joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a410
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, byte [0x14014b648]
test eax, eax
jne 0x14000a438
jmp 0x14000a509
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000a44f
mov byte [rsp + 0x21], 1
jmp 0x14000a454
mov byte [rsp + 0x21], 0
movzx eax, byte [rsp + 0x21]
mov byte [rsp + 0x20], al
mov rcx, qword [rsp + 0x50]
call fcn.14000a3d0
mov byte [rsp + 0x22], al
lea rdx, [rsp + 0x30]
lea rcx, [0x14014ced0]
call fcn.140035010
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14000a4c0
movzx eax, byte [rsp + 0x22]
test eax, eax
je 0x14000a4c0
mov dword [rsp + 0x24], 0xf
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x28]
call fcn.14002ab90
mov rcx, rax
call fcn.14002abb0
mov edx, 0x10001
lea rcx, [0x14014ced0]
call fcn.140034fd0
jmp 0x14000a509
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14000a4e5
movzx eax, byte [rsp + 0x22]
test eax, eax
jne 0x14000a4e5
mov edx, 0x100
lea rcx, [0x14014ced0]
call fcn.140034fd0
jmp 0x14000a509
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14000a509
cmp dword [rsp + 0x30], 0x10001
jne 0x14000a509
mov edx, 0x100
lea rcx, [0x14014ced0]
call fcn.140034fd0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400f3e20
add rsp, 0x48
ret
Function at 0x140033c50
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
movzx eax, byte [0x14014bb54]
test eax, eax
jne 0x140033c64
jmp 0x140033de9
mov dword [rsp + 0x20], 0x20
vmovss xmm0, dword [0x1401227d8]
call fcn.140055b10
vxorps xmm2, xmm2, xmm2
vmovss xmm1, dword [0x140122db0]
lea rcx, [rsp + 0x24]
call fcn.140008c10
xor edx, edx
mov rcx, rax
call fcn.140055a00
mov r8d, dword [rsp + 0x20]
xor edx, edx
lea rcx, str.Cheats_List
call fcn.1400508c0
movzx edx, byte [0x14012d062]
lea rcx, [0x1400fcb2c]
call fcn.140033bd0
movzx eax, byte [0x14014ce41]
test eax, eax
je 0x140033cf2
movzx eax, byte [0x14014ce5c]
test eax, eax
jne 0x140033ce6
mov ecx, dword [0x14014a028]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140033cf2
lea rcx, str.Aimbot__Toggle_
call fcn.140094e50
movzx edx, byte [0x14014ce40]
lea rcx, [0x1400fcb40]
call fcn.140033bd0
movzx edx, byte [0x14014bb57]
lea rcx, [0x1400fcb44]
call fcn.140033bd0
movzx edx, byte [0x14014bb80]
lea rcx, str.Radar
call fcn.140033bd0
movzx eax, byte [0x14014ce30]
test eax, eax
je 0x140033d5e
movzx eax, byte [0x14014ce35]
test eax, eax
jne 0x140033d52
mov ecx, dword [0x14014ce60]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140033d5e
lea rcx, str.TriggerBot__Toggle_
call fcn.140094e50
movzx edx, byte [0x14014bbb4]
lea rcx, str.Crosshair
call fcn.140033bd0
movzx edx, byte [0x14014ce34]
lea rcx, [0x1400fcb80]
call fcn.140033bd0
movzx edx, byte [0x14014bb52]
lea rcx, [0x1400fcb90]
call fcn.140033bd0
movzx edx, byte [0x14014bb50]
lea rcx, str.Bhop
call fcn.140033bd0
movzx edx, byte [0x14014bb55]
lea rcx, [0x1400fcba8]
call fcn.140033bd0
movzx edx, byte [0x14014bb58]
lea rcx, [0x1400fcbb8]
call fcn.140033bd0
movzx edx, byte [0x14014bb59]
lea rcx, [0x1400fcbc8]
call fcn.140033bd0
call fcn.140054330
nop
add rsp, 0x38
ret
Function at 0x140034b40
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x4d0
lea rbp, [rsp + 0x20]
mov rax, qword [0x14012d010]
xor rax, rbp
mov qword [rbp + 0x4a0], rax
mov dword [rbp + 0x60], 0x438
mov rax, qword [rbp + 0x4c0]
mov edx, dword [rax + 0x10]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
call fcn.140034aa0
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x90]
mov qword [rbp + 0x20], rax
cmp qword [rbp + 0x20], 0
jne 0x140034bbd
mov qword [rbp + 0x30], 0
jmp 0x140034c5b
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 8]
cmp word [rax + rcx*2], 0
jne 0x140034bcd
mov rax, qword [rbp + 8]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x140034bfc
mov qword [rbp + 0x28], 0
jmp 0x140034c53
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x40], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x140034c24
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.1400f5010
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x40]
mov r8d, ecx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call fcn.140034ab0
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x30], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.140028fa0
mov rcx, qword [rbp + 0x30]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x140034c81
inc rcx
test dl, dl
jne 0x140034c6e
xor eax, eax
jmp 0x140034c86
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140034cb1
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.140005820
mov rax, qword [rbp + 0x48]
jmp 0x140034ce9
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140034b9e
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x50], 0
mov rcx, qword [rbp + 0x4c8]
call fcn.140005820
mov rax, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x4a0]
xor rcx, rbp
call fcn.1400f3e20
lea rsp, [rbp + 0x4b0]
pop rbp
ret
Function at 0x140035ef0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x2c0
lea rbp, [rsp + 0x20]
mov rax, qword [0x14012d010]
xor rax, rbp
mov qword [rbp + 0x290], rax
mov dword [rbp + 0x50], 0x238
xor edx, edx
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
call fcn.140034aa0
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x7c]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140035f62
mov qword [rbp + 0x38], 0
jmp 0x140036000
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x40], rax
mov qword [rbp + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 8]
cmp word [rax + rcx*2], 0
jne 0x140035f72
mov rax, qword [rbp + 8]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x140035fa1
mov qword [rbp + 0x30], 0
jmp 0x140035ff8
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x48], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x140035fc9
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.1400f5010
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x48]
mov r8d, ecx
mov rdx, qword [rbp + 0x28]
mov rcx, rax
call fcn.140034ab0
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x38], rax
mov rcx, qword [rbp + 0x2b8]
call fcn.140028fa0
mov rcx, qword [rbp + 0x38]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x140036026
inc rcx
test dl, dl
jne 0x140036013
xor eax, eax
jmp 0x14003602b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140036050
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x58]
mov dword [rbp + 0x1c], eax
mov rcx, qword [rbp + 0x2b8]
call fcn.140005820
mov eax, dword [rbp + 0x1c]
jmp 0x140036086
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140035f46
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x20], 0
mov rcx, qword [rbp + 0x2b8]
call fcn.140005820
mov eax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x290]
xor rcx, rbp
call fcn.1400f3e20
lea rsp, [rbp + 0x2a0]
pop rbp
ret
Function at 0x140040e50
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1401011d0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x140040ede
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x140040e82
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x140040ef0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1401011d0]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x140040ff4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x140040fef
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x140040fc4
cmp qword [rsp + 0x38], 2
jb 0x140040fc4
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140040fc4
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140040fc4
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140040f37
jmp 0x140041086
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x140041086
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x14004105c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14004105c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14004105c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140040ff4
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x14008e2e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14008e306
mov dword [rsp + 0x20], 1
jmp 0x14008e30e
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x14009e220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x3c18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
vmovss xmm0, dword [rax + 0x3c20]
vmovss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x50]
vmovss xmm0, dword [rsp + 0x24]
vdivss xmm0, xmm0, dword [rax + 0x14]
vmovss dword [rsp + 0x3c], xmm0
vxorps xmm2, xmm2, xmm2
vxorps xmm1, xmm1, xmm1
mov rcx, qword [rsp + 0x70]
call fcn.140008c10
vxorps xmm0, xmm0, xmm0
vmovss dword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x88]
cmp qword [rsp + 0x30], rax
jae 0x14009e373
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xa
jne 0x14009e335
vmovss xmm1, dword [rsp + 0x20]
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rax]
call fcn.140069f40
mov rax, qword [rsp + 0x70]
vmovss dword [rax], xmm0
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rax + 4]
vaddss xmm0, xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
vmovss dword [rax + 4], xmm0
vxorps xmm0, xmm0, xmm0
vmovss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0xa0]
test eax, eax
je 0x14009e330
jmp 0x14009e373
jmp 0x14009e2a5
cmp dword [rsp + 0x28], 0xd
jne 0x14009e341
jmp 0x14009e2a5
movzx edx, word [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.140094180
vmulss xmm0, xmm0, dword [rsp + 0x3c]
vmovss dword [rsp + 0x40], xmm0
vmovss xmm0, dword [rsp + 0x20]
vaddss xmm0, xmm0, dword [rsp + 0x40]
vmovss dword [rsp + 0x20], xmm0
jmp 0x14009e2a5
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rsp + 0x20]
vcomiss xmm0, dword [rax]
jbe 0x14009e393
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rsp + 0x20]
vmovss dword [rax], xmm0
cmp qword [rsp + 0x98], 0
je 0x14009e3d0
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rax + 4]
vaddss xmm0, xmm0, dword [rsp + 0x24]
vmovups xmm2, xmm0
vmovss xmm1, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.140008c10
mov rax, qword [rax]
mov rcx, qword [rsp + 0x98]
mov qword [rcx], rax
vmovss xmm0, dword [rsp + 0x20]
vcomiss xmm0, dword [0x1401225f8]
ja 0x14009e3f0
mov rax, qword [rsp + 0x70]
vxorps xmm0, xmm0, xmm0
vucomiss xmm0, dword [rax + 4]
jne 0x14009e40a
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rax + 4]
vaddss xmm0, xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
vmovss dword [rax + 4], xmm0
cmp qword [rsp + 0x90], 0
je 0x14009e425
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x1400cfda0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
and eax, 7
test eax, eax
je 0x1400cfdd1
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
and eax, 7
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.1400cf3b0
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jle 0x1400cfe2c
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x14]
and eax, 0xff
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x28], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x14]
shr eax, 8
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x14], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
sub eax, 8
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x10], eax
jmp 0x1400cfdd9
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jge 0x1400cfe48
lea rcx, [0x14011ac60]
call fcn.1400c2700
jmp 0x1400cff8c
cmp dword [rsp + 0x20], 4
jge 0x1400cfe6e
mov rcx, qword [rsp + 0x50]
call fcn.1400cf2a0
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x28], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
jmp 0x1400cfe48
mov eax, 1
imul rax, rax, 1
movzx eax, byte [rsp + rax + 0x28]
imul eax, eax, 0x100
mov ecx, 1
imul rcx, rcx, 0
movzx ecx, byte [rsp + rcx + 0x28]
add eax, ecx
mov dword [rsp + 0x24], eax
mov eax, 1
imul rax, rax, 3
movzx eax, byte [rsp + rax + 0x28]
imul eax, eax, 0x100
mov ecx, 1
imul rcx, rcx, 2
movzx ecx, byte [rsp + rcx + 0x28]
add eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x24]
xor eax, 0xffff
cmp dword [rsp + 0x2c], eax
je 0x1400cfede
lea rcx, str.zlib_corrupt
call fcn.1400c2700
jmp 0x1400cff8c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 8]
jbe 0x1400cff07
lea rcx, str.read_past_buffer
call fcn.1400c2700
jmp 0x1400cff8c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 0x28]
jbe 0x1400cff40
mov r8d, dword [rsp + 0x24]
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax + 0x18]
mov rcx, qword [rsp + 0x50]
call fcn.1400cf640
test eax, eax
jne 0x1400cff40
xor eax, eax
jmp 0x1400cff8c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rdx]
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x18], rax
mov eax, 1
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x1400dab90
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x48]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
add rsp, 0x38
ret
Function at 0x1400f06c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x1400f06fd
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400f0704
mov al, 1
jmp 0x1400f085e
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.14002a060
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.14002a060
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x40]
call fcn.14002a0c0
movzx eax, al
test eax, eax
je 0x1400f075b
xor al, al
jmp 0x1400f085e
mov qword [rsp + 0x60], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1400f07cb
cmp dword [rsp + 0x30], 1
je 0x1400f07d7
cmp dword [rsp + 0x30], 3
je 0x1400f084c
jmp 0x1400f085c
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x1400f0823
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x1400f0823
xor al, al
jmp 0x1400f085e
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400f083d
mov dword [rsp + 0x34], 1
jmp 0x1400f0845
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x1400f085e
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400f085e
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400f3e20
add rsp, 0xa8
ret

Function at 0x1400f3474
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400f34f8
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400fb0a0]
cmp byte [rcx + rax], 0
je 0x1400f34f8
dec r8
sub rdx, 1
jne 0x1400f34de
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140008b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x58]
xor r15d, r15d
mov r11, qword [rsp + 0x70]
mov r13, rdx
mov rax, qword [rsp + 0x60]
mov qword [r14], r8
mov qword [r11], rax
mov rdi, qword [r14]
cmp rdi, r9
je 0x140008d13
mov r12, qword [rsp + 0x68]
lea r8d, [r15 + 1]
mov rsi, qword [r11]
mov r9d, 0x3ff
mov r10d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x140008d13
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rdi]
cmp r8w, dx
jae 0x140008c19
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x140008d37
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140008c2f
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x140008c2f
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140008c42
movzx r9d, al
mov r10d, r15d
mov ebx, r15d
jmp 0x140008c8d
mov r9d, eax
cmp eax, 0x800
jae 0x140008c5c
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x140008c8d
cmp eax, 0x10000
jae 0x140008c76
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov ebx, r10d
jmp 0x140008c8d
shr r9d, 0x12
mov r10d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdx, r12
sub rdx, rsi
mov ecx, r8d
cmp rdx, rcx
jl 0x140008d13
lea rcx, [rdi + 2]
mov qword [r14], rcx
test bpl, bpl
jne 0x140008cb1
cmp r10d, 3
jae 0x140008cbd
mov rcx, qword [r11]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jle 0x140008cee
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax + rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jg 0x140008cd0
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rdi, qword [r14]
cmp rdi, qword [rsp + 0x50]
jne 0x140008bce
mov rax, qword [rsp + 0x48]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, 2
jmp 0x140008d22