joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000fb20
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push r14
sub rsp, 0x28
mov r14, rcx
call fcn.14000bcc0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
movzx eax, word [rax]
test ax, ax
je 0x14000fb54
cmp ax, 0x20
ja 0x14000fb54
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x14000fb41
movzx r9d, word [rdx]
movzx eax, r9w
cmp r9w, 0x22
jne 0x14000fb67
movzx eax, word [rdx + 2]
mov ecx, 0x20
mov r8d, 0x22
cmovne r8w, cx
lea rcx, [rdx + 2]
cmovne rcx, rdx
cmp ax, r8w
je 0x14000fba1
movzx edx, ax
movzx eax, dx
test dx, dx
je 0x14000fba1
movzx eax, word [rcx + 2]
add rcx, 2
movzx edx, ax
cmp ax, r8w
jne 0x14000fb88
test ax, ax
lea rdx, [rcx + 2]
cmove rdx, rcx
mov rsi, rdx
cmp r9w, 0x22
jne 0x14000fbc0
cmp word [rdx], 0x20
jne 0x14000fbc0
lea rsi, [rdx + 2]
movzx eax, word [rsi]
test ax, ax
je 0x14000fd4e
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
cmp ax, 0x22
jne 0x14000fc92
movzx eax, word [rsi + 2]
add rsi, 2
mov rdi, rsi
test ax, ax
je 0x14000fc13
nop dword [rax]
cmp ax, 0x22
je 0x14000fc13
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x14000fc00
mov rbx, rdi
sub rbx, rsi
sar rbx, 1
test rbx, rbx
jle 0x14000fc48
mov rax, qword [r14]
add rbx, rbx
mov rcx, r14
lea rdx, [rbx + 2]
call qword [rax]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
mov rbp, rax
call fcn.140018280
mov word [rbx + rbp], r15w
jmp 0x14000fc4b
mov rbp, r15
mov rbx, qword [r14 + 0x30]
lea rcx, [r14 + 8]
mov rax, qword [rcx + 0x20]
sub rax, rbx
cmp rax, 8
jl 0x14000fc6f
mov rax, qword [rcx + 0x18]
mov qword [rbx + rax], rbp
add qword [rcx + 0x28], 8
jmp 0x14000fc7c
lea rdx, [rbx + 8]
call fcn.140010aa0
mov qword [rax + rbx], rbp
mov rsi, rdi
cmp word [rdi], r15w
je 0x14000fd2e
lea rsi, [rdi + 2]
jmp 0x14000fd2e
cmp ax, 0x20
jbe 0x14000fd2a
mov rdi, rsi
nop
cmp ax, 0x22
je 0x14000fcb9
cmp ax, 0x20
jbe 0x14000fcb9
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x14000fca0
mov rbx, rdi
sub rbx, rsi
sar rbx, 1
test rbx, rbx
jle 0x14000fcee
mov rax, qword [r14]
add rbx, rbx
mov rcx, r14
lea rdx, [rbx + 2]
call qword [rax]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
mov rbp, rax
call fcn.140018280
mov word [rbx + rbp], r15w
jmp 0x14000fcf1
mov rbp, r15
mov rbx, qword [r14 + 0x30]
lea rcx, [r14 + 8]
mov rax, qword [rcx + 0x20]
sub rax, rbx
cmp rax, 8
jl 0x14000fd18
mov rax, qword [rcx + 0x18]
mov rsi, rdi
mov qword [rbx + rax], rbp
add qword [rcx + 0x28], 8
jmp 0x14000fd2e
lea rdx, [rbx + 8]
call fcn.140010aa0
mov rsi, rdi
mov qword [rax + rbx], rbp
jmp 0x14000fd2e
add rsi, 2
movzx eax, word [rsi]
test ax, ax
jne 0x14000fbe3
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, qword [r14 + 0x30]
shr rax, 3
add rsp, 0x28
pop r14
pop rsi
ret
Function at 0x1400131cc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140013216
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140013216
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140013216
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140013216
cmp dword [rcx + 0x84], 0xe
jbe 0x140013216
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140013218
xor al, al
add rsp, 0x28
ret

Function at 0x140018c98
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140018b03
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140018b03
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140018b03
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140018b03
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140018b03
cmp dword [rcx + 0x84], 0xe
jbe 0x140018b03
cmp dword [rcx + 0xf8], 0
je 0x140018b03
mov ecx, ebx
call fcn.140018bb4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140018990
nop
cmp dword [rbp + 0x20], 0
je 0x140018b51
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140018b5c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140018a94
Function at 0x1400220b4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14002213b
mov rsi, rbx
cmp word [rax], bp
je 0x1400220fa
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400220e4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400220e0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14001f730
mov rdi, rax
test rax, rax
je 0x140022128
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140018280
mov rbp, rdi
xor ecx, ecx
call fcn.14001e018
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140026b00
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140026b28
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140026b28
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180003490
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x1800034b6
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
dec rcx
call fcn.180003490
movzx edx, word [rdi + rbx*2]
mov ecx, eax
mov rbx, qword [rsp + 0x30]
xor rdx, rcx
movzx ecx, dl
lea rdx, [0x18002a720]
shr eax, 8
xor eax, dword [rdx + rcx*4]
add rsp, 0x20
pop rdi
ret

Function at 0x1800034f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x180003516
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
dec rcx
call fcn.1800034f0
movsx edx, byte [rbx + rdi]
xor r8d, r8d
mov rbx, qword [rsp + 0x30]
mov r9d, 0x20
lea ecx, [rdx - 0x41]
cmp cl, 0x19
mov ecx, edx
lea rdx, [0x18002a720]
cmovbe r8d, r9d
or r8, rcx
xor r8, rax
shr eax, 8
movzx ecx, r8b
xor eax, dword [rdx + rcx*4]
add rsp, 0x20
pop rdi
ret

Function at 0x180003560
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x180003586
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
dec rcx
call fcn.180003560
movzx edx, word [rdi + rbx*2]
xor r8d, r8d
mov rbx, qword [rsp + 0x30]
mov r9d, 0x20
lea ecx, [rdx - 0x41]
cmp cx, 0x19
lea rcx, [0x18002a720]
cmovbe r8d, r9d
or r8, rdx
movzx edx, al
movzx r9d, r8b
xor r9, rdx
shr eax, 8
xor eax, dword [rcx + r9*4]
add rsp, 0x20
pop rdi
ret
Function at 0x180004a00
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x470
mov rax, qword [0x18002e010]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor esi, esi
mov rbx, rcx
mov ebp, 0x103
test rcx, rcx
jne 0x180004a38
mov r8d, esi
jmp 0x180004a43
mov rdx, rbp
call fcn.18000fc88
mov r8, rax
inc r8w
cmp r8w, bp
jae 0x180004b2f
cmp si, r8w
jae 0x180004ab3
mov rcx, rbx
movzx r9d, r8w
lea rdx, [rsp + 0x40]
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rcx]
lea rcx, [rcx + 1]
mov word [rdx], ax
lea rdx, [rdx + 2]
sub r9, 1
jne 0x180004a70
cmp r8w, 5
jbe 0x180004ab3
movzx eax, r8w
cmp word [rsp + rax*2 + 0x36], 0x2e
je 0x180004ab3
mov r9d, 5
lea r8, str..dll
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.180010108
lea rax, [rsp + 0x40]
mov r10, 0xffffffffffffffff
nop
inc r10
cmp word [rax + r10*2], si
jne 0x180004ac0
dec r10
cmp r10, 0xffffffffffffffff
jne 0x180004ada
mov eax, 0xffffffff
jmp 0x180004b1d
lea rcx, [r10 - 1]
lea rdx, [rsp + 0x40]
call fcn.180003560
movzx edx, word [rsp + r10*2 + 0x40]
mov r9d, 0x20
mov r8, rsi
lea ecx, [rdx - 0x41]
cmp cx, 0x19
lea rcx, [0x18002a720]
cmovbe r8, r9
or r8, rdx
movzx edx, al
movzx r9d, r8b
xor r9, rdx
shr eax, 8
xor eax, dword [rcx + r9*4]
not eax
mov ecx, eax
call fcn.180004c50
test rax, rax
jne 0x180004c1f
mov qword [rsp + 0x488], rdi
test rbx, rbx
jne 0x180004b41
mov rdi, rsi
jmp 0x180004b4f
mov rdx, rbp
mov rcx, rbx
call fcn.18000fc88
mov rdi, rax
inc di
cmp di, bp
jae 0x180004c14
cmp si, di
jae 0x180004bb5
lea rcx, [rsp + 0x250]
movzx r10d, di
nop dword [rax]
movsx eax, byte [rbx]
lea rbx, [rbx + 1]
mov word [rcx], ax
lea rcx, [rcx + 2]
sub r10, 1
jne 0x180004b70
cmp di, 5
jbe 0x180004bb5
movzx eax, di
cmp word [rsp + rax*2 + 0x246], 0x2e
je 0x180004bb5
lea r9d, [r10 + 5]
mov edx, 0x104
lea r8, str..dll
lea rcx, [rsp + 0x250]
call fcn.180010108
add di, di
lea rax, [rsp + 0x250]
mov word [rsp + 0x2a], di
sub di, 2
mov qword [rsp + 0x30], rax
mov rax, qword [0x180076440]
mov word [rsp + 0x28], di
test rax, rax
jne 0x180004bfa
mov edx, 0xa09b055e
mov ecx, 0x84c05e40
call fcn.1800051f0
mov qword [0x180076440], rax
test rax, rax
je 0x180004c14
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], rsi
lea r8, [rsp + 0x28]
xor edx, edx
xor ecx, ecx
call rax
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x488]
mov rax, rsi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.180005e50
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
Function at 0x1800051f0
Capabilities:
Hash data with crc32
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
call fcn.180004c50
mov edx, ebx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.180004e30

Function at 0x180005210
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18002e010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov edi, edx
mov rbx, rcx
mov r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], 0
jne 0x180005235
dec r8
cmp r8, 0xffffffffffffffff
jne 0x180005250
mov eax, 0xffffffff
jmp 0x180005276
lea rcx, [r8 - 1]
mov rdx, rbx
call fcn.180003490
movzx edx, word [rbx + r8*2]
mov ecx, eax
xor rdx, rcx
shr eax, 8
movzx ecx, dl
lea rdx, [0x18002a720]
xor eax, dword [rdx + rcx*4]
not eax
mov ecx, eax
call fcn.180004c50
test rax, rax
jne 0x18000530c
mov rax, qword [0x180076438]
test rax, rax
jne 0x1800052b7
mov ecx, 0x84c05e40
call fcn.180004c50
mov edx, 0xfa2a9aa9
mov rcx, rax
call fcn.180004e30
mov qword [0x180076438], rax
test rax, rax
je 0x1800052eb
mov rdx, rbx
lea rcx, [rsp + 0x28]
call rax
mov r10, qword [0x180076440]
test r10, r10
jne 0x1800052ef
mov edx, 0xa09b055e
mov ecx, 0x84c05e40
call fcn.1800051f0
mov qword [0x180076440], rax
mov r10, rax
test rax, rax
jne 0x1800052ef
xor eax, eax
jmp 0x18000530c
xor eax, eax
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call r10
mov rax, qword [rsp + 0x20]
mov edx, edi
mov rcx, rax
call fcn.180004e30
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180005e50
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180005b70
Capabilities:
Check os version
Execute syscall

Disassembly:
xor al, 0x5a
mov r10, qword gs:[0x60]
cmp word [r10 + 0x118], 0xa
je 0x180005bc0
cmp word [r10 + 0x118], 6
jne 0x180005be7
cmp word [r10 + 0x11c], 3
je 0x180005bc2
cmp word [r10 + 0x11c], 2
je 0x180005bc4
cmp word [r10 + 0x11c], 1
jne 0x180005be7
cmp word [r10 + 0x120], 0x1db1
je 0x180005bc6
jmp 0x180005be7
inc eax
inc eax
inc eax
cmp qword [0x180076310], 0
jne 0x180005bdc
cmp eax, 0xc390050f
pop r10
mov r10, rcx
jne 0x180005bd1
syscall
nop
ret
pop r10
mov r10, rcx
jmp qword [0x180076310]
ret
Function at 0x180015ddc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180015e0c
xor eax, eax
jmp 0x180015ecf
mov rbp, rbx
cmp word [rax], si
je 0x180015e31
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180015e18
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180015e14
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180015d2c
movsxd r14, eax
test eax, eax
jne 0x180015e6f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180015e05
mov rcx, r14
call fcn.180013b58
mov rdi, rax
test rax, rax
jne 0x180015e88
xor ecx, ecx
call fcn.180013b1c
jmp 0x180015e64
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180015d2c
test eax, eax
jne 0x180015eb9
mov rcx, rdi
call fcn.180013b1c
jmp 0x180015ec3
xor ecx, ecx
call fcn.180013b1c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18001a540
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18001a568
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18001a568
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140002c10
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
movaps xmmword [rax - 0x28], xmm6
mov rbp, r8
movsxd r8, dword [0x1400b8ce4]
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm7
lea rdx, [rax - 0x78]
movaps xmmword [rax - 0x48], xmm8
mov rdi, rcx
shl r8, 5
lea rcx, [0x1400b8d00]
add r8, qword [0x1400b8ce8]
mov rbx, r9
movaps xmmword [rax - 0x58], xmm9
movaps xmmword [rax - 0x68], xmm10
call fcn.1400044b0
mov rcx, qword [0x1400b8b30]
lea r8, [rsp + 0x30]
xorps xmm9, xmm9
mov rax, qword [rax]
mov eax, dword [rax + 0x40]
shl eax, 5
movsxd rdx, eax
add rdx, rbx
mov qword [rsp + 0x30], 0
xor ebx, ebx
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 0xc]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm8, dword [rsp + 0x34]
movss xmm7, dword [rsp + 0x30]
subss xmm8, dword [rdi + 0x34]
subss xmm7, dword [rdi + 0x30]
movss xmm6, dword [rsp + 0x38]
subss xmm6, dword [rdi + 0x38]
movaps xmm1, xmm8
movaps xmm0, xmm7
xorps xmm6, xmmword [0x1400a4740]
call fcn.140088c74
movaps xmm1, xmm0
movaps xmm0, xmm6
call fcn.140088fc4
movaps xmm10, xmm0
movaps xmm1, xmm7
mulss xmm10, dword [0x1400a4498]
movaps xmm0, xmm8
subss xmm10, dword [rdi + 0x48]
call fcn.140088fc4
movaps xmm7, xmm0
xorps xmm8, xmm8
mulss xmm7, dword [0x1400a4498]
movaps xmm0, xmm10
xorps xmm6, xmm6
subss xmm7, dword [rdi + 0x4c]
movaps xmm1, xmm7
call fcn.140088c74
movss xmm1, dword [0x1400b8cd8]
comiss xmm1, xmm0
jbe 0x140002d3e
movaps xmm8, xmm10
movaps xmm6, xmm7
movss xmm7, dword [0x1400a44a4]
comiss xmm8, xmm7
movss xmm1, dword [0x1400a44c8]
movss xmm0, dword [0x1400a44b8]
jbe 0x140002d62
comiss xmm0, xmm8
jae 0x140002d80
comiss xmm8, xmm0
movaps xmm7, xmm8
jbe 0x140002d70
subss xmm7, xmm1
movss xmm2, dword [0x1400a4540]
comiss xmm2, xmm7
jbe 0x140002d80
movaps xmm7, xmm2
comiss xmm6, xmm0
jbe 0x140002d89
subss xmm6, xmm1
movss xmm0, dword [0x1400a4548]
comiss xmm0, xmm6
jbe 0x140002d9a
addss xmm6, xmm1
divss xmm7, dword [0x1400b8cd4]
divss xmm6, dword [0x1400b8cd4]
ucomiss xmm7, xmm9
jp 0x140002dbe
jne 0x140002dbe
ucomiss xmm6, xmm9
jp 0x140002dbe
je 0x140002e3f
cmp byte [0x1400b8d10], bl
je 0x140002dfa
movsxd r8, dword [0x1400b8d14]
lea rdx, [rsp + 0x40]
shl r8, 5
lea rcx, [0x1400b8d38]
add r8, qword [0x1400b8d20]
call fcn.1400044b0
mov rcx, qword [rax]
mov ecx, dword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140002e3f
addss xmm7, dword [rsi]
addss xmm6, dword [rsi + 4]
movss xmm1, dword [rsi + 8]
lea r8, [rsp + 0x30]
mov rcx, qword [0x1400b8b30]
addss xmm1, xmm9
mov r9d, 0xc
mov qword [rsp + 0x20], rbx
movaps xmm0, xmm7
mov rdx, rbp
unpcklps xmm0, xmm6
movsd qword [rsp + 0x30], xmm0
movss dword [rsp + 0x38], xmm1
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop rdi
pop rsi
pop rbp
ret
Function at 0x140009f70
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1400b6080]
xor rax, rsp
mov qword [rbp + 0x10], rax
xor r14d, r14d
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], r14
xorps xmm0, xmm0
mov qword [rsp + 0x48], r14
lea rdx, str.m_iIDEntIndex
lea r8d, [r14 + 0xd]
lea rcx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
call fcn.140004780
lea rdx, [rsp + 0x30]
lea rcx, [0x1400b8dc8]
call fcn.1400051e0
xorps xmm0, xmm0
mov qword [rsp + 0x60], r14
lea r8d, [r14 + 5]
mov qword [rsp + 0x68], r14
lea rdx, str.value
mov rbx, rax
lea rcx, [rsp + 0x50]
movups xmmword [rsp + 0x50], xmm0
call fcn.140004780
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400051e0
mov rcx, rax
call fcn.140007f30
mov rcx, rdi
movsxd rbx, eax
call fcn.1400602a0
mov rcx, qword [0x1400b8b30]
lea r9d, [r14 + 4]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x20], r14
lea rdx, [rbx + rax]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ebx, dword [rsp + 0x70]
test ebx, ebx
je 0x14000a14d
mov rdx, rsi
lea rcx, [rbp - 0x70]
call fcn.140006700
mov eax, ebx
mov qword [rsp + 0x20], r14
sar eax, 9
lea r9d, [r14 + 8]
movsxd rcx, eax
lea r8, [rbp - 0x78]
mov rax, qword [rbp - 0x68]
add rax, 0x10
lea rdx, [rax + rcx*8]
mov rcx, qword [0x1400b8b30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1400b8b30]
lea r9d, [r14 + 8]
mov eax, ebx
mov qword [rsp + 0x20], r14
and eax, 0x1ff
lea r8, [rsp + 0x78]
imul edx, eax, 0x78
add rdx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x78]
mov qword [rbp - 0x50], rax
cmp ebx, 0xffffffff
je 0x14000a0de
lea rcx, [rbp - 0x70]
call fcn.1400601b0
test eax, eax
jle 0x14000a0de
lea rcx, [rbp - 0x70]
call fcn.1400601b0
cmp eax, 0x64
jg 0x14000a0de
mov bl, 1
jmp 0x14000a0e0
xor bl, bl
cmp byte [0x1400b8c73], r14b
je 0x14000a11d
movsxd r8, dword [0x1400b8c74]
lea rdx, [rsp + 0x78]
shl r8, 5
lea rcx, [0x1400b8c98]
add r8, qword [0x1400b8c80]
call fcn.1400044b0
mov rcx, qword [rax]
mov ecx, dword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000a14d
test bl, bl
je 0x14000a14d
xor edx, edx
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_mouse_event]
xor edx, edx
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 4]
call qword [sym.imp.USER32.dll_mouse_event]
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140061880
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000b4f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x1400b6080]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dil, 1
mov qword [rsp + 0xd0], rbx
movzx esi, dil
mov r14, rdx
mov rbp, rcx
nop word [rax + rax]
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14000b546
test sil, sil
sete sil
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14000b5ab
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [rsp + 0x58], 0x12
je 0x14000b5a8
test dil, dil
je 0x14000b5ab
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x14000b565
jmp 0x14000b5ab
xor dil, dil
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14000b6fe
mov rax, qword [0x1400b8ba8]
test rax, rax
je 0x14000b5d4
mov rcx, qword [rax + 0x98]
jmp 0x14000b5d6
xor ecx, ecx
cmp qword [rcx + 0x48], 0
jne 0x14000b5e2
call fcn.14003a9f0
call fcn.14003bae0
call fcn.140012ff0
movups xmm0, xmmword [r14]
lea rdx, [rsp + 0x30]
movsd xmm1, qword [r14 + 0x10]
movaps xmmword [rsp + 0x30], xmm0
movsd qword [rsp + 0x40], xmm1
call fcn.140006840
test sil, sil
je 0x14000b621
movzx ecx, dil
call fcn.14000b150
mov r8d, 0x80088
jmp 0x14000b627
mov r8d, 0x800a8
mov rcx, qword [rbp + 0x58]
mov edx, 0xffffffec
call qword [sym.imp.USER32.dll_SetWindowLongW]
call fcn.140014bc0
call fcn.140014fc0
mov rcx, qword [rbp + 0xb8]
lea r8, [rbp + 0xc8]
xorps xmm0, xmm0
xor r9d, r9d
movups xmmword [rsp + 0x80], xmm0
mov rax, qword [rcx]
lea edx, [r9 + 1]
call qword [rax + 0x108]
mov rcx, qword [rbp + 0xb8]
lea r8, [rsp + 0x80]
mov rdx, qword [rbp + 0xc8]
mov rax, qword [rcx]
call qword [rax + 0x190]
mov rax, qword [0x1400b8ba8]
mov rcx, qword [rax + 0x48d8]
mov rax, qword [rcx]
xor ecx, ecx
add rax, 0x48
cmp byte [rax], cl
cmovne rcx, rax
call fcn.140039d90
mov rcx, qword [rbp + 0xc0]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 1]
call qword [rax + 0x40]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
test dil, dil
jne 0x14000b530
mov rbx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140061880
mov rbp, qword [rsp + 0xd8]
add rsp, 0xa0
pop r14
pop rdi
pop rsi
ret
mov rcx, rbp
call fcn.14000b710
xor ecx, ecx
call fcn.1400686f4
int3