joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009c1e0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 0x28]
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x40
jae 0x14009c398
lea ecx, [r8*8]
mov qword [rsp + 0x30], rsi
add qword [rbx], rcx
mov byte [r8 + rbx + 0x2c], 0x80
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jbe 0x14009c258
cmp eax, 0x40
jae 0x14009c242
nop word [rax + rax]
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x40
jb 0x14009c230
lea rsi, [rbx + 0x2c]
mov rcx, rbx
mov rdx, rsi
call fcn.14009c4c0
xor eax, eax
mov dword [rbx + 0x28], eax
jmp 0x14009c260
lea rsi, [rbx + 0x2c]
jae 0x14009c272
nop
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jb 0x14009c260
movzx eax, byte [rbx + 7]
mov rdx, rsi
mov byte [rbx + 0x64], al
mov rcx, rbx
movzx eax, byte [rbx + 6]
mov byte [rbx + 0x65], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 0x66], al
movzx eax, byte [rbx + 4]
mov byte [rbx + 0x67], al
movzx eax, byte [rbx + 3]
mov byte [rbx + 0x68], al
movzx eax, byte [rbx + 2]
mov byte [rbx + 0x69], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 0x6a], al
movzx eax, byte [rbx]
mov byte [rbx + 0x6b], al
call fcn.14009c4c0
movzx eax, byte [rbx + 0xb]
mov byte [rdi], al
movzx eax, byte [rbx + 0xa]
mov byte [rdi + 1], al
movzx eax, byte [rbx + 9]
mov byte [rdi + 2], al
movzx eax, byte [rbx + 8]
mov byte [rdi + 3], al
movzx eax, byte [rbx + 0xf]
mov byte [rdi + 4], al
movzx eax, byte [rbx + 0xe]
mov byte [rdi + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rdi + 6], al
movzx eax, byte [rbx + 0xc]
mov byte [rdi + 7], al
movzx eax, byte [rbx + 0x13]
mov byte [rdi + 8], al
movzx eax, byte [rbx + 0x12]
mov byte [rdi + 9], al
movzx eax, byte [rbx + 0x11]
mov byte [rdi + 0xa], al
movzx eax, byte [rbx + 0x10]
mov byte [rdi + 0xb], al
movzx eax, byte [rbx + 0x17]
mov byte [rdi + 0xc], al
movzx eax, byte [rbx + 0x16]
mov byte [rdi + 0xd], al
movzx eax, byte [rbx + 0x15]
mov byte [rdi + 0xe], al
movzx eax, byte [rbx + 0x14]
mov byte [rdi + 0xf], al
movzx eax, byte [rbx + 0x1b]
mov byte [rdi + 0x10], al
movzx eax, byte [rbx + 0x1a]
mov byte [rdi + 0x11], al
movzx eax, byte [rbx + 0x19]
mov byte [rdi + 0x12], al
movzx eax, byte [rbx + 0x18]
mov byte [rdi + 0x13], al
movzx eax, byte [rbx + 0x1f]
mov byte [rdi + 0x14], al
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 0x15], al
movzx eax, byte [rbx + 0x1d]
mov byte [rdi + 0x16], al
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 0x17], al
movzx eax, byte [rbx + 0x23]
mov byte [rdi + 0x18], al
movzx eax, byte [rbx + 0x22]
mov byte [rdi + 0x19], al
movzx eax, byte [rbx + 0x21]
mov byte [rdi + 0x1a], al
movzx eax, byte [rbx + 0x20]
mov byte [rdi + 0x1b], al
movzx eax, byte [rbx + 0x27]
mov byte [rdi + 0x1c], al
movzx eax, byte [rbx + 0x26]
mov byte [rdi + 0x1d], al
movzx eax, byte [rbx + 0x25]
mov byte [rdi + 0x1e], al
movzx eax, byte [rbx + 0x24]
mov rsi, qword [rsp + 0x30]
mov byte [rdi + 0x1f], al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14009c3b0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov qword [rcx + 0x24], 0x5be0cd19
mov qword [rcx], rax
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
ret
Function at 0x1400b63d0
Capabilities:
Check http status code

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
lea eax, [rdx - 0xc8]
mov rdi, rcx
mov rcx, qword [rcx]
mov esi, r8d
cmp eax, 0x64
jb 0x1400b6405
lea rdx, [0x1400e0e40]
call fcn.140098710
lea eax, [rbx + 0x11]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
cmp edx, 0xc8
je 0x1400b641c
mov r8d, edx
lea rdx, [0x1400e0e60]
call fcn.140098890
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r14
cmp esi, 0x13
jne 0x1400b6438
mov rcx, rdi
call fcn.1400b6310
jmp 0x1400b656f
cmp esi, 0x14
jne 0x1400b6551
mov rsi, qword [rdi]
mov rbp, rbx
cmp dword [rsi + 0xba0], 2
jne 0x1400b64b9
mov rax, qword [rsi + 0x1e0]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400b64b9
mov byte [rsp + 0x28], 1
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov qword [rsp + 0x50], rbx
call fcn.140082910
test eax, eax
jne 0x1400b656f
mov rcx, qword [rsp + 0x50]
lea edx, [rax + 0x2f]
call fcn.1400d278c
test rax, rax
je 0x1400b64ae
mov rbp, qword [rsp + 0x50]
mov ecx, 1
sub rax, rbp
cmovne rcx, rax
mov byte [rcx + rbp], bl
jmp 0x1400b64b9
mov rcx, qword [rsp + 0x50]
call qword [fcn.140108028]
mov rdx, qword [rsi + 0xc08]
test rdx, rdx
jne 0x1400b64dd
cmp byte [rsi + 0xf0d], bl
lea rax, [0x1400e0ae0]
lea rdx, [0x1400dfc2c]
cmovne rdx, rax
lea r8, [0x1400e5d0a]
test rbp, rbp
mov r9, r8
lea rax, [0x1400ef564]
cmovne r9, rbp
lea rcx, [0x1400db510]
cmovne r8, rax
call fcn.140087090
mov rcx, rbp
mov r14, rax
call qword [fcn.140108028]
test r14, r14
jne 0x1400b651c
lea ebx, [r14 + 0x1b]
jmp 0x1400b6571
lea rcx, [rdi + 0xa00]
mov r8, r14
lea rdx, [0x1400ea778]
call fcn.1400cc530
mov rcx, r14
mov esi, eax
call qword [fcn.140108028]
test esi, esi
je 0x1400b6545
mov ebx, esi
jmp 0x1400b6571
mov dword [rdi + 0xab8], 0x1f
jmp 0x1400b6571
cmp esi, 0x15
jne 0x1400b655c
lea r8d, [rsi - 8]
jmp 0x1400b6565
cmp esi, 0x16
jne 0x1400b6571
lea r8d, [rsi - 8]
mov dl, 1
mov rcx, rdi
call fcn.1400b5e40
mov ebx, eax
mov r14, qword [rsp + 0x60]
mov eax, ebx
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400d0db0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [fcn.140108020]
mov rdi, rax
test rax, rax
jne 0x1400d0df2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400d0e39
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + 8]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + 0x10]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400d0e92
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + 8]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + 8]
sub rbp, 1
jne 0x1400d0e50
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400d0ed3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400e53e2]
mov r8d, 1
call qword [rbx + 8]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400e53e3]
mov r8d, 1
call qword [rbx + 8]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400d0ea0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x18000ed40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x18000ed63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x46]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x18000ed50
mov byte [rcx + 7], 0
mov rax, rcx
ret

Function at 0x18000ed90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x18000edb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x46]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x18000eda0
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x18000edc0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, rdx
call fcn.18003f1b0
mov rcx, rdi
mov rbx, rax
call fcn.18003f1b0
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x3df
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x18000ee90
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, Ordinal_301
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0x130
cmp rdi, 0xffffffffffffffff
je 0x18000ef52
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x18000ef52
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x18000ef49
cmp qword [rbx + 0x18], 0x10
mov r8, rbx
jb 0x18000ef11
mov r8, qword [rbx]
lea rax, [rsp + 0x4c]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x18000ef33
inc rax
test ecx, ecx
jne 0x18000ef20
mov rcx, rdi
test edx, edx
je 0x18000ef7d
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x18000ef04
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.180040e40
xor al, al
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180112f90
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x28], 0
je 0x18000ef52
mov rcx, rbx
call fcn.180040e40
mov al, 1
jmp 0x18000ef5c
Function at 0x180010320
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
je 0x180010343
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x46]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1d
jb 0x180010330
mov byte [rcx + 0x1e], 0
mov rax, rcx
ret

Function at 0x180010350
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x180010373
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x46]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x180010360
mov byte [rcx + 6], 0
mov rax, rcx
ret

Function at 0x180010a20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
mov eax, 0x13f0
call fcn.180114040
sub rsp, rax
movaps xmmword [rsp + 0x13e0], xmm6
movaps xmmword [rsp + 0x13d0], xmm7
movaps xmmword [rsp + 0x13c0], xmm8
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
movaps xmm7, xmm1
movaps xmm8, xmm0
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ebx, 1
mov dword [rsp + 0x13a4], 0xffffffff
mov dword [rsp + 0x24], eax
mov edx, ebx
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, 0x270
jb 0x180010a80
movss xmm6, dword [0x180137d48]
movaps xmm0, xmm6
mov dword [rsp + 0x20], 0x270
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_log2f]
movss xmm1, dword [0x180137c68]
divss xmm1, xmm0
movaps xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm2, dword [0x180137b54]
xorps xmm3, xmm3
cvttss2si eax, xmm0
xorps xmm1, xmm1
cmp eax, ebx
cmovl eax, ebx
test eax, eax
jle 0x180010b1a
mov ebx, eax
nop dword [rax]
lea rcx, [rsp + 0x20]
call fcn.18005a700
mov eax, eax
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
subss xmm0, xmm3
mulss xmm0, xmm2
mulss xmm2, xmm6
addss xmm1, xmm0
sub rbx, 1
jne 0x180010af0
divss xmm1, xmm2
subss xmm7, xmm8
mulss xmm1, xmm7
addss xmm1, xmm8
movaps xmm0, xmm1
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.180112f90
lea r11, [rsp + 0x13f0]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop rbx
ret
Function at 0x1800128e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rsi, qword [0x180184888]
mov r15, qword [0x180184890]
cmp rsi, r15
je 0x180012ab1
xor r13d, r13d
movzx ebx, byte [rbp + 0x67]
movss xmm7, dword [0x180137c48]
movzx edi, byte [rbp + 0x67]
nop
movsd xmm6, qword [rsi + 0x50]
movss xmm0, dword [0x180180814]
cvtps2pd xmm0, xmm0
comisd xmm6, xmm0
jae 0x180012aa4
lea rcx, [0x180180580]
call fcn.180063930
mov r12d, eax
mov dword [rbp + 0x6f], 0xe1d69a
mov byte [rbp + 0x73], 1
mov rdx, r13
nop word [rax + rax]
lea ecx, [rdx - 0x46]
xor byte [rbp + rdx + 0x6f], cl
inc rdx
cmp rdx, 3
jb 0x180012970
mov byte [rbp + 0x73], 0
cvttsd2si edx, xmm6
lea rcx, [rbp - 0x19]
call fcn.18000eac0
mov r14, rax
mov dword [rbp + 0x67], 0x100e09a
mov rdx, r13
nop
lea ecx, [rdx - 0x46]
xor byte [rbp + rdx + 0x67], cl
inc rdx
cmp rdx, 2
jb 0x1800129a0
mov byte [rbp + 0x6a], 0
mov rdx, qword [rsi + 0x10]
lea rax, [rbp + 0x67]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x1800129c3
movabs rax, 0x7fffffffffffffff
sub rax, rdx
cmp rax, rcx
jb 0x180012ad6
mov r9, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x1800129ef
mov r9, qword [rsi]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov r8, rsi
movzx edx, bl
lea rcx, [rbp - 0x39]
call fcn.1800522c0
nop
mov r9, r14
lea r8, [rbp - 0x39]
movzx edx, dil
lea rcx, [rbp - 0x59]
call fcn.1800520d0
nop
lea rax, [rbp + 0x6f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180012a32
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x59]
call fcn.18003f1c0
mov qword [rbp - 0x79], r13
mov qword [rbp - 0x69], r13
mov qword [rbp - 0x61], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x79], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x69], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rsi + 0x48]
mov r9d, r12d
movaps xmm2, xmm7
lea rcx, [rbp - 0x79]
call fcn.1800111b0
nop
lea rcx, [rbp - 0x59]
call fcn.180040e40
nop
lea rcx, [rbp - 0x39]
call fcn.180040e40
nop
lea rcx, [rbp - 0x19]
call fcn.180040e40
add rsi, 0x58
cmp rsi, r15
jne 0x180012930
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x58]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18000c960
nop
int3

Function at 0x180012ae0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x180012b03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x46]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x180012af0
mov byte [rcx + 3], 0
mov rax, rcx
ret

Function at 0x180012b10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x180012b33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x46]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x180012b20
mov byte [rcx + 4], 0
mov rax, rcx
ret
Function at 0x180014110
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0xe8
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp byte [0x180180840], 0
je 0x180014337
mov edx, dword [0x18018086c]
lea rcx, [rsp + 0x50]
mov qword [r11 - 8], rdi
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x38], xmm8
movaps xmmword [r11 - 0x48], xmm9
call fcn.180013900
movups xmm8, xmmword [rax]
movsd xmm9, qword [rax + 0x20]
movups xmm6, xmmword [rax + 0x10]
movdqa xmm0, xmm8
movsd qword [rsp + 0x40], xmm9
psrldq xmm0, 8
movq rdi, xmm0
test rdi, rdi
je 0x1800142ed
movss xmm0, dword [0x18018084c]
comiss xmm0, dword [rsp + 0x40]
jb 0x1800142ed
movss xmm1, dword [0x180180864]
movaps xmm0, xmm6
cvtps2pd xmm1, xmm1
unpckhpd xmm0, xmm6
comisd xmm1, xmm0
jb 0x1800142ed
mov ecx, dword [reloc.WS2_32.dll_bind]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x1800142ed
mov qword [rsp + 0xf8], rsi
movd esi, xmm6
test esi, esi
je 0x1800142e5
mov qword [rsp + 0xf0], rbx
lea rdx, [rsp + 0x80]
movd ebx, xmm8
mov rcx, rdi
movaps xmmword [rsp + 0xc0], xmm7
mov r8d, ebx
call qword [0x1801847c0]
movaps xmm1, xmmword [rsp + 0x80]
movss dword [rsp + 0x80], xmm1
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x55
shufps xmm1, xmm1, 0xaa
movss dword [rsp + 0x88], xmm1
movss dword [rsp + 0x84], xmm0
cmp ebx, 0x1233
jne 0x180014252
movsd xmm7, qword [rdi + 0x90]
mov ebx, dword [rdi + 0x98]
jmp 0x180014262
mov ebx, dword [rsp + 0x88]
movsd xmm7, qword [rsp + 0x80]
cmp byte [0x180184625], 0
je 0x18001428c
lea rcx, [rsp + 0x80]
movsd qword [rsp + 0x80], xmm7
mov dword [rsp + 0x88], ebx
call fcn.180010b60
test al, al
jne 0x1800142d5
mov edx, esi
movabs rcx, 0x7239b21a38f536ba
call fcn.180044180
test eax, eax
je 0x1800142d5
lea rdx, [rsp + 0x80]
movsd qword [rsp + 0x80], xmm7
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x88], ebx
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x30], xmm6
movsd qword [rsp + 0x40], xmm9
call fcn.180013b90
mov rbx, qword [rsp + 0xf0]
movaps xmm7, xmmword [rsp + 0xc0]
mov rsi, qword [rsp + 0xf8]
cmp byte [0x180185ee8], 0
movaps xmm9, xmmword [rsp + 0xa0]
movaps xmm8, xmmword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0xd0]
mov rdi, qword [rsp + 0xe0]
jne 0x18001433e
mov byte [0x180185ee8], 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180112f90
add rsp, 0xe8
ret
mov byte [0x180185ee8], 0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180112f90
add rsp, 0xe8
ret
Function at 0x180014360
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rbp - 9], rax
cmp byte [0x180180b58], 0
mov rsi, rdx
mov r14, rcx
je 0x1800145a8
mov rax, qword [0x1801847c8]
movss xmm0, dword [rcx + 8]
movss xmm1, dword [rcx]
movss xmm2, dword [rcx + 4]
subss xmm2, dword [rax + 0x94]
subss xmm0, dword [rax + 0x98]
subss xmm1, dword [rax + 0x90]
mulss xmm2, xmm2
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm2, xmm1
addss xmm2, xmm0
xorps xmm0, xmm0
ucomiss xmm0, xmm2
ja 0x1800143e4
xorps xmm0, xmm0
sqrtss xmm0, xmm2
jmp 0x1800143ec
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movss xmm1, dword [0x180137bb0]
comiss xmm1, xmm0
jbe 0x1800145a8
mov edx, dword [0x180180b68]
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x108], rdi
call fcn.180013900
movups xmm2, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movsd xmm1, qword [rax + 0x20]
movups xmmword [rbp - 0x69], xmm2
psrldq xmm2, 8
movq rdi, xmm2
movsd qword [rbp - 0x49], xmm1
movups xmmword [rbp - 0x59], xmm0
test rdi, rdi
je 0x1800145a0
movss xmm0, dword [0x180180b5c]
comiss xmm0, dword [rbp - 0x49]
jb 0x1800145a0
movss xmm0, dword [0x180180b64]
cvtps2pd xmm0, xmm0
comisd xmm0, xmmword [rbp - 0x51]
jb 0x1800145a0
mov ecx, dword [reloc.WS2_32.dll_bind]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x1800145a0
mov r8d, dword [rbp - 0x69]
lea rdx, [rbp - 0x19]
mov qword [rsp + 0x100], rbx
mov rcx, rdi
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm7
movaps xmmword [rsp + 0xa0], xmm8
movaps xmmword [rsp + 0x90], xmm9
call qword [0x1801847c0]
cmp dword [rbp - 0x69], 0x1233
movaps xmm8, xmmword [rbp - 0x19]
movaps xmm9, xmm8
movss dword [rbp - 0x19], xmm8
movaps xmm7, xmm8
shufps xmm9, xmm8, 0x55
shufps xmm7, xmm8, 0xaa
movss dword [rbp - 0x15], xmm9
movss dword [rbp - 0x11], xmm7
jne 0x180014519
movsd xmm6, qword [rdi + 0x90]
mov ebx, dword [rdi + 0x98]
movaps xmm0, xmm6
shufps xmm0, xmm0, 0x55
mov dword [rbp - 0x11], ebx
movaps xmm9, xmm0
movss xmm7, dword [rbp - 0x11]
movsd qword [rbp - 0x19], xmm6
movss xmm8, dword [rbp - 0x19]
jmp 0x180014521
mov ebx, dword [rbp - 0x11]
movsd xmm6, qword [rbp - 0x19]
cmp byte [0x180184625], 0
je 0x180014545
cmp byte [rbp - 0x45], 0
jne 0x180014545
lea rcx, [rbp - 0x19]
movsd qword [rbp - 0x19], xmm6
mov dword [rbp - 0x11], ebx
call fcn.180010b60
test al, al
jne 0x180014576
cmp byte [0x180180b60], 0
je 0x18001456f
addss xmm7, dword [0x180137afc]
movaps xmm0, xmm8
unpcklps xmm0, xmm9
movsd qword [r14], xmm0
movss dword [rbp - 0x11], xmm7
mov eax, dword [rbp - 0x11]
mov dword [r14 + 8], eax
movsd qword [rsi], xmm6
mov dword [rsi + 8], ebx
movaps xmm8, xmmword [rsp + 0xa0]
movaps xmm7, xmmword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0xc0]
mov rbx, qword [rsp + 0x100]
movaps xmm9, xmmword [rsp + 0x90]
mov rdi, qword [rsp + 0x108]
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.180112f90
add rsp, 0xd0
pop r14
pop rsi
pop rbp
ret
Function at 0x1800145c0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp byte [0x180180878], 0
je 0x1800147db
mov edx, dword [0x180180888]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0xa0], rbx
call fcn.180013900
movups xmm2, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movsd xmm1, qword [rax + 0x20]
movups xmmword [rsp + 0x30], xmm2
psrldq xmm2, 8
movq rbx, xmm2
movsd qword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x40], xmm0
test rbx, rbx
je 0x1800147d3
movss xmm0, dword [0x180180880]
cvtps2pd xmm0, xmm0
comisd xmm0, xmmword [rsp + 0x48]
jb 0x1800147d3
cmp qword [0x180185ed0], rbx
je 0x18001465e
mov qword [0x180185ed0], rbx
mov dword [0x180185eec], 0
mov ecx, dword [0x180184604]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x180186088], ecx
jle 0x1800146af
lea rcx, [0x180186088]
call fcn.180113138
cmp dword [0x180186088], 0xffffffff
jne 0x1800146af
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea rcx, [0x180186088]
mov qword [0x180185f50], rax
call fcn.1801130d8
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x180185f50]
movsxd rcx, dword [0x180185eec]
cmp rax, rcx
jb 0x1800147d3
mov ecx, dword [reloc.WS2_32.dll_bind]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x1800147c6
cmp byte [0x180184625], 0
je 0x18001474a
cmp byte [rsp + 0x54], 0
jne 0x18001474a
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [0x1801847c0]
movaps xmm1, xmmword [rsp + 0x80]
lea rcx, [rsp + 0x20]
movaps xmm2, xmm1
movaps xmm0, xmm1
shufps xmm0, xmm1, 0xaa
shufps xmm2, xmm1, 0x55
movss dword [rsp + 0x88], xmm0
mov eax, dword [rsp + 0x88]
unpcklps xmm1, xmm2
movsd qword [rsp + 0x20], xmm1
mov dword [rsp + 0x28], eax
call fcn.180010b60
test al, al
jne 0x1800147c6
cmp byte [0x18018087a], 0
jne 0x180014784
movss xmm0, dword [0x18018087c]
comiss xmm0, dword [rsp + 0x50]
jb 0x1800147c6
movss xmm3, dword [0x180137b54]
call fcn.1800456a0
cmp byte [0x18018087a], 0
mov eax, dword [0x180180884]
mov dword [0x180185eec], eax
je 0x1800147c6
movabs rcx, 0x4f8644af03d0e0d6
call fcn.180043f60
mov r8d, dword [rsp + 0x40]
mov edx, eax
movabs rcx, 0x3c06b5c839b38f7b
call fcn.180043e60
test eax, eax
je 0x1800147c6
movss xmm3, dword [0x180137b54]
call fcn.1800456a0
mov eax, dword [0x180180884]
mov dword [0x180185eec], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x180185f50], rax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180112f90
add rsp, 0xa8
ret