joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001034
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0x30
mov rbx, rdx
mov edi, ecx
and qword [rsp + 0x50], 0
mov ecx, 0x3a98
call fcn.1400052d0
mov rcx, rax
mov r9, rbx
mov r8d, edi
lea rdx, [0x140006950]
call fcn.140003fbc
nop
mov r14d, 0x3a99
mov ecx, r14d
call fcn.1400052d0
lea rcx, [0x14002ada4]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
lea r9, [0x140006970]
mov r8, rbx
mov edx, edi
mov rcx, rax
call fcn.1400040ac
mov r10b, al
mov dl, byte [0x14002adac]
cmp byte [0x14002ad99], 0
je 0x140001125
test dl, dl
je 0x1400010ec
mov ecx, r14d
call fcn.1400052d0
mov rcx, rax
lea r9, str.noreset
lea r8, str.reset
mov edx, 0x42
call fcn.140003c80
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov al, byte [0x14002ad98]
test al, al
je 0x140001162
mov ecx, r14d
call fcn.1400052d0
mov rcx, rax
lea r9, str.onlyzero
lea r8, str.reset
mov edx, 0x42
call fcn.140003c80
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov al, byte [0x14002ad98]
test dl, dl
je 0x140001162
test al, al
je 0x140001162
mov ecx, r14d
call fcn.1400052d0
mov rcx, rax
lea r9, str.onlyzero
lea r8, str.noreset
mov edx, 0x42
call fcn.140003c80
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp byte [0x14002adab], 0
je 0x1400011a3
cmp dword [0x14002ada0], 0
jne 0x1400011a3
mov ecx, r14d
call fcn.1400052d0
mov rcx, rax
lea r9, [0x140006910]
lea r8, str.wait
mov edx, 0x44
call fcn.140003c80
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r9b, byte [0x14002ad9b]
mov r8b, byte [0x14002adad]
test r9b, r9b
je 0x1400011ea
test r8b, r8b
je 0x1400011ea
mov ecx, r14d
call fcn.1400052d0
mov rcx, rax
lea r9, str.resume
lea r8, str.pause
mov edx, 0x42
call fcn.140003c80
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
test dl, dl
sete byte [0x14002ad99]
test r10b, r10b
je 0x14000125e
cmp byte [0x14002ada9], 0
jne 0x140001274
mov ecx, dword [0x14002ada4]
cmp ecx, 2
jg 0x140001253
cmp ecx, 1
jne 0x140001215
test al, al
je 0x140001253
test ecx, ecx
jne 0x140001223
test r9b, r9b
jne 0x140001223
test r8b, r8b
je 0x140001253
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov qword [0x14002adb8], rax
mov rax, qword [rcx + 8]
mov qword [0x14002adb0], rax
call fcn.140002e60
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop r14
ret
mov ecx, 1
call fcn.140001000
int3
mov ecx, 0xa
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_putchar]
mov ecx, 1
call fcn.140001000
int3
xor ecx, ecx
call fcn.140001000
int3
Function at 0x140001fc0
Capabilities:
Get common file path
Terminate process

Disassembly:
sub rsp, 0x248
mov rax, qword [0x140009010]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140002010
mov ecx, 0x3a99
call fcn.1400052d0
mov rcx, rax
mov edx, 0x60
call fcn.140003d30
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r8, [0x140006d50]
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x14002adc8], rax
test rax, rax
jne 0x14000205a
lea r8d, [rax + 0x30]
mov ecx, 0x406
lea rdx, str.D:_a_work1_s_src_vctoolsCompilerUtc_src_toolspogopogosweep_sweepsys.cpp
call fcn.140005a2c
mov rax, qword [0x14002adc8]
lea rdx, str.EnumDeviceDrivers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14002add0], rax
test rax, rax
jne 0x14000208b
lea r8d, [rax + 0x37]
mov ecx, 0x407
lea rdx, str.D:_a_work1_s_src_vctoolsCompilerUtc_src_toolspogopogosweep_sweepsys.cpp
call fcn.140005a2c
mov rcx, qword [0x14002adc8]
lea rdx, str.GetDeviceDriverBaseNameW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14002adc0], rax
test rax, rax
jne 0x1400020c0
lea r8d, [rax + 0x3e]
mov ecx, 0x407
lea rdx, str.D:_a_work1_s_src_vctoolsCompilerUtc_src_toolspogopogosweep_sweepsys.cpp
call fcn.140005a2c
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140002e40
add rsp, 0x248
ret
Function at 0x1400052d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x14000ad70]
xor edi, edi
mov ebx, ecx
mov esi, 1
test rax, rax
jne 0x140005320
cmp byte [0x14000ad78], dil
jne 0x140005320
xor edx, edx
xor ecx, ecx
call fcn.1400049fc
movzx ecx, byte [0x14000ad78]
test rax, rax
mov qword [0x14000ad70], rax
cmove ecx, esi
mov byte [0x14000ad78], cl
mov ecx, ebx
xor r9d, r9d
sar ecx, 4
add cx, si
movzx r8d, cx
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x140005384
mov rcx, qword [0x14000ad70]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
test rax, rax
je 0x140005384
and ebx, 0x8000000f
jge 0x140005368
sub ebx, esi
or ebx, 0xfffffff0
add ebx, esi
test ebx, ebx
je 0x14000537b
movzx eax, word [rcx]
lea rcx, [rcx + rax*2]
add rcx, 2
sub ebx, esi
jne 0x14000536c
lea rax, [rcx + 2]
cmp word [rcx], di
jne 0x14000538b
lea rax, [0x140006c9c]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140005438
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x140009010]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rcx
xor r8d, r8d
lea rcx, str.VS_UNICODE_OUTPUT
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140005499
mov r8d, 0x40
lea rdx, [rsp + 0x20]
lea rcx, str.VS_UNICODE_OUTPUT
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi64]
mov qword [rbx], rax
mov eax, 1
jmp 0x14000549b
xor eax, eax
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140002e40
add rsp, 0xb0
pop rbx
ret
Function at 0x1400054b4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x140009010]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbp, rdx
lea rsi, [rsp + 0x60]
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov ecx, eax
lea rdx, [rsp + 0x40]
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
or rdi, 0xffffffffffffffff
mov rbx, rdi
xor r12d, r12d
inc rbx
cmp word [rbp + rbx*2], r12w
jne 0x14000550a
imul ebx, dword [rsp + 0x40]
inc ebx
cmp ebx, 0x100
jle 0x140005555
movsxd rcx, ebx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x140005555
mov ecx, 0x2720
call fcn.1400052d0
lea ebx, [rsi + 2]
mov rcx, rax
mov edx, ebx
call fcn.140003d30
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x38], r12
mov r9d, edi
mov qword [rsp + 0x30], r12
mov r8, rbp
mov dword [rsp + 0x28], ebx
xor edx, edx
mov ecx, r15d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputs]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
cmp ebx, 0x100
jle 0x14000559f
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc rdi
cmp word [rbp + rdi*2], r12w
jne 0x14000559f
mov eax, edi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140002e40
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x1400055d8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r15
sub rsp, 0x30
movsxd rdi, edx
mov rbx, rcx
cmp edi, 1
ja 0x1400056a5
lea r15, [0x140000000]
xor ebp, ebp
cmp dword [r15 + rdi*4 + 0xad80], ebp
jne 0x140005638
lea ecx, [rbp + 1]
test edx, edx
je 0x140005616
lea ecx, [rbp + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call fcn.1400053ec
mov dword [r15 + rdi*4 + 0xad88], eax
mov dword [r15 + rdi*4 + 0xad80], 1
cmp dword [r15 + rdi*4 + 0xad88], ebp
je 0x14000564d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__cputws]
jmp 0x1400056a5
lea rcx, [rsp + 0x60]
call fcn.140005438
test eax, eax
je 0x140005686
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], bp
jne 0x14000565f
mov rcx, qword [rsp + 0x60]
lea r8d, [rax + rax]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], rbp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1400056a5
mov ecx, 1
test edi, edi
je 0x140005694
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.1400054b4
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
Function at 0x14043d4e0
Capabilities:
Encode data using xor

Disassembly:
invalid
lea rbp, [rsp + rbp + 8]
mov word [rbp + riz], di
jae 0x1404464a3
add byte [rax], al
call fcn.1404495bf
add byte [rax], al
add byte [rax], al
add byte [rax], al
jbe 0x14043d499
add dword [rax], eax
add byte [rax], al
loopne 0x14043d540
add dword [rax], eax
add byte [rax], al
cmp dh, bl
add dword [rax], eax
add byte [rax], al
mov ebp, 0x1404520
add byte [rax], al
add byte [0x1418419a6], dh
add byte [rax], al
add byte [rax + rbx*4 + 0x14043], al
add byte [rax], al
sbb byte [rbx + 0x14044], dh
add byte [rax], al
movabs dword [0x9c00000001404537], eax
add dword [rax], eax
add byte [rax], al
jg 0x14043d4d3
add dword [rax], eax
add byte [rax], al
fsubr dword [rax + 0x14046]
add byte [rax], al
xor al, 0xa8
add dword [rax], eax
add byte [rax], al
mov dl, 0x45
add dword [rax], eax
add byte [rax], al
sub ch, dh
add byte [rax], al
add byte [rdx], ch
out dx, al
add dword [rax], eax
add byte [rax], al
xor ecx, esi
add dword [rax], eax
add byte [rax], al
mov ch, 0xcf
add dword [rax], eax
add byte [rax], al
jno 0x14043d545
add dword [rax], eax
add byte [rax], al
int1
popfq
add dword [rax], eax
add byte [rax], al
invalid
adc rbx, 1
xor bpl, r11b
xor bpl, 0xa0
not bpl
xor bpl, 0x95
mov qword [rsp], 0x733a553d
inc bpl
ror bpl, 1
xor r11b, bpl
shr byte [rsp], 3
jnp 0x14043d4c5
Function at 0x140008480
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
movzx eax, byte [0x1401161a1]
test eax, eax
jne 0x140008499
jmp 0x140008534
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x1400084cd
mov rcx, qword [rsp + 0x30]
call fcn.140008440
movzx eax, al
test eax, eax
je 0x1400084cd
mov edx, 0x10001
lea rcx, [0x140116220]
call fcn.140025ea0
jmp 0x140008534
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140008523
mov rcx, qword [rsp + 0x30]
call fcn.140008440
movzx eax, al
test eax, eax
jne 0x140008523
mov edx, pe_nt_image_headers64
lea rcx, [0x140116220]
call fcn.140025ea0
mov edx, 0x10001
lea rcx, [0x140116220]
call fcn.140025ea0
mov edx, pe_nt_image_headers64
lea rcx, [0x140116220]
call fcn.140025ea0
jmp 0x140008534
mov edx, pe_nt_image_headers64
lea rcx, [0x140116220]
call fcn.140025ea0
add rsp, 0x28
ret

Function at 0x140024b90
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
movzx eax, byte [0x1401161ad]
test eax, eax
jne 0x140024ba4
jmp 0x140024d29
mov dword [rsp + 0x20], 0x20
vmovss xmm0, dword [0x1400f422c]
call fcn.140046940
vxorps xmm2, xmm2, xmm2
vmovss xmm1, dword [0x1400f460c]
lea rcx, [rsp + 0x24]
call fcn.140007360
xor edx, edx
mov rcx, rax
call fcn.140046830
mov r8d, dword [rsp + 0x20]
xor edx, edx
lea rcx, str.Cheats_List
call fcn.1400416f0
movzx edx, byte [0x140116185]
lea rcx, [0x1400d076c]
call fcn.140024b10
movzx eax, byte [0x1401161a3]
test eax, eax
je 0x140024c32
movzx eax, byte [0x1401161c8]
test eax, eax
jne 0x140024c26
mov ecx, dword [0x1400fd0a8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140024c32
lea rcx, str.Aimbot__Toggle_
call fcn.140085340
movzx edx, byte [0x1401161a2]
lea rcx, [0x1400d0780]
call fcn.140024b10
movzx edx, byte [0x1401161e1]
lea rcx, [0x1400d0784]
call fcn.140024b10
movzx edx, byte [0x1401161a4]
lea rcx, str.Radar
call fcn.140024b10
movzx eax, byte [0x140116190]
test eax, eax
je 0x140024c9e
movzx eax, byte [0x140116196]
test eax, eax
jne 0x140024c92
mov ecx, dword [0x1401161cc]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140024c9e
lea rcx, str.TriggerBot__Toggle_
call fcn.140085340
movzx edx, byte [0x1401161df]
lea rcx, str.Crosshair
call fcn.140024b10
movzx edx, byte [0x140116195]
lea rcx, [0x1400d07c0]
call fcn.140024b10
movzx edx, byte [0x1401161e2]
lea rcx, [0x1400d07d0]
call fcn.140024b10
movzx edx, byte [0x1401161a1]
lea rcx, str.Bhop
call fcn.140024b10
movzx edx, byte [0x1401161ac]
lea rcx, [0x1400d07e8]
call fcn.140024b10
movzx edx, byte [0x1401161ba]
lea rcx, [0x1400d07f8]
call fcn.140024b10
movzx edx, byte [0x1401161b8]
lea rcx, [0x1400d0808]
call fcn.140024b10
call fcn.140045160
nop
add rsp, 0x38
ret
Function at 0x1400259f0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x4d0
lea rbp, [rsp + 0x20]
mov rax, qword [0x1400fd010]
xor rax, rbp
mov qword [rbp + 0x4a0], rax
mov dword [rbp + 0x60], 0x438
mov rax, qword [rbp + 0x4c0]
mov edx, dword [rax + 0x10]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
call fcn.140025950
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x90]
mov qword [rbp + 0x20], rax
cmp qword [rbp + 0x20], 0
jne 0x140025a6d
mov qword [rbp + 0x30], 0
jmp 0x140025b0b
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 8]
cmp word [rax + rcx*2], 0
jne 0x140025a7d
mov rax, qword [rbp + 8]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x140025aac
mov qword [rbp + 0x28], 0
jmp 0x140025b03
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x40], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x140025ad4
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.1400c9de0
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x40]
mov r8d, ecx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call fcn.140025960
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x30], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.14001dc10
mov rcx, qword [rbp + 0x30]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x140025b31
inc rcx
test dl, dl
jne 0x140025b1e
xor eax, eax
jmp 0x140025b36
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140025b61
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.1400040c0
mov rax, qword [rbp + 0x48]
jmp 0x140025b99
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140025a4e
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x50], 0
mov rcx, qword [rbp + 0x4c8]
call fcn.1400040c0
mov rax, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x4a0]
xor rcx, rbp
call fcn.1400c8bf0
lea rsp, [rbp + 0x4b0]
pop rbp
ret
Function at 0x140026ca0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x2c0
lea rbp, [rsp + 0x20]
mov rax, qword [0x1400fd010]
xor rax, rbp
mov qword [rbp + 0x290], rax
mov dword [rbp + 0x50], 0x238
xor edx, edx
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
call fcn.140025950
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x7c]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140026d12
mov qword [rbp + 0x38], 0
jmp 0x140026db0
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x40], rax
mov qword [rbp + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 8]
cmp word [rax + rcx*2], 0
jne 0x140026d22
mov rax, qword [rbp + 8]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x140026d51
mov qword [rbp + 0x30], 0
jmp 0x140026da8
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x48], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x140026d79
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.1400c9de0
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x48]
mov r8d, ecx
mov rdx, qword [rbp + 0x28]
mov rcx, rax
call fcn.140025960
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x38], rax
mov rcx, qword [rbp + 0x2b8]
call fcn.14001dc10
mov rcx, qword [rbp + 0x38]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x140026dd6
inc rcx
test dl, dl
jne 0x140026dc3
xor eax, eax
jmp 0x140026ddb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140026e00
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x58]
mov dword [rbp + 0x1c], eax
mov rcx, qword [rbp + 0x2b8]
call fcn.1400040c0
mov eax, dword [rbp + 0x1c]
jmp 0x140026e36
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140026cf6
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x20], 0
mov rcx, qword [rbp + 0x2b8]
call fcn.1400040c0
mov eax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x290]
xor rcx, rbp
call fcn.1400c8bf0
lea rsp, [rbp + 0x2a0]
pop rbp
ret
Function at 0x140031dd0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1400d4c40]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x140031e5e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x140031e02
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x140031e70
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1400d4c40]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x140031f74
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x140031f6f
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x140031f44
cmp qword [rsp + 0x38], 2
jb 0x140031f44
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140031f44
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140031f44
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140031eb7
jmp 0x140032006
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x140032006
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x140031fdc
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140031fdc
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140031fdc
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140031f74
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x14007e8a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14007e8c6
mov dword [rsp + 0x20], 1
jmp 0x14007e8ce
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x14008e2b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x3c18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
vmovss xmm0, dword [rax + 0x3c20]
vmovss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x50]
vmovss xmm0, dword [rsp + 0x24]
vdivss xmm0, xmm0, dword [rax + 0x14]
vmovss dword [rsp + 0x3c], xmm0
vxorps xmm2, xmm2, xmm2
vxorps xmm1, xmm1, xmm1
mov rcx, qword [rsp + 0x70]
call fcn.140007360
vxorps xmm0, xmm0, xmm0
vmovss dword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x88]
cmp qword [rsp + 0x30], rax
jae 0x14008e403
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xa
jne 0x14008e3c5
vmovss xmm1, dword [rsp + 0x20]
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rax]
call fcn.14005abe0
mov rax, qword [rsp + 0x70]
vmovss dword [rax], xmm0
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rax + 4]
vaddss xmm0, xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
vmovss dword [rax + 4], xmm0
vxorps xmm0, xmm0, xmm0
vmovss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0xa0]
test eax, eax
je 0x14008e3c0
jmp 0x14008e403
jmp 0x14008e335
cmp dword [rsp + 0x28], 0xd
jne 0x14008e3d1
jmp 0x14008e335
movzx edx, word [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.140084670
vmulss xmm0, xmm0, dword [rsp + 0x3c]
vmovss dword [rsp + 0x40], xmm0
vmovss xmm0, dword [rsp + 0x20]
vaddss xmm0, xmm0, dword [rsp + 0x40]
vmovss dword [rsp + 0x20], xmm0
jmp 0x14008e335
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rsp + 0x20]
vcomiss xmm0, dword [rax]
jbe 0x14008e423
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rsp + 0x20]
vmovss dword [rax], xmm0
cmp qword [rsp + 0x98], 0
je 0x14008e460
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rax + 4]
vaddss xmm0, xmm0, dword [rsp + 0x24]
vmovups xmm2, xmm0
vmovss xmm1, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.140007360
mov rax, qword [rax]
mov rcx, qword [rsp + 0x98]
mov qword [rcx], rax
vmovss xmm0, dword [rsp + 0x20]
vcomiss xmm0, dword [0x1400f40f4]
ja 0x14008e480
mov rax, qword [rsp + 0x70]
vxorps xmm0, xmm0, xmm0
vucomiss xmm0, dword [rax + 4]
jne 0x14008e49a
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rax + 4]
vaddss xmm0, xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
vmovss dword [rax + 4], xmm0
cmp qword [rsp + 0x90], 0
je 0x14008e4b5
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret