joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800010a8
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18003e3b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x1800010e5
xor al, al
jmp 0x180001123
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x1800010f6
xor al, al
jmp 0x180001123
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x18000111d
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x18000111d
mov al, 1
jmp 0x180001123
xor al, al
jmp 0x180001123
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180031a00
add rsp, 0x60
pop rbx
ret

Function at 0x18000126c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x18003e3b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
mov esi, 0x10000
test rax, rax
je 0x1800012a3
sub rbx, rax
add rbx, rsi
cmp rbx, rdi
jae 0x18000132d
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x1800012c4
add rbx, 0x8000000
jmp 0x1800012a3
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000132d
mov rcx, qword [rsp + 0x38]
cmp dword [rsp + 0x40], esi
jne 0x18000134e
cmp rcx, rsi
jb 0x18000134e
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x18000132f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x677
jne 0x1800012a0
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180031a00
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x1800012a3
mov rax, rsi
sub rax, rcx
add rbx, rax
jmp 0x1800012a3
Function at 0x180001370
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x18003e3b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x18000145d
mov esi, 0x10000
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x1800013d1
sub rbx, 0x8000000
jmp 0x180001454
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000145d
cmp dword [rsp + 0x40], esi
jne 0x180001438
cmp qword [rsp + 0x38], rsi
jb 0x180001438
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x18000145f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x677
je 0x18000145d
sub rbx, rsi
jmp 0x180001454
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x1800013b6
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180031a00
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18000154c
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
lea r8, [rsp + 0x48]
mov rbp, rcx
lea rdx, [rsp + 0x50]
call fcn.180001138
mov rax, qword [0x180042f00]
xor ebx, ebx
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdx, qword [0x180042f10]
test rax, rax
jne 0x180001598
test rdx, rdx
je 0x1800015ae
mov rax, rdx
mov qword [0x180042f00], rdx
cmp qword [rax + 0x10], rbx
je 0x1800015ae
cmp qword [rax + 0x10], rsi
jb 0x1800015ae
cmp qword [rax + 0x10], rdi
jbe 0x180001655
mov qword [0x180042f00], rdx
mov rax, rdx
test rdx, rdx
je 0x1800015ed
mov rcx, rdx
test rdx, rdx
je 0x1800015d7
cmp qword [rcx + 0x10], rbx
je 0x1800015d7
cmp qword [rcx + 0x10], rsi
jb 0x1800015d7
cmp qword [rcx + 0x10], rdi
jbe 0x180001655
mov rax, qword [rax + 8]
mov qword [0x180042f00], rax
mov rcx, rax
mov rdx, rax
test rax, rax
jne 0x1800015c0
movzx eax, bp
mov r8, rdi
sub rbp, rax
mov rdx, rsi
mov rcx, rbp
call fcn.180001480
test rax, rax
je 0x180001681
mov dword [rax], 0x52727464
lea rdx, [rax + 0xffa8]
mov qword [rax + 0x10], rbx
mov r8d, 0x2a7
mov rcx, qword [0x180042f10]
mov qword [rax + 8], rcx
lea rcx, [rax + 0xff60]
mov qword [0x180042f10], rax
mov qword [0x180042f00], rax
mov qword [rdx], rbx
mov rbx, rcx
sub rcx, 0x60
lea rdx, [rdx - 0x60]
sub r8, 1
jne 0x18000163d
mov qword [rax + 0x10], rbx
mov rbx, qword [rax + 0x10]
cmp rbx, rsi
jb 0x180001681
cmp rbx, rdi
ja 0x180001681
mov rcx, qword [rbx + 0x48]
mov edx, 0xcc
mov qword [rax + 0x10], rcx
mov rcx, rbx
lea r8d, [rdx - 0x6c]
call sub.VCRUNTIME140.dll_memset
mov rax, rbx
jmp 0x180001683
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x180001730
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x18003e3b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ebx, ebx
cmp dword [0x180042efc], ebx
jne 0x1800017bf
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x180042efc], ecx
jne 0x1800017bf
mov rdi, qword [0x180042f10]
mov qword [0x180042f20], rbx
mov qword [0x180042f18], rbx
mov qword [0x180042f08], rbx
jmp 0x1800017a6
lea r9, [rsp + 0x20]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800017ad
mov rdi, qword [rdi + 8]
test rdi, rdi
jne 0x180001785
jmp 0x1800017b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x180042ef8], ebx
mov eax, ebx
jmp 0x1800017c4
mov eax, 0x10dd
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180031a00
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1800017dc
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x18003e3b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x180042efc], eax
je 0x18000180d
mov eax, 0x10dd
jmp 0x1800018d0
mov rdi, qword [0x180042f20]
test rdi, rdi
je 0x180001884
mov rax, qword [rdi + 0x20]
lea r9, [rsp + 0x20]
mov r8d, dword [rdi + 0x28]
mov rcx, qword [rdi + 0x18]
movzx edx, byte [rax + 0x3e]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [rdi + 8], 0
jne 0x18000186c
mov rbx, qword [rdi + 0x20]
test rbx, rbx
je 0x18000186c
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x60]
call sub.VCRUNTIME140.dll_memset
mov rdx, rbx
and rdx, 0xffffffffffff0000
mov rax, qword [rdx + 0x10]
mov qword [rbx + 0x48], rax
mov qword [rdx + 0x10], rbx
and qword [rdi + 0x20], 0
mov rbx, qword [rdi]
mov edx, 0x30
mov rcx, rdi
call fcn.180031a5c
mov rdi, rbx
test rbx, rbx
jne 0x180001819
and qword [0x180042f20], 0
call fcn.1800011f4
mov rdi, qword [0x180042f18]
test rdi, rdi
je 0x1800018bf
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rdi]
mov edx, 0x10
mov rcx, rdi
call fcn.180031a5c
mov rdi, rbx
test rbx, rbx
jne 0x18000189d
and qword [0x180042f18], 0
and dword [0x180042efc], 0
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180031a00
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1800028e4
Capabilities:
Decompress data using quicklz

Disassembly:
lea eax, [r8 + 0x100000]
cmp eax, 0x1fffff
ja 0x180002945
mov eax, r8d
mov ecx, r8d
shl ecx, 4
shr eax, 1
xor eax, edx
and eax, 0x7ff
xor eax, edx
mov edx, r8d
xor ecx, eax
shl edx, 6
and ecx, 0x3f0000
xor ecx, eax
xor edx, ecx
and edx, 0x4000000
xor edx, ecx
mov ecx, r8d
shr ecx, 5
xor ecx, edx
shr r8d, 8
and ecx, 0x2000
xor ecx, edx
xor r8d, ecx
and r8d, 0x800
xor r8d, ecx
mov eax, r8d
ret
xor eax, eax
ret
Function at 0x180004c50
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp byte [0x18003f5c6], bl
je 0x180004c7e
movsxd rcx, dword [0x18003f5c8]
lea rax, [0x1800353b0]
mov ecx, dword [rax + rcx*4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov cl, 1
test ax, ax
jne 0x180004c80
mov cl, bl
call fcn.1800047c8
mov rcx, qword [0x18003f618]
call fcn.1800046d0
test al, al
je 0x180004d59
mov r8, qword [0x18003f650]
mov rcx, r8
call fcn.1800046d0
test al, al
je 0x180004d59
cmp byte [0x18003f5c3], bl
setne cl
call fcn.180004b98
cmp byte [0x18003f5c4], bl
je 0x180004d06
cmp byte [0x18003f54d], bl
jne 0x180004ce5
movups xmm0, xmmword [r8 + 0x968]
mov byte [0x18003f54d], 1
movdqu xmmword [0x180042fa0], xmm0
and dword [0x180042f30], ebx
and dword [0x180042f2c], ebx
and dword [0x180042f34], ebx
mov dword [0x180042f28], ebx
movups xmm0, xmmword [0x180042f28]
jmp 0x180004d34
mov al, byte [0x18003f54d]
test al, al
jne 0x180004d29
movups xmm0, xmmword [r8 + 0x968]
mov al, 1
mov byte [0x18003f54d], al
movups xmmword [0x180042fa0], xmm0
jmp 0x180004d30
movups xmm0, xmmword [0x180042fa0]
test al, al
je 0x180004d3d
movdqu xmmword [r8 + 0x968], xmm0
cmp byte [0x18003f5c5], bl
je 0x180004d52
mov dword [r8 + 0x628], 0x40a00000
jmp 0x180004d59
mov dword [r8 + 0x628], ebx
add rsp, 0x20
pop rbx
ret
Function at 0x180006868
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
call fcn.18002dc00
xor edi, edi
mov dword [rbp - 0x40], 0xe753e74e
mov word [rbp - 0x2c], di
mov ecx, edi
mov dword [rbp - 0x3c], 0xe70fe755
mov dword [rbp - 0x38], 0xe74be70f
mov dword [rbp - 0x34], 0xe724e711
mov dword [rbp - 0x30], 0xe72ee72d
mov byte [rbp - 0x2a], 1
movzx eax, cx
mov edx, 0x18c7
sub ax, dx
xor word [rbp + rcx*2 - 0x40], ax
inc rcx
cmp rcx, 0xa
jb 0x1800068ae
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x2a], dil
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8, rax
test rax, rax
je 0x180006931
movdqa xmm0, xmmword [0x180039650]
mov rcx, rdi
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0x2d3f1930
mov dword [rbp - 0x14], 0x1002b39
lea eax, [rcx + 0x39]
xor byte [rbp + rcx - 0x28], al
inc rcx
cmp rcx, 0x16
jb 0x1800068fb
lea rdx, [rbp - 0x28]
mov byte [rbp - 0x11], dil
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180042f40], rax
test rax, rax
jne 0x180006a17
mov al, dil
jmp 0x180006934
mov al, byte [rbp + 0x10]
test al, al
jne 0x180006a17
movdqa xmm0, xmmword [0x180039640]
mov rcx, rdi
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x1002e2c
lea eax, [rcx + 0x39]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x12
jb 0x180006953
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x2d], dil
lea rcx, [rbp - 0x28]
call fcn.18000904c
mov rbx, rax
mov dword [rbp - 0x50], 0x52495b6e
mov rcx, rdi
mov dword [rbp - 0x4c], 0x585054
mov byte [rbp - 0x48], 1
lea eax, [rcx + 0x39]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x18000698c
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
mov byte [rbp - 0x48], dil
jb 0x1800069ad
mov rdx, qword [rbx]
xor r9d, r9d
lea r8, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
movups xmm0, xmmword [rbx + 0x10]
movups xmm1, xmmword [rbx]
mov qword [rbx + 0x10], rdi
psrldq xmm0, 8
movq rdx, xmm0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dil
cmp rdx, 0x10
jb 0x180006a17
inc rdx
movq rcx, xmm1
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006a12
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180006a12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180031a5c
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18000a368
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
cmp dword [0x180043084], 0
lea rsi, [0x180043080]
mov ebx, r8d
mov edi, edx
mov r10, rcx
jne 0x18000a3cf
xor r9d, r9d
mov r11, rsi
mov r8d, r9d
mov edx, 8
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov r8d, ecx
xor r8d, eax
sub rdx, 1
jne 0x18000a39d
mov dword [r11], r8d
inc r9d
add r11, 4
cmp r9d, 0x100
jb 0x18000a395
not ebx
mov edx, ebx
test edi, edi
jle 0x18000a3f1
movzx eax, byte [r10]
inc r10
movzx ecx, dl
xor rcx, rax
shr edx, 8
xor edx, dword [rsi + rcx*4]
sub edi, 1
jne 0x18000a3d7
jmp 0x18000a42b
mov r8b, byte [r10]
inc r10
test r8b, r8b
je 0x18000a42b
mov r9b, 0x23
cmp r8b, r9b
jne 0x18000a410
cmp byte [r10], r9b
jne 0x18000a410
cmp byte [r10 + 1], r9b
cmove edx, ebx
movzx ecx, dl
movzx eax, r8b
mov r8b, byte [r10]
xor rcx, rax
shr edx, 8
inc r10
xor edx, dword [rsi + rcx*4]
test r8b, r8b
jne 0x18000a3ff
mov rbx, qword [rsp + 8]
not edx
mov rsi, qword [rsp + 0x10]
mov eax, edx
mov rdi, qword [rsp + 0x18]
ret

Function at 0x18000ac68
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call fcn.18000ab44
mov rbx, rax
test rax, rax
je 0x18000ad3f
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18000ad36
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x18000ad36
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18000ad36
mov r8, qword [0x18003e588]
lea eax, [rsi + 1]
movsxd rcx, eax
inc dword [r8 + 0x354]
mov r8, qword [r8 + 0xf0]
call r8
mov rdi, rax
test rax, rax
je 0x18000ad36
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x18000ad26
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x18003e588]
mov rcx, rdi
dec dword [rax + 0x354]
call qword [rax + 0xf8]
jmp 0x18000ad3f
xor eax, eax
mov byte [rsi + rdi], al
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, rdi
jmp 0x18000ad41
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800255a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r14d, r14d
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rsi, rdx
movsxd rdi, r9d
mov rbp, rcx
test r9d, r9d
jle 0x180025799
lea rbx, [r8 + 0x20]
xor r13d, r13d
lea r8d, [r14 + 1]
mov r11d, 0x100
xorps xmm7, xmm7
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x18002564a
movsxd r10, dword [rsi + 0x24]
mov r9, qword [rsi + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
mov r8d, 1
movd xmm0, eax
jmp 0x18002566c
movsxd rdx, dword [rsi + 0x1c]
mov rax, qword [rsi + 8]
xorps xmm6, xmmword [0x1800397d0]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
mov al, byte [rbp + 0x20]
xor r15d, r15d
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
mov al, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], r15d
jle 0x18002578c
mov rcx, qword [rsp + 0xe0]
mov rax, r13
shl rax, 4
add rcx, 6
xor r12d, r12d
add rcx, rax
mov qword [rsp + 0x60], rcx
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x1800256ba
mov edx, dword [rbx - 0x1c]
add edx, r15d
jmp 0x1800256be
mov edx, dword [rax + r12]
mov eax, dword [rbp + 0x24]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov rcx, rsi
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
mulss xmm3, xmm6
mulss xmm2, xmm6
call fcn.1800216d0
mov edx, eax
mov rcx, rsi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.1800235b4
mov rcx, qword [rsp + 0x60]
mov r8d, 1
movzx eax, word [rbp + 0x1c]
add r14d, r8d
sub ax, word [rsp + 0xd8]
add r13, r8
add ax, word [rbp + 0x20]
add r15d, r8d
add ax, word [rsp + 0x50]
add r12, 4
sub ax, r8w
mov word [rcx - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x54]
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x58]
sub ax, r8w
mov word [rcx], ax
add rcx, 0x10
mov qword [rsp + 0x60], rcx
cmp r15d, dword [rbx - 0x10]
jl 0x1800256a9
mov r11d, 0x100
add rbx, 0x28
sub rdi, r8
jne 0x1800255f8
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov eax, r14d
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18002da9c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18003e3b0]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp qword [0x180043028], 0
jne 0x18002dac6
call fcn.18002d588
mov rcx, qword [0x180043038]
lea rdx, [rbp - 0x30]
mov rbx, qword [0x18003e588]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp - 0x28]
lea rcx, [rbp - 0x18]
sub eax, dword [rbp - 0x30]
movd xmm1, eax
mov eax, dword [rbp - 0x24]
sub eax, dword [rbp - 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 8], xmm1
movss dword [rbx + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x18]
xorps xmm1, xmm1
sub rax, qword [0x180043048]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x180043058]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rbx + 0x10], xmm1
mov rax, qword [rbp - 0x18]
mov qword [0x180043048], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rbx + 0x125], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rbx + 0x126], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x128], 0
cmp byte [rbx + 0x34f], 0
mov byte [rbx + 0x127], al
je 0x18002dbc4
cvttss2si eax, dword [rbx + 0x110]
mov rcx, qword [0x180043038]
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], eax
cvttss2si eax, dword [rbx + 0x114]
mov dword [rbp - 0x1c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x1c]
mov ecx, dword [rbp - 0x20]
call qword [sym.imp.USER32.dll_SetCursorPos]
cmp byte [rbx + 0x124], 0
je 0x18002dbd5
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
call fcn.18000bbdc
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180031a00
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x18002ede0
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xc], 0
mov rcx, qword [rsp + 0x40]
call fcn.18002ebd0
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x18002eeb7
mov dword [rsp + 0x20], 0
jmp 0x18002ee54
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x18002eeb7
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18002eeb5
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.18002e9b0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18002ee4a
add rsp, 0x30
pop rdi
ret
Function at 0x18002eed0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x18002ef74
mov dword [rsp + 0x20], 0
jmp 0x18002ef0d
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x18002ef5d
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18002ef5b
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18002ef03
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x18003ef08]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x30
pop rdi
ret
Function at 0x18002ef80
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x70
mov rdi, rsp
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x80]
mov eax, dword [rsp + 0x80]
imul rax, rax, 0x38
mov rcx, qword [0x1800434b0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], 5
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18002f004
mov rax, qword [rsp + 0x50]
sub rax, 5
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
add rax, 2
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x34]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18002f02d
mov eax, 0xa
jmp 0x18002f167
cmp dword [rsp + 0x88], 0
je 0x18002f09b
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov byte [rax], 0xe9
mov rax, qword [rsp + 0x50]
add rax, 5
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x58]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18002f099
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov byte [rax], 0xeb
mov rax, qword [rsp + 0x60]
mov byte [rax + 1], 0xf9
jmp 0x18002f0e7
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18002f0cb
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18002f0e7
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x88]
and al, 1
shl al, 1
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x20], al
movzx eax, byte [rsp + 0x88]
and al, 1
shl al, 2
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x20], al
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x180034800]
call fcn.180032394
mov rax, rdi
add rsp, 0x70
pop rdi
ret