joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140082bd0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1402a2cf8]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.140063060
mov rdi, rax
mov rcx, qword [rax + 0xa0]
cmp dword [rcx + 0x40], 0
jle 0x140082c0c
cmp qword [rcx + 0x18], 0
jne 0x140082c25
cmp qword [rcx + 0x20], 0
jne 0x140082c25
mov r8d, 0xd7
lea rdx, str.H:loadermainmenuImGuiimgui_impl_win32.cpp
lea rcx, str.io.Fonts__IsBuilt_____Font_atlas_not_built__It_is_generally_built_by_the_renderer_back_end._Missing_call_to_renderer__NewFrame___function__e.g._ImGui_ImplOpenGL3_NewFrame__._
call fcn.1400c8588
mov rcx, qword [0x1402a79b0]
lea rdx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x40]
lea rcx, [rsp + 0x30]
sub eax, dword [rsp + 0x38]
movd xmm1, eax
mov eax, dword [rsp + 0x44]
sub eax, dword [rsp + 0x3c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
xorps xmm1, xmm1
sub rax, qword [0x1402a79b8]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x1402a79c0]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rsp + 0x30]
mov qword [0x1402a79b8], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rdi + 0x140], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rdi + 0x141], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x143], 0
mov byte [rdi + 0x142], al
call fcn.140063060
mov rbx, rax
cmp byte [rax + 0x39b], 0
je 0x140082d31
cvttss2si ecx, dword [rax + 0x128]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], ecx
cvttss2si ecx, dword [rax + 0x12c]
mov dword [rsp + 0x24], ecx
mov rcx, qword [0x1402a79b0]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx + 0x128], 0xff7fffff
mov dword [rbx + 0x12c], 0xff7fffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x140082db0
mov rdx, qword [0x1402a79b0]
cmp rax, rdx
je 0x140082d69
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x140082db0
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140082db0
mov rcx, qword [0x1402a79b0]
lea rdx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x140082db0
movd xmm0, dword [rsp + 0x28]
movd xmm1, dword [rsp + 0x2c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0x128], xmm0
movss dword [rbx + 0x12c], xmm1
cmp byte [rdi + 0xc0], 0
je 0x140082dc0
mov eax, 0xffffffff
jmp 0x140082dc5
call fcn.1400630a0
cmp dword [reloc.OLEAUT32.dll_VariantCopy], eax
je 0x140082dd8
mov dword [reloc.OLEAUT32.dll_VariantCopy], eax
call fcn.1400830f0
call fcn.140082e10
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14009a9c0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14008eb20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x50
mov rbp, r8
mov r15, rdx
mov r14, rcx
cmp rdx, r8
je 0x14008ed11
cmp qword [rdx + 0x28], 0x10
lea r8, [rdx + 0x10]
mov rax, qword [rcx + 8]
mov r10, qword [rcx + 0x18]
mov r9, qword [r8 + 0x10]
mov qword [rsp + 0x70], rbx
mov rbx, rdx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x80], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x20], r10
jb 0x14008eb88
mov r8, qword [r8]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
movabs r11, 0x100000001b3
test r9, r9
je 0x14008ebc4
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + r8]
inc rcx
xor rdx, rax
imul rdx, r11
cmp rcx, r9
jb 0x14008ebb0
mov r12, qword [r14 + 0x30]
and r12, rdx
shl r12, 4
add r12, r10
mov rax, qword [r12 + 8]
mov r13, qword [r12]
mov qword [rsp + 0x88], rax
mov rdi, rbx
mov rsi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x10]
call fcn.14008e1b0
mov edx, 0xc8
mov rcx, rdi
call fcn.14009aa1c
dec qword [r14 + 0x10]
cmp rdi, qword [rsp + 0x88]
je 0x14008ec2f
cmp rbx, rbp
jne 0x14008ebe3
cmp r13, r15
jne 0x14008ec1e
mov qword [r12], rbx
mov rax, qword [rsp + 0x78]
mov qword [rax], rbx
mov qword [rbx + 8], rax
jmp 0x14008ecf8
cmp r13, r15
mov r13, qword [rsp + 0x78]
jne 0x14008ec47
mov rax, qword [rsp + 0x80]
mov qword [r12], rax
jmp 0x14008ec4a
mov rax, r13
mov qword [r12 + 8], rax
cmp rbx, rbp
je 0x14008ecf0
nop dword [rax + rax]
cmp qword [rbx + 0x28], 0x10
lea r8, [rbx + 0x10]
mov r9, qword [r8 + 0x10]
jb 0x14008ec72
mov r8, qword [r8]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test r9, r9
je 0x14008eca9
movabs r13, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + r8]
inc rcx
xor rdx, rax
imul rdx, r13
cmp rcx, r9
jb 0x14008ec90
mov r13, qword [rsp + 0x78]
mov r15, qword [r14 + 0x30]
and r15, rdx
shl r15, 4
add r15, qword [rsp + 0x20]
mov r12, qword [r15 + 8]
nop dword [rax]
mov rdi, rbx
mov rsi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x10]
call fcn.14008e1b0
mov edx, 0xc8
mov rcx, rdi
call fcn.14009aa1c
dec qword [r14 + 0x10]
cmp rdi, r12
je 0x14008ed1e
cmp rbx, rbp
jne 0x14008ecc0
mov qword [r15], rbx
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x70]
mov r13, qword [rsp + 0x30]
mov rax, rbp
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
mov rcx, qword [rsp + 0x80]
mov qword [r15], rcx
mov qword [r15 + 8], rcx
cmp rbx, rbp
jne 0x14008ec60
jmp 0x14008ecf0
Function at 0x140091c10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x140091c35
cvtsi2ss xmm0, rdx
jmp 0x140091c4a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.1400d1a14
movss xmm1, dword [0x140120f78]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140091c78
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140091c78
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x140091caa
cmp rbx, 0x200
jae 0x140091ca7
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x140091caa
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14008e750

Function at 0x140091cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x140091ce5
cvtsi2ss xmm0, rdx
jmp 0x140091cfa
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.1400d1a14
movss xmm1, dword [0x140120f78]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140091d28
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140091d28
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x140091d5a
cmp rbx, 0x200
jae 0x140091d57
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x140091d5a
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14008b410
Function at 0x140096710
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x1402a2cf8]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov eax, edx
mov dword [rbp - 0x61], 0x67452301
and eax, 0x1fffffff
mov dword [rbp - 0x5d], 0xefcdab89
mov dword [rbp - 0x69], eax
mov rdi, r8
mov eax, edx
mov dword [rbp - 0x59], 0x98badcfe
shr eax, 0x1d
mov rbx, rdx
mov dword [rbp - 0x55], 0x10325476
mov dword [rbp - 0x65], eax
cmp edx, 0x40
jb 0x140096780
mov r8d, ebx
mov rdx, rcx
and r8d, 0xffffffc0
lea rcx, [rbp - 0x69]
call fcn.140094ad0
mov rcx, rax
and ebx, 0x3f
mov rdx, rcx
mov r8d, ebx
lea rcx, [rbp - 0x51]
call fcn.1400b76e0
mov ecx, dword [rbp - 0x69]
mov eax, 0x40
and ecx, 0x3f
mov byte [rbp + rcx - 0x51], 0x80
inc ecx
sub eax, ecx
cmp eax, 8
jae 0x1400967d5
mov r8d, eax
xor edx, edx
mov eax, ecx
lea rcx, [rbp - 0x51]
add rcx, rax
call fcn.1400b6650
mov r8d, 0x40
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x69]
call fcn.140094ad0
xor ecx, ecx
mov eax, 0x40
add eax, 0xfffffff8
xor edx, edx
mov r8d, eax
mov eax, ecx
lea rcx, [rbp - 0x51]
add rcx, rax
call fcn.1400b6650
mov eax, dword [rbp - 0x69]
lea rdx, [rbp - 0x51]
mov r8d, 0x40
lea ecx, [rax*8]
movzx eax, cl
mov dword [rbp - 0x69], ecx
mov eax, ecx
mov byte [rbp - 0x19], cl
shr eax, 8
mov byte [rbp - 0x18], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp - 0x17], al
movzx eax, byte [rbp - 0x65]
mov byte [rbp - 0x15], al
shr ecx, 0x18
mov byte [rbp - 0x16], cl
mov ecx, dword [rbp - 0x65]
mov eax, ecx
shr eax, 8
mov byte [rbp - 0x14], al
mov eax, ecx
shr ecx, 0x18
mov byte [rbp - 0x12], cl
lea rcx, [rbp - 0x69]
shr eax, 0x10
mov byte [rbp - 0x13], al
call fcn.140094ad0
movzx ecx, byte [rbp - 0x61]
mov byte [rdi], cl
mov ecx, dword [rbp - 0x61]
mov eax, ecx
shr eax, 8
mov byte [rdi + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 2], al
movzx eax, byte [rbp - 0x5d]
mov byte [rdi + 4], al
shr ecx, 0x18
mov byte [rdi + 3], cl
mov ecx, dword [rbp - 0x5d]
mov eax, ecx
shr eax, 8
mov byte [rdi + 5], al
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 6], al
movzx eax, byte [rbp - 0x59]
mov byte [rdi + 8], al
shr ecx, 0x18
mov byte [rdi + 7], cl
mov ecx, dword [rbp - 0x59]
mov eax, ecx
shr eax, 8
mov byte [rdi + 9], al
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 0xa], al
movzx eax, byte [rbp - 0x55]
mov byte [rdi + 0xc], al
shr ecx, 0x18
mov byte [rdi + 0xb], cl
mov ecx, dword [rbp - 0x55]
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xd], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [rdi + 0xf], cl
mov byte [rdi + 0xe], al
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14009a9c0
add rsp, 0xd0
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400af9c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
mov r10, qword [rsp + 0x40]
xor ecx, ecx
mov r11, rdx
test r10, r10
je 0x1400afb40
cmp r10, 0x40
jb 0x1400afb08
mov qword [rsp + 0x20], rbx
lea rdx, [r8 - 1]
lea rbx, [r10 - 1]
add rdx, r10
add rbx, r11
cmp r8, rbx
ja 0x1400afa02
cmp rdx, r11
jae 0x1400afb03
lea rax, [r9 - 1]
add rax, r10
cmp r8, rax
ja 0x1400afa17
cmp rdx, r9
jae 0x1400afb03
cmp r11, rax
ja 0x1400afa25
cmp rbx, r9
jae 0x1400afb03
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x10], rdi
mov rdi, r10
mov qword [rsp + 8], r14
and rdi, 0xffffffffffffffc0
mov qword [rsp], r15
mov rax, r9
lea rdx, [r8 + 0x10]
sub rax, r8
mov rsi, r9
sub rsi, r11
mov rbx, r11
sub rbx, r8
lea rbp, [rax + 0x10]
lea r14, [rax + 0x20]
lea r15, [rax - 0x10]
nop word [rax + rax]
movdqu xmm0, xmmword [rdx - 0x10]
lea rax, [rbx + rdx]
add rcx, 0x40
movdqu xmm1, xmmword [r15 + rdx]
lea rdx, [rdx + 0x40]
movdqu xmm2, xmmword [rax + rsi]
pxor xmm0, xmm1
movdqu xmmword [rdx - 0x50], xmm1
movdqa xmm1, xmm2
movdqu xmmword [rbx + rdx - 0x50], xmm0
movdqu xmm0, xmmword [rdx - 0x40]
movdqu xmmword [rdx - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rdx - 0x30]
movdqu xmm2, xmmword [r14 + rdx - 0x40]
movdqu xmmword [rax], xmm1
movdqu xmm1, xmmword [rdx + rbp - 0x40]
pxor xmm0, xmm1
movdqu xmmword [rbx + rdx - 0x30], xmm0
movdqu xmmword [rdx - 0x30], xmm1
movdqu xmm0, xmmword [rdx - 0x20]
movdqu xmmword [rdx - 0x20], xmm2
pxor xmm0, xmm2
movdqu xmmword [rbx + rdx - 0x20], xmm0
cmp rcx, rdi
jb 0x1400afa70
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
cmp rcx, r10
jae 0x1400afb40
sub r9, r11
lea rax, [rcx + r8]
sub r11, r8
sub r10, rcx
nop word [rax + rax]
lea rdx, [rax + r11]
movzx r8d, byte [rdx + r9]
lea rax, [rax + 1]
movzx ecx, r8b
xor cl, byte [rax - 1]
mov byte [rdx], cl
mov byte [rax - 1], r8b
sub r10, 1
jne 0x1400afb20
add rsp, 0x18
ret
Function at 0x1400d87cc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400d85f8
Function at 0x140001450
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rsp + 0x4c]
mov r8, rdi
sub r8, rdx
nop dword [rax + rax]
movzx ecx, word [rdx]
movzx eax, word [rdx + r8]
sub ecx, eax
jne 0x1400014b4
add rdx, 2
test eax, eax
jne 0x1400014a0
test ecx, ecx
je 0x1400014db
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001490
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
mov eax, dword [rsp + 0x28]
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x1400014f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001531
xor eax, eax
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 0x50], rbx
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x58], rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
movsxd rbx, eax
mov rdx, rbx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov rdx, rax
mov r8d, ebx
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x50]
test eax, eax
je 0x1400015a4
cmp dword [rsi], 0x905a4d
jne 0x1400015a4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rsi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x40
pop rdi
ret

Function at 0x140001740
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
movsxd rdx, ecx
lea rcx, [0x1400016f0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [0x14000a180]
add rsp, 0x28
ret
Function at 0x140005940
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, rdx
lea rcx, [0x14000a190]
cmp qword [0x14000a1a8], 0x10
cmovae rcx, qword [0x14000a190]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r12, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov r14, qword [rdi + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0xc
jb 0x140005b46
mov r15, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400059ad
mov r15, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rbp, [r14 + 0xc]
mov ebx, 0xf
lea rsi, [rsp + 0x20]
cmp rbp, rbx
jbe 0x140005a4b
mov rbx, rbp
or rbx, 0xf
cmp rbx, rcx
jbe 0x140005a0d
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400067d4
test rax, rax
je 0x140005ad0
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140005a46
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140005a35
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005b4c
jmp 0x1400059ee
test rcx, rcx
je 0x140005a44
call fcn.1400067d4
mov rsi, rax
jmp 0x140005a46
xor esi, esi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbx
movsd xmm0, qword [str.___log_____]
movsd qword [rsi], xmm0
mov eax, dword [0x140008628]
mov dword [rsi + 8], eax
lea rcx, [rsi + 0xc]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbp], 0
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, r12
call fcn.1400065b0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140005add
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ad7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ad7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006810
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140005b13
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140005b0e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005b3f
mov rcx, r8
call fcn.140006810
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140005830
nop
call fcn.140005790
int3
Function at 0x140007070
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400070ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400070ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400070ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400070ba
cmp dword [rcx + 0x84], 0xe
jbe 0x1400070ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400070bc
xor al, al
add rsp, 0x28
ret
Function at 0x140005c5c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r8d, dword [0x140029d70]
lea rdi, [0x140029d70]
mov r9d, 0x270
cmp r8d, r9d
jne 0x140005cd3
lea r8, [0x140029d78]
mov r10d, 0x7fffffff
mov r11d, 0x9908b0df
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, r10d
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140005c92
mov r8d, dword [0x140029d70]
jmp 0x140005da7
cmp r8d, 0x4e0
jb 0x140005da7
xor r8d, r8d
mov r10d, 0x7fffffff
mov ebx, r8d
mov r11d, 0x9908b0df
mov r9d, 0x38c
mov eax, dword [rbx + rdi + 0x9c4]
mov edx, eax
xor edx, dword [rbx + rdi + 0x9c8]
and edx, r10d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [rbx + rdi + 0xff8]
xor ecx, edx
mov dword [rbx + rdi + 4], ecx
add rbx, 4
cmp rbx, r9
jb 0x140005cf8
mov eax, dword [r9 + rdi + 0x9c4]
mov edx, eax
xor edx, dword [r9 + rdi + 0x9c8]
and edx, r10d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [r9 + rdi - 0x388]
xor ecx, edx
mov dword [r9 + rdi + 4], ecx
add r9, 4
cmp r9, 0x9bc
jb 0x140005d30
mov edx, dword [0x14002b0f0]
xor edx, dword [0x140029d74]
and edx, r10d
mov dword [0x140029d70], r8d
xor edx, dword [0x14002b0f0]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, edx
xor ecx, dword [0x14002a3a4]
mov dword [0x14002a730], ecx
mov rbx, qword [rsp + 8]
mov eax, r8d
mov ecx, dword [rdi + rax*4 + 4]
inc eax
mov rdi, qword [rsp + 0x10]
mov dword [0x140029d70], eax
mov eax, ecx
shr eax, 0xb
and eax, dword [0x14002b0f4]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x140006534
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x178]
sub rsp, 0x270
mov ebx, 0x104
lea rdx, [rbp + 0x60]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov r8d, ebx
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
xorps xmm1, xmm1
or rdi, 0xffffffffffffffff
movups xmmword [rsp + 0x30], xmm0
mov r8, rdi
movdqu xmmword [rsp + 0x40], xmm1
inc r8
cmp byte [rax + r8], 0
jne 0x140006590
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140006170
lea rax, [rbp + 0x60]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400065ad
mov rsi, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
mov rbx, qword [rsp + 0x30]
lea r9, [rbp + 0x60]
mov rdx, qword [rsp + 0x40]
cmp rsi, 0xf
mov qword [rsp + 0x20], rdi
cmova rcx, rbx
call fcn.1400060cc
test rax, rax
sete dil
cmp rsi, 0xf
jbe 0x14000661a
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140006612
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006636
mov rcx, rbx
call fcn.1400073d8
lea r11, [rsp + 0x270]
mov al, dil
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14000d4c4
int3
Function at 0x1400066e8
Capabilities:
Check for debugger via api

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14000671b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x38], 0
jne 0x14000671b
add rsp, 0x28
ret
mov ecx, 1
call fcn.14000cf50
int3
Function at 0x1400069b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov dil, byte [r9]
mov rbx, rdx
mov rdx, qword [r8]
xor eax, eax
xorps xmm0, xmm0
or r8, 0xffffffffffffffff
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
inc r8
cmp byte [rdx + r8], al
jne 0x1400069d7
mov rcx, rbx
call fcn.140006170
cmp qword [rbx + 0x18], 0xf
jbe 0x1400069f7
mov rdx, qword [rbx]
mov rcx, rdx
jmp 0x1400069fd
mov rcx, rbx
mov rdx, rbx
mov r8, qword [rbx + 0x10]
add r8, rcx
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140006a11
mov rcx, qword [rbx]
cmp rcx, r8
je 0x140006a29
sub rdx, rcx
mov al, dil
xor al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
cmp rcx, r8
jne 0x140006a19
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140007b90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140007bda
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140007bda
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007bda
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140007bda
cmp dword [rcx + 0x84], 0xe
jbe 0x140007bda
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140007bdc
xor al, al
add rsp, 0x28
ret

Function at 0x14000cd4c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000cdbb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000cdbb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000cdbb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000cdbb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000cdbb
cmp dword [rcx + 0x84], 0xe
jbe 0x14000cdbb
cmp dword [rcx + 0xf8], 0
je 0x14000cdbb
mov ecx, ebx
call fcn.14000ce6c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000cc48
nop
cmp dword [rbp + 0x20], 0
je 0x14000ce09
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000ce14
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000cd4c