joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x98
movabs rax, 0x14550f381
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x30], eax
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
call fcn.14006f700
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x14000f053
xor eax, eax
jmp 0x14000f1df
mov byte [rsp + 0x68], 0x41
mov byte [rsp + 0x69], 0x88
mov byte [rsp + 0x6a], 0x5d
mov byte [rsp + 0x6b], 0
mov byte [rsp + 0x6c], 0xf
mov byte [rsp + 0x6d], 0x4f
mov byte [rsp + 0x6e], 0xc1
mov byte [rsp + 0x6f], 0x48
mov byte [rsp + 0x70], 0x83
mov byte [rsp + 0x71], 0x44
mov byte [rsp + 0x72], 0x24
mov byte [rsp + 0x73], 0x50
mov byte [rsp + 0x74], 8
mov byte [rsp + 0x75], 0x41
mov byte [rsp + 0x76], 0x88
mov byte [rsp + 0x77], 0x45
mov byte [rsp + 0x78], 0xde
mov byte [rsp + 0x79], 0x41
mov byte [rsp + 0x7a], 0xff
mov byte [rsp + 0x7b], 0xc6
mov byte [rsp + 0x7c], 0x49
mov byte [rsp + 0x7d], 0xff
mov byte [rsp + 0x7e], 0xc5
mov byte [rsp + 0x7f], 0x89
mov byte [rsp + 0x80], 0x44
mov byte [rsp + 0x81], 0x24
mov byte [rsp + 0x82], 0x58
mov byte [rsp + 0x48], 0xb3
mov byte [rsp + 0x49], 0x63
mov byte [rsp + 0x4a], 0x41
mov byte [rsp + 0x4b], 0x88
mov byte [rsp + 0x4c], 0x5d
mov byte [rsp + 0x4d], 0
mov byte [rsp + 0x4e], 0xf
mov byte [rsp + 0x4f], 0x4f
mov byte [rsp + 0x50], 0xc1
mov byte [rsp + 0x51], 0x48
mov byte [rsp + 0x52], 0x83
mov byte [rsp + 0x53], 0x44
mov byte [rsp + 0x54], 0x24
mov byte [rsp + 0x55], 0x50
mov byte [rsp + 0x56], 8
mov byte [rsp + 0x57], 0xb0
mov byte [rsp + 0x58], 0x63
mov byte [rsp + 0x59], 0x41
mov byte [rsp + 0x5a], 0x88
mov byte [rsp + 0x5b], 0x45
mov byte [rsp + 0x5c], 0xde
mov byte [rsp + 0x5d], 0x41
mov byte [rsp + 0x5e], 0xff
mov byte [rsp + 0x5f], 0xc6
mov byte [rsp + 0x60], 0x49
mov byte [rsp + 0x61], 0xff
mov byte [rsp + 0x62], 0xc5
mov r9d, 0x20
mov r8, qword [rsp + 0x38]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
call fcn.14006faac
cmp dword [rsp + 0xa8], 0
je 0x14000f1b6
mov qword [rsp + 0x20], 0x1b
lea r9, [rsp + 0x48]
mov r8, qword [rsp + 0x38]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
call fcn.14006f9d4
jmp 0x14000f1da
mov qword [rsp + 0x20], 0x1b
lea r9, [rsp + 0x68]
mov r8, qword [rsp + 0x38]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
call fcn.14006f9d4
mov eax, 1
add rsp, 0x98
ret
Function at 0x14002aec4
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x140098690]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x14002af52
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x14002aef6
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x14002af5c
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x140098690]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x14002b05e
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x14002b059
mov rax, qword [rsp + 8]
mov al, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov al, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x14002b02e
cmp qword [rsp + 0x38], 2
jb 0x14002b02e
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14002b02e
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14002b02e
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x14002afa3
jmp 0x14002b0ee
mov rax, qword [rsp + 8]
mov al, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov al, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x14002b0ee
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x14002b0c4
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14002b0c4
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14002b0c4
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x14002b05e
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x14002b310
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.140078540
add rsp, 0x28
ret
Function at 0x1400592e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss dword [rsp + 0x20], xmm3
movss dword [rsp + 0x18], xmm2
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
movss xmm0, dword [rsp + 0x80]
ucomiss xmm0, dword [0x14009cc20]
jne 0x140059334
mov rax, qword [rsp + 0x70]
add rax, 0x80
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x40]
call fcn.140048798
jmp 0x14005945b
mov rax, qword [rsp + 0x70]
add rax, 0x80
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x80]
mov ecx, dword [rsp + 0x98]
lea eax, [rcx + rax + 1]
mov edx, eax
mov rcx, qword [rsp + 0x48]
call fcn.140048858
mov dword [rsp + 0x20], 0
jmp 0x14005937a
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x98]
cmp dword [rsp + 0x20], eax
jg 0x14005945b
cvtsi2ss xmm0, dword [rsp + 0x20]
cvtsi2ss xmm1, dword [rsp + 0x98]
divss xmm0, xmm1
movss xmm1, dword [rsp + 0x90]
subss xmm1, dword [rsp + 0x88]
mulss xmm0, xmm1
movss xmm1, dword [rsp + 0x88]
addss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x70]
add rax, 0x80
mov qword [rsp + 0x50], rax
movss xmm0, dword [rsp + 0x24]
call fcn.14008cca0
mulss xmm0, dword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
movss xmm1, dword [rax + 4]
addss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rsp + 0x24]
call fcn.14008c720
mulss xmm0, dword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
movss xmm1, dword [rax]
addss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x28], xmm0
movss xmm0, dword [rsp + 0x28]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x30]
movss dword [rsp + 0x3c], xmm0
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
call fcn.140048798
jmp 0x140059370
add rsp, 0x68
ret
Function at 0x14006f8e4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [rsp + 0xa0]
mov ecx, dword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x68], 0x1a
mov rax, qword [rsp + 0xa0]
cmp dword [rax + 0x30], 1
jne 0x14006f947
mov qword [rsp + 0x68], 0x1c
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
mov r8d, 0x1a
mov edx, dword [rsp + 0x70]
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax]
call fcn.140021fdc
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x80]
add rsp, 0x98
ret

Function at 0x140070778
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400707c2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400707c2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400707c2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400707c2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400707c2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400707c4
xor al, al
add rsp, 0x28
ret

Function at 0x14007e8b4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14007e6e0

Function at 0x14008c090
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14008c0b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14008c0b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x14008c144
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1800010a0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x60]
call sub.libglib_2.0_0.dll_g_utf8_to_utf16
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x3c], 0
cmp qword [rsp + 0x30], 0
jne 0x1800010f7
call qword [sym.imp.MSVCR100.dll__errno]
mov dword [rax], 0x16
mov eax, 0xffffffff
jmp 0x18000122b
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x68]
call sub.libglib_2.0_0.dll_g_utf8_to_utf16
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x180001142
mov rcx, qword [rsp + 0x30]
call sub.libglib_2.0_0.dll_g_free
call qword [sym.imp.MSVCR100.dll__errno]
mov dword [rax], 0x16
mov eax, 0xffffffff
jmp 0x18000122b
mov r8d, 1
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x180001169
mov dword [rsp + 0x38], 0
jmp 0x180001207
mov dword [rsp + 0x38], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
sub eax, 2
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0xb5
ja case.0x1800011ad.4
mov eax, dword [rsp + 0x48]
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x1254]
mov eax, dword [rcx + rax*4 + 0x1230]
add rax, rcx
jmp rax
mov dword [rsp + 0x3c], 2
jmp 0x180001207
mov dword [rsp + 0x3c], 2
jmp 0x180001207
mov dword [rsp + 0x3c], 0xd
jmp 0x180001207
mov dword [rsp + 0x3c], 5
mov rcx, qword [rsp + 0x30]
call sub.libglib_2.0_0.dll_g_free
mov rcx, qword [rsp + 0x40]
call sub.libglib_2.0_0.dll_g_free
call qword [sym.imp.MSVCR100.dll__errno]
mov ecx, dword [rsp + 0x3c]
mov dword [rax], ecx
mov eax, dword [rsp + 0x38]
add rsp, 0x58
ret

Function at 0x1800033d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add rax, qword [rbp + 0x20]
movzx eax, byte [rax]
movzx eax, al
lea rdx, [rbp]
mov ecx, dword [rbp + 8]
add rdx, rcx
movzx edx, byte [rdx]
movzx edx, dl
xor eax, edx
mov edx, dword [rbp + 4]
add rdx, qword [rbp + 0x20]
mov byte [rdx], al
mov eax, 1
add eax, dword [rbp + 8]
mov dword [rbp + 8], eax

Function at 0x180003400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [rbp + 4]
mov edx, dword [rbp + 0x28]
cmp eax, edx
jb 0x1800033cd
jmp 0x180003411
mov eax, 1
add eax, dword [rbp + 4]
mov dword [rbp + 4], eax
jmp 0x1800033b4
mov eax, dword [rbp + 4]
mov eax, dword [rbp + 8]
cmp eax, 4
jne 0x1800033c0
mov dword [rbp + 8], 0
jmp 0x1800033c0
lea rsp, [rbp + 0x10]
pop rbp
ret
Function at 0x1800053d4
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x10
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x1800053ed
test esi, esi
je 0x18000540c
call fcn.180005384
cmp eax, esi
jne 0x1800053ed
mov rax, qword [rbx + 0x30]
jmp 0x180005410
mov rax, qword [rbx + 0x30]
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x180006b10
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x3c]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180006b9d
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x3c], eax
jne 0x180006b9d
mov dword [rsp + 0x38], 0
jmp 0x180006b5c
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x38], eax
jge 0x180006b9d
movsxd rax, dword [rsp + 0x38]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + rax*8]
call sub.libglib_2.0_0.dll_g_utf16_to_utf8
movsxd rcx, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x58]
mov qword [rdx + rcx*8], rax
jmp 0x180006b52
add rsp, 0x48
ret

Function at 0x1800081b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x58]
mov ecx, dword [rcx]
mov dword [rax + 0x34], ecx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x58]
mov ecx, dword [rcx + 0x34]
mov dword [rax + 0x30], ecx
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x20], 0
lea rcx, str.POSIXLY_CORRECT
call sub.MSVCR100.dll_getenv
test rax, rax
je 0x18000820e
mov dword [rsp + 0x20], 1
jmp 0x180008216
mov dword [rsp + 0x20], 0
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x60]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x58]
mov dword [rcx + 0x2c], eax
mov rax, qword [rsp + 0x50]
movsx eax, byte [rax]
cmp eax, 0x2d
jne 0x180008252
mov rax, qword [rsp + 0x58]
mov dword [rax + 0x28], 2
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
jmp 0x18000829f
mov rax, qword [rsp + 0x50]
movsx eax, byte [rax]
cmp eax, 0x2b
jne 0x18000827a
mov rax, qword [rsp + 0x58]
mov dword [rax + 0x28], 0
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
jmp 0x18000829f
mov rax, qword [rsp + 0x58]
cmp dword [rax + 0x2c], 0
je 0x180008293
mov rax, qword [rsp + 0x58]
mov dword [rax + 0x28], 0
jmp 0x18000829f
mov rax, qword [rsp + 0x58]
mov dword [rax + 0x28], 1
mov rax, qword [rsp + 0x50]
add rsp, 0x38
ret
Function at 0x18003e080
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x18003e0b3
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x18003df80]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x180048260
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, 0x4c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x18004829a
cmp byte [0x1800fd383], 0
lea rcx, str.DRIFT_OFF
sete al
mov byte [0x1800fd383], al
test al, al
je 0x180048295
lea rcx, str.DRIFT_ON
call fcn.180050ad0
mov qword [rsp + 0x20], rbx
movabs rax, 0xd80958fc74e988a6
xor ebx, ebx
mov qword [0x180100a88], rax
cmp byte [0x1800fd383], bl
mov dword [0x1800fbc08], ebx
mov dword [0x1800fbc18], ebx
je 0x1800483a2
mov eax, dword [0x1800fd3a4]
inc eax
mov dword [0x1800fd3a4], eax
cmp eax, 2
jl 0x1800483a2
call fcn.180067770
mov qword [rsp + 0x30], rbx
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0x30], ecx
mov qword [0x180100a88], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x30], rbx
mov qword [0x1800fbce0], rax
mov dword [rsp + 0x30], 1
mov rax, qword [rsp + 0x30]
mov qword [0x1800fbce8], rax
mov dword [0x1800fbc18], ebx
mov dword [0x1800fbc08], 2
call fcn.180067770
mov qword [rsp + 0x30], rbx
mov ecx, dword [rax]
movabs rax, 0x222ff6a823d122e2
mov dword [rsp + 0x30], ecx
mov qword [0x180100a88], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x30], rbx
mov qword [0x1800fbce0], rax
mov dword [rsp + 0x30], 1
mov rax, qword [rsp + 0x30]
mov qword [0x1800fbce8], rax
mov dword [0x1800fbc18], ebx
mov dword [0x1800fbc08], 2
call fcn.180067770
mov dword [0x1800fd3a4], ebx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.180067770
mov qword [rsp + 0x30], rbx
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0x30], ecx
mov qword [0x180100a88], rax
mov rax, qword [rsp + 0x30]
mov qword [0x1800fbce0], rax
mov dword [0x1800fbc18], ebx
mov qword [0x1800fbce8], rbx
mov dword [0x1800fbc08], 2
call fcn.180067770
mov qword [rsp + 0x30], rbx
mov ecx, dword [rax]
movabs rax, 0x222ff6a823d122e2
mov dword [rsp + 0x30], ecx
mov qword [0x180100a88], rax
mov rax, qword [rsp + 0x30]
mov qword [0x1800fbce0], rax
mov dword [0x1800fbc18], ebx
mov qword [0x1800fbce8], rbx
mov dword [0x1800fbc08], 2
call fcn.180067770
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x1800518d0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1800518f8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x18005191e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180051920
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180051979
test ecx, ecx
jle 0x180051959
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180051979
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180051979
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x1800519a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1800519d1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x1800519ef
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180051a0b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180051a0d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180051a49
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180051ade
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x180051a84
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x180051abe
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x180051ade
cmp rbx, rax
ja 0x180051a90
test rbx, rbx
je 0x180051ade
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x180051f20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1800e23b0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x180051f4d
xor eax, eax
jmp 0x1800520aa
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x180051f78
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x180051f78
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1800520aa
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18005209d
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x180051fbb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180051fe6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800520a2
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180052055
sub eax, 1
je 0x180052055
cmp eax, 2
jne 0x18005209d
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800520a2
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180052083
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x18005209d
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1800520a2
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180071130
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret