joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009e40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x140009f60
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x140009ea0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x140009ea0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x140009ea0
Function at 0x1400168c0
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x1400168f5
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x1400168d0
and r10, 0xf
je 0x140016925
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x140016900
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140016919
mov rax, r8
repz ret

Function at 0x140016930
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x14001696d
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x140016940
pxor xmm1, xmm1
and r10, 0xf
je 0x1400169a3
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x14001697b
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140016997
mov rax, r8
repz ret
Function at 0x140069410
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x140069435
cvtsi2ss xmm0, rdx
jmp 0x14006944a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x1402805e8]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140069478
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140069478
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1400694aa
cmp rbx, 0x200
jae 0x1400694a7
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1400694aa
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140068c90

Function at 0x14006e240
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
push rbx
push rdi
push r14
push r15
sub rsp, 0x98
mov r10, qword [r9 + 0x10]
mov rdi, rdx
mov rdx, qword [r8 + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rdx
xor ebx, ebx
mov r15, rcx
cmp rax, r10
jb 0x14006e3a8
cmp qword [r8 + 0x18], 0xf
mov rax, r8
mov qword [r11 - 0x28], rbp
mov qword [r11 - 0x30], rsi
jbe 0x14006e28b
mov rax, qword [r8]
cmp qword [r9 + 0x18], 0xf
jbe 0x14006e295
mov r9, qword [r9]
mov qword [rsp + 0x30], r10
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], r9
mov r9, rax
mov qword [rsp + 0x20], rdx
movzx edx, byte [rsp + 0x40]
call fcn.140065450
mov rbp, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
mov rsi, qword [rsp + 0x48]
cmp rbp, 0xf
mov rdx, qword [rsp + 0x58]
movabs r9, 0xcbf29ce484222325
cmova rcx, rsi
test rdx, rdx
je 0x14006e303
movabs r8, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + rbx]
inc rbx
xor r9, rax
imul r9, r8
cmp rbx, rdx
jb 0x14006e2f0
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x68]
lea rcx, [r15 + 0xb8]
call fcn.14005e210
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x14006e329
mov rbx, qword [r15 + 0xc0]
cmp rbp, 0xf
jbe 0x14006e363
lea rdx, [rbp + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14006e35b
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006e35b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140277d20
mov rax, rdi
cmp rbx, qword [r15 + 0xc0]
jne 0x14006e37b
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
jmp 0x14006e38a
movups xmm0, xmmword [rbx + 0x30]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x40]
movups xmmword [rdi + 0x10], xmm1
mov rbp, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rbx
ret
call fcn.140069610
int3
Function at 0x14007b050
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0x1e8]
mov r10, r8
movsxd r9, dword [rcx + 0x1e0]
mov r11, rdx
mov rcx, r11
mov r8d, dword [rax + r9*4 - 4]
mov eax, r10d
sub eax, edx
xor edx, edx
test r10, r10
cmovne edx, eax
jmp fcn.14007bba0

Function at 0x14007b770
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
test r8, r8
je 0x14007b78b
mov qword [r8], 0
call fcn.14007b8c0
mov rbx, rax
test rax, rax
jne 0x14007b7a1
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x40], rsi
xor edx, edx
mov qword [rsp + 0x48], rdi
mov r8d, 2
mov rcx, rbx
mov qword [rsp + 0x50], r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14007b890
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14007b890
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14007b890
mov rax, qword [0x1403503d0]
mov rsi, rdi
test rax, rax
je 0x14007b809
inc dword [rax + 0x3c8]
mov rdx, qword [0x1403503e0]
lea rcx, [rdi + rbp]
call qword [0x140345010]
mov rdi, rax
test rax, rax
je 0x14007b890
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rsi
je 0x14007b868
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1403503d0]
test rax, rax
je 0x14007b856
dec dword [rax + 0x3c8]
mov rdx, qword [0x1403503e0]
mov rcx, rdi
call qword [0x140345018]
jmp 0x14007b899
test ebp, ebp
jle 0x14007b87a
lea rcx, [rdi + rsi]
mov r8, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14007b88b
mov qword [r14], rsi
mov rax, rdi
jmp 0x14007b89b
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
Function at 0x14007bba0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x1403503f4], 0
lea rdi, [0x1403503f0]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x14007bc78
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x14007bbd0
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x14007bcae
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x14007bc90
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x14007bcef
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x14007bcd3
cmp byte [r8], r9b
jne 0x14007bcd3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x14007bcc0
not eax
pop rdi
ret
Function at 0x140082f40
Capabilities:
Write file on windows

Disassembly:
push rdi
push r15
sub rsp, 0x28
mov rax, qword [0x1403503d0]
xor edi, edi
mov r15, rcx
mov dword [rax + 0x2d9c], edi
test rcx, rcx
je 0x14008306f
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rsi, qword [0x1403503d0]
lea rbx, [rsi + 0x2da0]
mov dword [rsi + 0x2d9c], edi
mov ecx, dword [rbx + 4]
test ecx, ecx
jns 0x140082fa5
mov eax, ecx
cdq
sub eax, edx
mov edx, edi
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.140085c90
mov dword [rbx], edi
cmp dword [rbx + 4], edi
jne 0x140082fb9
mov edx, 8
mov rcx, rbx
call fcn.140085c90
movsxd rcx, dword [rbx]
mov ebp, edi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], dil
inc dword [rbx]
cmp dword [rsi + 0x2db0], edi
jle 0x14008300a
mov qword [rsp + 0x20], r14
mov r14, rdi
nop dword [rax + rax]
mov r9, qword [rsi + 0x2db8]
mov r8, rbx
add r9, r14
mov rcx, rsi
mov rdx, r9
call qword [r9 + reloc.WLDAP32.dll_Ordinal_32]
inc ebp
add r14, 0x30
cmp ebp, dword [rsi + 0x2db0]
jl 0x140082fe0
mov r14, qword [rsp + 0x20]
cmp qword [rbx + 8], rdi
je 0x140083014
mov edi, dword [rbx]
dec edi
mov rax, qword [rsi + 0x2da8]
lea rdx, [0x140280884]
test rax, rax
movsxd rbp, edi
lea rdi, [0x1403503d8]
mov rcx, r15
cmovne rdi, rax
call fcn.14007b8c0
mov rsi, qword [rsp + 0x50]
mov rbx, rax
test rax, rax
je 0x140083065
mov r9, rax
mov r8, rbp
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x28
pop r15
pop rdi
ret
Function at 0x140088ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x140088c99
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x140088b76
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14008b930
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.140086520
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x140088b67
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140085dd0
mov dword [rbx + 0x80], 0
jmp 0x140088c85
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
mov r8d, 4
call fcn.14008be70
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400950f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14034a8c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.14007b080
mov rcx, qword [0x140350848]
lea rdx, [rsp + 0x28]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rsp + 0x30]
sub ecx, dword [rsp + 0x28]
movd xmm1, ecx
mov ecx, dword [rsp + 0x34]
sub ecx, dword [rsp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rsp + 0x40]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x40]
xorps xmm1, xmm1
sub rax, qword [0x140350850]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x140350858]
mov ecx, reloc.WS2_32.dll_recvfrom
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rsp + 0x40]
mov qword [0x140350850], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, reloc.WS2_32.dll_recv
and al, 1
mov byte [rdi + 0x128], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, reloc.WS2_32.dll_select
and al, 1
mov byte [rdi + 0x129], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x12b], 0
mov byte [rdi + 0x12a], al
call fcn.14007b080
cmp byte [rax + 0x3a7], 0
lea rbx, [rax + 0x110]
je 0x14009521d
cvttss2si ecx, dword [rbx]
lea rdx, [rsp + 0x38]
cvttss2si eax, dword [rax + 0x114]
mov dword [rsp + 0x38], ecx
mov rcx, qword [0x140350848]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx], 0xff7fffff
mov dword [rbx + 4], 0xff7fffff
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x140350848]
jne 0x140095279
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140095279
mov rcx, qword [0x140350848]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x140095279
movd xmm0, dword [rsp + 0x20]
movd xmm1, dword [rsp + 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x140095289
mov eax, 0xffffffff
jmp 0x14009528e
call fcn.14007b090
cmp dword [reloc.WS2_32.dll_htonl], eax
je 0x1400952a1
mov dword [reloc.WS2_32.dll_htonl], eax
call fcn.1400952d0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140278080
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140095730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14034a8c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [rcx]
mov ebx, edx
test al, al
je 0x140095768
cmp al, 0x25
jne 0x14009575d
cmp byte [rcx + 1], al
jne 0x140095768
inc rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140095751
cmp byte [rcx], 0x25
jne 0x140095839
cmp byte [rcx + 1], 0x25
je 0x140095839
xorps xmm3, xmm3
mov r8, rcx
cvtss2sd xmm3, xmm2
mov edx, 0x40
lea rcx, [rsp + 0x30]
movq r9, xmm3
call fcn.14007ba50
cmp byte [rsp + 0x30], 0x20
lea rcx, [rsp + 0x30]
jne 0x1400957ad
inc rcx
cmp byte [rcx], 0x20
je 0x1400957a5
lea eax, [rbx - 4]
cmp eax, 1
jbe 0x140095827
movzx edx, byte [rcx]
movzx r8d, dl
cmp dl, 0x2d
jne 0x1400957c6
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
xorps xmm1, xmm1
cmovne rax, rcx
cmp r8b, 0x2b
lea rcx, [rax + 1]
cmovne rcx, rax
movzx eax, byte [rcx]
cmp al, 0x30
jl 0x140095816
movss xmm2, dword [0x1402809a0]
nop dword [rax]
cmp al, 0x39
ja 0x140095816
movsx eax, byte [rcx]
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x1400957f0
cmp dl, 0x2d
jne 0x140095834
xorps xmm1, xmmword [0x140280a20]
movaps xmm0, xmm1
jmp 0x14009583c
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14009583c
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140278080
add rsp, 0x80
pop rbx
ret

Function at 0x140095860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14034a8c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [rcx]
mov ebx, edx
test al, al
je 0x140095898
cmp al, 0x25
jne 0x14009588d
cmp byte [rcx + 1], al
jne 0x140095898
inc rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140095881
cmp byte [rcx], 0x25
jne 0x14009595b
cmp byte [rcx + 1], 0x25
je 0x14009595b
mov r8, rcx
movaps xmm3, xmm2
lea rcx, [rsp + 0x30]
movq r9, xmm2
mov edx, 0x40
call fcn.14007ba50
cmp byte [rsp + 0x30], 0x20
lea rcx, [rsp + 0x30]
jne 0x1400958d9
inc rcx
cmp byte [rcx], 0x20
je 0x1400958d1
lea eax, [rbx - 4]
cmp eax, 1
jbe 0x14009594d
movzx edx, byte [rcx]
movzx r8d, dl
cmp dl, 0x2d
jne 0x1400958f2
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
xorps xmm1, xmm1
cmovne rax, rcx
cmp r8b, 0x2b
lea rcx, [rax + 1]
cmovne rcx, rax
movzx eax, byte [rcx]
cmp al, 0x30
jl 0x14009593c
movsd xmm2, qword [0x140284a18]
cmp al, 0x39
ja 0x14009593c
movsx eax, byte [rcx]
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x140095918
cmp dl, 0x2d
jne 0x140095956
xorps xmm1, xmmword [0x140284a70]
movaps xmm0, xmm1
jmp 0x14009595e
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14009595e
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140278080
add rsp, 0x80
pop rbx
ret
Function at 0x1400a4400
Capabilities:
Terminate process

Disassembly:
sub rsp, 0xe8
mov rax, qword [0x14034a8c0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
lea rdx, [0x140350930]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call sub.d3d9.dll_Direct3DCreate9Ex
test eax, eax
jns 0x1400a443a
mov ecx, 3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [0x140350a1c]
lea rdx, [0x140350938]
mov rcx, qword [0x140350930]
mov r8d, 1
mov r9, qword [0x1403509b0]
mov qword [rsp + 0x38], rdx
lea rdx, [0x140350940]
mov dword [0x140350940], eax
mov eax, dword [0x140350a20]
mov qword [0x140350958], 1
mov dword [0x140350968], 1
mov qword [0x140350960], r9
mov dword [0x140350948], 0x15
mov dword [0x140350944], eax
mov dword [0x14035096c], 1
mov dword [0x140350970], 0x50
mov qword [rsp + 0xe0], rdi
xor edi, edi
mov qword [0x14035094c], rdi
mov qword [0x140350974], rdi
mov dword [0x140350954], edi
mov dword [0x14035097c], edi
mov rax, qword [rcx]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdx
xor edx, edx
mov dword [rsp + 0x20], 0x40
call qword [rax + 0xa0]
test eax, eax
jns 0x1400a4511
mov rcx, qword [0x140350930]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov ecx, 4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
mov qword [rsp + 0xf0], rbx
call fcn.1400784e0
mov rcx, qword [0x1403509b0]
call fcn.140094fe0
mov rcx, qword [0x140350938]
call fcn.140094400
call fcn.14007b080
lea rcx, [rsp + 0x40]
mov rbx, rax
mov qword [rax + 0x18], rdi
call fcn.140086280
movss xmm2, dword [0x140280ae4]
lea rax, [0x140284f58]
mov qword [rsp + 0x78], rax
lea r9, [rsp + 0x40]
mov byte [rsp + 0x60], dil
lea rdx, str.C:WindowsFonts_tahoma.ttf
mov byte [rsp + 0x4c], dil
mov dword [rsp + 0x58], 5
mov dword [rsp + 0x5c], 5
mov dword [rsp + 0x90], 0x3f99999a
mov rcx, qword [rbx + 0x98]
mov qword [rsp + 0x20], rax
call fcn.140087200
xor ecx, ecx
call fcn.14008cb90
call fcn.14007b580
movdqa xmm3, xmmword [0x1402850a0]
xorps xmm1, xmm1
movdqa xmm2, xmmword [0x1402850b0]
movdqa xmm0, xmmword [0x140285080]
movups xmmword [rax + 0xc0], xmm0
mov dword [rax + 0xc], edi
movdqa xmm0, xmmword [0x140285090]
movups xmmword [rax + 0xd0], xmm0
mov dword [rax + 0x10], 0x3f800000
movups xmmword [rax + 0x230], xmm1
mov dword [rax + 0x28], 0x3f800000
movdqa xmm1, xmmword [0x1402850c0]
xorps xmm0, xmm0
movups xmmword [rax + 0x220], xmm0
mov dword [rax + 0x40], 0x3f800000
movups xmmword [rax + 0x240], xmm0
mov qword [rax + 0x34], rdi
movups xmmword [rax + 0xf0], xmm2
mov word [rax + 0x98], di
movups xmmword [rax + 0x110], xmm3
movups xmmword [rax + 0xe0], xmm3
movups xmmword [rax + 0x1c0], xmm1
movups xmmword [rax + 0x1d0], xmm1
movups xmmword [rax + 0x250], xmm2
movups xmmword [rax + 0x270], xmm2
movups xmmword [rax + 0x260], xmm2
movups xmmword [rax + 0x1f0], xmm3
movups xmmword [rax + 0x210], xmm3
movups xmmword [rax + 0x200], xmm3
mov rcx, qword [0x140350930]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rbx, qword [rsp + 0xf0]
xor eax, eax
mov rdi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140278080
add rsp, 0xe8
ret