joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002bd60
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x2c], 0x20
mov word [rcx], 0
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x50]
xor edx, edx
xor r8d, r8d
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14002bfaa
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14002bdeb
test byte [rdi], 1
jne 0x14002bdfd
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x30], xmm0
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x40], rax
movzx r14d, byte [rsp + 0x30]
jmp 0x14002be59
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x14002bfaa
mov rbx, qword [rdi + 8]
mov rdi, qword [rdi + 0x10]
cmp rbx, 0x16
ja 0x14002be1b
lea rcx, [rsp + 0x31]
lea r14d, [rbx + rbx]
mov byte [rsp + 0x30], r14b
jmp 0x14002be4b
cmp rbx, 0xfffffffffffffff0
jae 0x14002bfbc
mov r14, rbx
or r14, 0xf
lea rcx, [r14 + 1]
call fcn.140001610
mov rcx, rax
mov qword [rsp + 0x40], rax
add r14, 2
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbx
inc rbx
mov rdx, rdi
mov r8, rbx
call sub.msvcrt.dll_memmove
mov eax, r14d
shr al, 1
and r14b, 1
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
lea rdi, [rsp + 0x31]
mov rbx, rdx
cmove rbx, rdi
movzx eax, al
mov r15, r8
cmove r15, rax
test r15, r15
je 0x14002becc
xor r14d, r14d
mov r12, qword [sym.imp.msvcrt.dll_tolower]
nop word cs:[rax + rax]
movsx ecx, byte [rbx + r14]
call r12
mov byte [rbx + r14], al
inc r14
cmp r15, r14
jne 0x14002bea0
movzx eax, byte [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov r14d, eax
and r14b, 1
shr eax, 1
mov rcx, qword [rsp + 0x48]
test r14b, r14b
cmove rdx, rdi
cmove r8d, eax
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x48]
test eax, eax
je 0x14002bf86
mov dword [rsp + 0x20], 0
lea r8, [rsp + 0x70]
lea r9, [rsp + 0x2c]
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14002bf81
cmp dword [rsp + 0x2c], 0
je 0x14002bf81
lea rbx, [rsp + 0x59]
xor r14d, r14d
lea rdi, [rsp + 0x58]
jmp 0x14002bf3c
inc r14
mov eax, dword [rsp + 0x2c]
cmp r14, rax
jae 0x14002bf81
movzx edx, byte [rsp + r14 + 0x70]
mov rcx, rdi
call fcn.140001880
movzx eax, byte [rsp + 0x58]
mov r8d, eax
shr r8d, 1
test al, 1
mov rdx, qword [rsp + 0x68]
cmove rdx, rbx
cmovne r8, qword [rsp + 0x60]
mov rcx, rsi
call fcn.1400016b0
test byte [rsp + 0x58], 1
je 0x14002bf30
mov rcx, qword [rsp + 0x68]
call fcn.140001680
jmp 0x14002bf30
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test byte [rsp + 0x30], 1
je 0x14002bfaa
mov rcx, qword [rsp + 0x40]
call fcn.140001680
nop
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.14002bfd0
int3
Function at 0x180003588
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x38
mov r15d, r8d
mov rsi, rcx
xor ebx, ebx
mov dword [rbp - 0x18], ebx
mov qword [rcx], rbx
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], 0xf
mov byte [rcx], bl
mov dword [rbp - 0x18], 1
mov r14d, ebx
test r8d, r8d
je 0x18000373c
mov ecx, ebx
lea edi, [rbx + 3]
dec r15d
mov al, byte [rdx]
mov byte [rbp + rcx + 0x58], al
inc r14d
inc rcx
inc rdx
mov qword [rbp + 0x50], rdx
mov r8b, byte [rbp + 0x5a]
mov r12b, byte [rbp + 0x59]
mov r13b, byte [rbp + 0x58]
cmp rcx, rdi
jne 0x180003676
mov al, r13b
shr al, 2
mov byte [rbp + 0x60], al
mov cl, r13b
and cl, dil
shl cl, 4
mov al, r12b
shr al, 4
add cl, al
mov byte [rbp + 0x61], cl
mov cl, r12b
and cl, 0xf
shl cl, 2
mov al, r8b
shr al, 6
add cl, al
mov byte [rbp + 0x62], cl
mov al, r8b
and al, 0x3f
mov byte [rbp + 0x63], al
mov r14, rbx
lea rcx, [0x18000e038]
cmp qword [0x18000e050], 0x10
cmovae rcx, qword [0x18000e038]
movzx eax, byte [rbp + r14 + 0x60]
mov dl, byte [rax + rcx]
mov rcx, rsi
call fcn.1800081ec
inc r14
cmp r14, 4
jl 0x180003637
mov r14d, ebx
mov rcx, rbx
mov rdx, qword [rbp + 0x50]
mov r8b, byte [rbp + 0x5a]
test r15d, r15d
jne 0x1800035d4
test r14d, r14d
je 0x18000373c
movsxd rax, r14d
cmp rax, rdi
jge 0x1800036ae
jae 0x180003750
mov byte [rbp + rax + 0x58], bl
inc rax
cmp rax, rdi
jl 0x180003690
mov r8b, byte [rbp + 0x5a]
mov r12b, byte [rbp + 0x59]
mov r13b, byte [rbp + 0x58]
mov al, r13b
shr al, 2
mov byte [rbp + 0x60], al
and r13b, dil
shl r13b, 4
mov al, r12b
shr al, 4
add r13b, al
mov byte [rbp + 0x61], r13b
and r12b, 0xf
shl r12b, 2
mov al, r8b
shr al, 6
add r12b, al
mov byte [rbp + 0x62], r12b
and r8b, 0x3f
mov byte [rbp + 0x63], r8b
lea eax, [r14 + 1]
movsxd r15, eax
test eax, eax
jle 0x180003722
lea rcx, [0x18000e038]
cmp qword [0x18000e050], 0x10
cmovae rcx, qword [0x18000e038]
movzx eax, byte [rbp + rbx + 0x60]
mov dl, byte [rax + rcx]
mov rcx, rsi
call fcn.1800081ec
inc rbx
cmp rbx, r15
jl 0x1800036f3
cmp r14d, edi
jge 0x18000373c
sub edi, r14d
mov ebx, edi
mov dl, 0x3d
mov rcx, rsi
call fcn.1800081ec
sub rbx, 1
jne 0x18000372c
mov rax, rsi
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.180008db0
int3
Function at 0x180007790
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x1800077ab
xor edx, edx
lea eax, [rdx + 0x60]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 4
jb 0x180007798
mov byte [rcx + 5], 0
ret

Function at 0x1800077ac
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2b], 0
je 0x1800077c7
xor edx, edx
lea eax, [rdx + 0x60]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x2a
jb 0x1800077b4
mov byte [rcx + 0x2b], 0
ret

Function at 0x1800077c8
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x81], 0
je 0x1800077ec
xor edx, edx
lea eax, [rdx + 0x60]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x80
jb 0x1800077d3
mov byte [rcx + 0x81], 0
ret

Function at 0x1800077f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x180007816
xor edx, edx
movzx eax, dx
mov r8d, 0x56a0
sub ax, r8w
xor word [rcx + rdx*2], ax
inc rdx
cmp rdx, 5
jb 0x1800077f8
mov byte [rcx + 0xc], 0
ret

Function at 0x180007818
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
je 0x18000783e
xor edx, edx
movzx eax, dx
mov r8d, 0x56a0
sub ax, r8w
xor word [rcx + rdx*2], ax
inc rdx
cmp rdx, 0xc
jb 0x180007820
mov byte [rcx + 0x1a], 0
ret

Function at 0x180007840
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x180007866
xor edx, edx
movzx eax, dx
mov r8d, 0x56a0
sub ax, r8w
xor word [rcx + rdx*2], ax
inc rdx
cmp rdx, 2
jb 0x180007848
mov byte [rcx + 6], 0
ret

Function at 0x180007868
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x180007883
xor edx, edx
lea eax, [rdx + 0x60]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0xb
jb 0x180007870
mov byte [rcx + 0xc], 0
ret

Function at 0x180007884
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x18000789f
xor edx, edx
lea eax, [rdx + 0x60]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0xa
jb 0x18000788c
mov byte [rcx + 0xb], 0
ret

Function at 0x1800078a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3f], 0
je 0x1800078bb
xor edx, edx
lea eax, [rdx + 0x60]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x3e
jb 0x1800078a8
mov byte [rcx + 0x3f], 0
ret

Function at 0x1800079d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x1800079eb
xor edx, edx
lea eax, [rdx + 0x60]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0xc
jb 0x1800079d8
mov byte [rcx + 0xd], 0
ret

Function at 0x1800080fc
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x180008122
xor edx, edx
movzx eax, dx
mov r8d, 0x56a0
sub ax, r8w
xor word [rcx + rdx*2], ax
inc rdx
cmp rdx, 4
jb 0x180008104
mov byte [rcx + 0xa], 0
ret
Function at 0x14000d4c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1405786c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.1400a2cf0
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.1400968b0
nop
lea rax, [0x14000c9c0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.14000c3d0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14000d564
lea rcx, [rsp + 0x40]
call fcn.1400aef40
nop
jmp 0x14000d57b
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.14009a210
nop
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401cb6f0
add rsp, 0x58
ret

Function at 0x14000d5a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1405786c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.1400a2d10
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140096930
nop
lea rax, [0x14000ca50]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.14000c3d0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14000d644
lea rcx, [rsp + 0x40]
call fcn.1400aef70
nop
jmp 0x14000d65b
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.14009a260
nop
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401cb6f0
add rsp, 0x58
ret

Function at 0x140098900
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.1400988b0
nop
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x14009b2a0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x14009b2c3
mov rcx, qword [rsp + 0x40]
call fcn.1400a20d0
nop
jmp 0x14009b2db
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x14009b2db
mov rcx, qword [rsp + 0x40]
call fcn.1400a1ed0
nop
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x14009d440
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
add rsp, 0x28
ret

Function at 0x14009e520
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov rax, qword [0x1405786c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, [0x1401d3c90]
mov qword [rsp + 0x48], rax
cmp dword [rsp + 0x90], 0
jl 0x14009e57d
cmp dword [rsp + 0x90], 0x7c
jge 0x14009e57d
lea r8, [rsp + 0x48]
mov edx, dword [rsp + 0x90]
lea rcx, str.Keybind
call fcn.14009eea0
nop
lea rcx, [rsp + 0x50]
call fcn.140098340
nop
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x48]
movsx eax, byte [rcx + rax]
test eax, eax
jne 0x14009e5b2
lea rdx, str.Your_Key
lea rcx, [rsp + 0x50]
call fcn.14009a840
nop
jmp 0x14009e5c2
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.14009a840
nop
cmp dword [rsp + 0xa0], 1
jne 0x14009e5de
lea rdx, str.Press_Key
lea rcx, [rsp + 0x50]
call fcn.14009a840
nop
movss xmm2, dword [0x1401d5fd8]
movss xmm1, dword [0x1401d5ff4]
lea rcx, [rsp + 0x40]
call fcn.140098d40
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x50]
call fcn.1400a92b0
mov qword [rsp + 0x38], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.1401106e0
movzx eax, al
test eax, eax
je 0x14009e659
cmp dword [rsp + 0xa0], 0
jne 0x14009e659
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rcx, [rsp + 0x50]
call fcn.140099fb0
nop
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401cb6f0
add rsp, 0x88
ret
Function at 0x1400a1160
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x1405786c0]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x1400a119d
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400a11a4
mov al, 1
jmp 0x1400a12fc
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.1400aa1e0
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.1400aa1e0
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.1400aa230
movzx eax, al
test eax, eax
je 0x1400a11f9
xor al, al
jmp 0x1400a12fc
mov qword [rsp + 0x60], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1400a1269
cmp dword [rsp + 0x30], 1
je 0x1400a1275
cmp dword [rsp + 0x30], 3
je 0x1400a12ea
jmp 0x1400a12fa
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x1400a12c1
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x1400a12c1
xor al, al
jmp 0x1400a12fc
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400a12db
mov dword [rsp + 0x34], 1
jmp 0x1400a12e3
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x1400a12fc
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400a12fc
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401cb6f0
add rsp, 0xa8
ret
Function at 0x1400a1ed0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x1400a1f00
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x1400a1f82
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x1400a1f4e
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x1400a1f56
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1400a1ef5
mov qword [rsp + 8], 0xe3
jmp 0x1400a1f9a
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x1400a2021
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x1400a1feb
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x1400a1ff3
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1400a1f8d
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x1400a2075
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x1400a207d
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x1400a20d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x1400a20f1
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x1400a2175
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x1400a2140
mov dword [rsp + 4], 0x9908b0df
jmp 0x1400a2148
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1400a20e4
add rsp, 0x18
ret
Function at 0x1400aa450
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1400aa610
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x288
mov rax, qword [0x1405786c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400aa6a9
mov rdx, qword [rsp + 0x298]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400aa696
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x290]
mov ecx, dword [rsp + 0x38]
mov dword [rax + 8], ecx
mov eax, dword [rsp + 0x38]
jmp 0x1400aa6b6
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400aa65f
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1401cb6f0
add rsp, 0x288
ret

Function at 0x1400ac6a0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
lea rax, str.taskkill__F__IM__NVIDIA_Share.exe_
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0x20], eax
mov r8d, 0x1f4
mov edx, 0x145
mov rcx, qword [rsp + 0x40]
call fcn.1400a9150
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.1400aa450
nop
add rsp, 0x38
ret

Function at 0x1400adca0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1405791dc]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400adce0
movzx eax, byte [0x1405791d8]
test eax, eax
jne 0x1400adccd
mov dword [rsp + 0x20], 1
jmp 0x1400adcd5
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov byte [0x1405791d8], al
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400add00
lea rcx, [0x140579098]
call fcn.1400ac6a0
nop
movzx eax, byte [0x1405791d8]
test eax, eax
je 0x1400add11
call fcn.1400acae0
nop
add rsp, 0x38
ret
Function at 0x1400aefa0
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x80
mov rax, qword [0x1405786c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
cmp dword [rsp + 0x48], 0x12
je 0x1400af134
mov rcx, qword [0x140579280]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov edx, 5
mov rcx, qword [0x140579280]
call qword [sym.imp.USER32.dll_ShowWindow]
nop
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x140579280]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x1400af040
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_DispatchMessageW]
nop
call fcn.1400c3300
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movss xmm0, dword [0x1401d5ee0]
movss dword [rax + 0x10], xmm0
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetCursorPos]
cvtsi2ss xmm0, dword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
movss dword [rax + 0xdf8], xmm0
cvtsi2ss xmm0, dword [rsp + 0x3c]
mov rax, qword [rsp + 0x30]
movss dword [rax + 0xdfc], xmm0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x1400af113
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov byte [rcx + rax + 0xe00], 1
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov byte [rcx + rax + 0x3738], 1
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
movss xmm0, dword [rdx + 0xdf8]
movss dword [rcx + rax + 0x36e8], xmm0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
movss xmm0, dword [rdx + 0xdfc]
movss dword [rcx + rax + 0x36e8], xmm0
jmp 0x1400af129
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov byte [rcx + rax + 0xe00], 0
call fcn.1400a9ac0
nop
jmp 0x1400aefda
call fcn.1400fcb80
call fcn.1400fd1e0
xor ecx, ecx
call fcn.1400bf5b0
mov rcx, qword [0x140579280]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401cb6f0
add rsp, 0x80
pop rdi
ret