, qword [rsp + 0x20]
cmp rcx, 8
sbb edx, edx
mov rsi, qword [rsp + 0x30]
movzx edi, byte [rsi]
shr dil, cl
and edi, edx
mov byte [rax], dil
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
mov r8d, 1
jmp 0x502a7a
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp rdi, 0x20
sbb r9d, r9d
movzx r10d, byte [r8 + rsi - 1]
mov r11, rcx
mov rcx, rdi
shl r10d, cl
and r10d, r9d
mov byte [rax + r8], r10b
movzx r9d, byte [rsi + r8]
mov rcx, r11
shr r9b, cl
and r9d, edx
or r10d, r9d
mov byte [rax + r8], r10b
inc r8
cmp rbx, r8
jg 0x502a45
mov rcx, rbx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460c80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005029a0
Function at 0x509680
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5097e0
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x20]
nop
call fcn.00509340
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x48], 0
lea rcx, [rsp + 0x50]
movups xmmword [rcx], xmm15
lea rcx, [rsp + 0x60]
movups xmmword [rcx], xmm15
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x88]
xor eax, eax
jmp 0x50972d
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x50977e
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
sar rdx, 3
mov rdi, rdx
shl rdx, 3
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x48]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x18], rdx
xor ecx, ecx
jmp 0x5097a4
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
movzx r8d, byte [rbx + rsi]
or r8d, edx
mov byte [rbx + rsi], r8b
inc rcx
cmp rcx, 8
jge 0x509727
movzx edx, byte [rsp + rcx + 0x18]
lea rsi, [rdi + rcx]
nop word [rax + rax]
cmp rsi, 0x20
jge 0x509727
test byte [rbx], al
cmp rsi, 0x20
jb 0x509795
mov rax, rsi
mov ecx, 0x20
call fcn.004633a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460c80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00509680
Function at 0x54d0e0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [0x0080af50], rax
je 0x54d115
lea rcx, [0x0080af60]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, 2
call qword [fcn.0054ec40]
mov r8d, 0x3d
mov edx, 1
lea rcx, str.runtime:_failed_to_create_runtime_initialization_wait_event._n
mov r9, rax
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop

Function at 0x54da00
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x0080b5a4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x54db88
mov rax, qword [0x0080b5a8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x54da4c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x54dad5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x54da30
mov rcx, rbx
call fcn.0054e6a0
test rax, rax
mov r12, rax
je 0x54dbbd
mov rax, qword [0x0080b5a8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.0054e7d0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0080b5a8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x54dba0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x54dace
sub eax, 0x40
and eax, 0xffffffbf
jne 0x54db30
add dword [0x0080b5a4], 1
cmp edi, 8
jae 0x54db03
test dil, 4
jne 0x54db74
test edi, edi
je 0x54daf8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x54db8f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x54daf8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x54db1c
jmp 0x54daf8
add rsi, qword [0x0080b5a8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x54dace
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0054ecb0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x54daf8
xor esi, esi
jmp 0x54da57
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x54daf8
mov rax, qword [0x0080b5a8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.0054ecb0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.0054ecb0
nop
nop dword [rax]
Function at 0x54e310
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0080b880]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0080b860]
test rbx, rbx
je 0x54e364
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x54e35b
test rsi, rsi
je 0x54e35b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x54e340
lea rcx, [0x0080b880]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x54e6a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x007aa9e0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x54e70d
mov rcx, r8
call fcn.0054e580
test eax, eax
je 0x54e70d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x54e70d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x54e704
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x54e70f
add rax, 0x28
cmp rax, r9
jne 0x54e6f0
xor eax, eax
add rsp, 0x28
ret

Function at 0x54ecb0
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.0054ec40
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.0054ec40
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x14000cf10
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140163340]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [0x14022e639]
test eax, eax
jne 0x14000cf4b
mov rcx, qword [rsp + 0xa0]
call fcn.14000d140
jmp 0x14000d120
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14022e970], eax
jle 0x14000cf97
lea rcx, [0x14022e970]
call fcn.1401356a8
cmp dword [0x14022e970], 0xffffffff
jne 0x14000cf97
lea rcx, [0x14022e658]
call fcn.1400084b0
nop
lea rcx, [0x14022e970]
call fcn.14013563c
mov rax, qword [rsp + 0xa0]
mov ecx, dword [0x1401b9050]
cmp dword [rax + 0xc0], ecx
jbe 0x14000d0f7
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xa0]
add rax, 0xc4
mov qword [rsp + 0x38], rax
vmovss xmm2, dword [0x140150748]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
call fcn.14000c6b0
mov r8, qword [rax]
lea rdx, [rsp + 0x50]
lea rcx, [0x14022e658]
call fcn.14000c660
mov r8, qword [rax]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
call fcn.14000c610
mov r8, qword [rax]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x70]
call fcn.14000c660
mov rax, qword [rsp + 0xa0]
vmovss xmm0, dword [rax + 0x110]
vmulss xmm0, xmm0, dword [0x14015034c]
vmovss xmm1, dword [rsp + 0x7c]
vdivss xmm0, xmm1, xmm0
vmulss xmm0, xmm0, dword [0x14022ed70]
vcvttss2si eax, xmm0
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0xa0]
vmovss xmm0, dword [rax + 0x110]
vmulss xmm0, xmm0, dword [0x14015034c]
vmovss xmm1, dword [rsp + 0x78]
vdivss xmm0, xmm1, xmm0
vmulss xmm0, xmm0, dword [0x14022ed74]
vcvttss2si eax, xmm0
mov dword [rsp + 0x30], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14000d0c1
mov eax, dword [rsp + 0x30]
neg eax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
mov edx, dword [rsp + 0x34]
mov ecx, 1
call qword [sym.imp.USER32.dll_mouse_event]
mov rax, qword [rsp + 0xa0]
add rax, 0xc4
mov qword [rsp + 0x40], rax
vmovss xmm2, dword [0x140150748]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call fcn.14000c6b0
mov rax, qword [rax]
mov qword [0x14022e658], rax
jmp 0x14000d113
vxorps xmm2, xmm2, xmm2
vxorps xmm1, xmm1, xmm1
lea rcx, [rsp + 0x68]
call fcn.14000c330
mov rax, qword [rax]
mov qword [0x14022e658], rax
mov rcx, qword [rsp + 0xa0]
call fcn.14000d140
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401355e0
add rsp, 0x98
ret
Function at 0x1400125a0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
add rsp, 0x28
ret

Function at 0x140029670
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.14002a1d0
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x14002f590
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x14002f5b2
mov rcx, qword [rsp + 0x40]
call fcn.14002f660
jmp 0x14002f5c9
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x14002f5c9
mov rcx, qword [rsp + 0x40]
call fcn.14002f710
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x14002f660
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x14002f681
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x14002f705
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x14002f6d0
mov dword [rsp + 4], 0x9908b0df
jmp 0x14002f6d8
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14002f674
add rsp, 0x18
ret
Function at 0x14002f710
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x14002f740
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x14002f7c2
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x14002f78e
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x14002f796
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14002f735
mov qword [rsp + 8], 0xe3
jmp 0x14002f7da
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x14002f861
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x14002f82b
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x14002f833
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14002f7cd
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x14002f8b5
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x14002f8bd
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x140031cc0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
vmovss dword [rsp + 0x20], xmm3
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140031cf6
mov rax, qword [rsp + 0x38]
mov byte [rax], 1
jmp 0x140031d5b
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
test eax, eax
je 0x140031d5b
xor edx, edx
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov r8d, 8
movzx edx, al
movzx ecx, byte [rsp + 0x40]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov r8d, 2
movzx edx, al
movzx ecx, byte [rsp + 0x40]
call qword [sym.imp.USER32.dll_keybd_event]
mov rax, qword [rsp + 0x38]
mov byte [rax], 0
add rsp, 0x28
ret