joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180025c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov word [rsp + 0x2f], 0x64
mov dword [rsp + 0x26], 0x746e6572
mov word [rsp + 0x20], 0x6547
mov word [rsp + 0x23], 0x7543
mov dword [rsp + 0x2a], 0x65726854
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x25], 0x72
mov byte [rsp + 0x2e], 0x61
call fcn.180025bc0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180025c93
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret

Function at 0x180025cb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, r9
mov rbp, r8
mov esi, edx
xor ebx, ebx
call fcn.180025b00
mov rdi, rax
test rax, rax
je 0x180025718
lea rdx, [rsp + 0x20]
mov word [rsp + 0x2c], 0x7845
mov rcx, rax
mov byte [rsp + 0x2e], bl
mov dword [rsp + 0x27], 0x6f6f4874
mov dword [rsp + 0x23], 0x78654e6c
mov word [rsp + 0x21], 0x6c61
mov byte [rsp + 0x2b], 0x6b
mov byte [rsp + 0x20], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002570f
mov r9, r14
mov r8, rbp
mov edx, esi
xor ecx, ecx
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r9, r8
mov r8, rdx
mov edx, ecx
jmp 0x180025690

Function at 0x180025cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x158
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp edx, 1
jne 0x180025da1
lea rdx, [rsp + 0x30]
call fcn.1800255e0
lea rcx, [rsp + 0x30]
call fcn.180001310
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x26], 0x75732074
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x2c], 0x74726f
mov dword [rsp + 0x21], 0x6174736e
mov word [rsp + 0x2a], 0x7070
mov byte [rsp + 0x20], 0x69
mov byte [rsp + 0x25], 0x6e
call fcn.180024e90
test rax, rax
jne 0x180025dd5
lea rdx, [sym.gphelper.dll_y1xxu0]
lea rcx, [0x180063818]
call fcn.180027130
test eax, eax
je 0x180025dd5
lea rdx, [sym.gphelper.dll_y9oqva]
lea rcx, [0x180063800]
call fcn.180027130
test eax, eax
je 0x180025dd5
lea rdx, [sym.gphelper.dll_rooilz]
lea rcx, [0x180063810]
call fcn.180027130
test eax, eax
je 0x180025dd5
lea rdx, [sym.gphelper.dll_a3prmf]
lea rcx, [0x180063808]
call fcn.180027130
jmp 0x180025dd5
test edx, edx
jne 0x180025dd5
lea rcx, [0x180063818]
call fcn.1800273c0
lea rcx, [0x180063800]
call fcn.1800273c0
lea rcx, [0x180063810]
call fcn.1800273c0
lea rcx, [0x180063808]
call fcn.1800273c0
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180001330
add rsp, 0x158
ret
Function at 0x180025e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x3a0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x388], rbx
mov qword [rbp + 0x390], rdi
mov rax, qword [0x180038010]
xor rax, rbp
mov qword [rbp + 0x360], rax
mov rbx, rcx
mov word [rbp + 0x20], 0x4f53
mov dword [rbp + 0x25], 0x5c455241
mov byte [rbp + 0x29], 0
mov word [rbp + 0x23], 0x5754
mov byte [rbp + 0x22], 0x46
mov dword [rbp + 0x11], 0x732573
mov byte [rbp + 0x10], 0x25
call fcn.180001290
xor edx, edx
lea rcx, [rbp + 0x30]
mov r8d, 0x104
mov edi, eax
call fcn.180002660
lea rax, str.RSpeedupTab
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180025e90
inc ecx
cmp ecx, 0x3fffffff
jle 0x180025ea8
xor eax, eax
jmp 0x180025ee1
movsxd rax, ecx
lea r8d, [rcx + rcx]
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180025ec5
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180014db0
sub rsp, rcx
mov r9d, edi
lea rcx, [rsp + 0x30]
call fcn.1800012a0
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x10]
lea rax, [rbp + 0x20]
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x30]
call fcn.180001270
lea rax, [rbp + 8]
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.180025510
test eax, eax
jne 0x180025fde
xor edx, edx
lea rcx, [rbp + 0x250]
mov r8d, 0x104
call fcn.180002660
mov rcx, qword [rbp + 8]
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x18]
lea rax, [rbp + 0x250]
mov dword [rbp + 0x1a], 0x736c61
mov qword [rsp + 0x20], rax
mov word [rbp + 0x18], 0x7668
call fcn.1800257f0
test eax, eax
jne 0x180025fd5
cmp dword [rbp + 4], eax
jbe 0x180025fd5
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x104
call fcn.180002660
lea r9, [rbp]
mov word [rbp], 0x6425
mov edx, 0x104
mov byte [rbp + 2], 0
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rbx
lea rcx, [rbp + 0x140]
call fcn.180001270
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x250]
call fcn.180024e90
test rax, rax
je 0x180025fd5
mov rcx, qword [rbp + 8]
call fcn.180025460
mov eax, 1
jmp 0x180025fe7
mov rcx, qword [rbp + 8]
call fcn.180025460
mov rcx, rbx
call qword [0x180063808]
mov rcx, qword [rbp + 0x360]
xor rcx, rbp
call fcn.180001330
mov rbx, qword [rbp + 0x388]
mov rdi, qword [rbp + 0x390]
lea rsp, [rbp + 0x370]
pop rbp
ret
Function at 0x180026020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x3a0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x388], rbx
mov qword [rbp + 0x390], rdi
mov rax, qword [0x180038010]
xor rax, rbp
mov qword [rbp + 0x360], rax
mov rbx, rcx
mov dword [rbp + 0x22], 0x41575446
mov word [rbp + 0x20], 0x4f53
mov dword [rbp + 0x26], 0x5c4552
mov word [rbp + 0x10], 0x7325
mov word [rbp + 0x13], 0x73
mov byte [rbp + 0x12], 0x25
call fcn.180001290
xor edx, edx
lea rcx, [rbp + 0x30]
mov r8d, 0x104
mov edi, eax
call fcn.180002660
lea rcx, str.RSpeedupTab
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1800260a0
inc eax
cmp eax, 0x3fffffff
jle 0x1800260b7
xor eax, eax
jmp 0x1800260ef
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800260d3
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180014db0
sub rsp, rcx
mov r9d, edi
lea rcx, [rsp + 0x30]
call fcn.1800012a0
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x10]
lea rax, [rbp + 0x20]
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x30]
call fcn.180001270
lea rax, [rbp + 8]
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.180025510
test eax, eax
jne 0x1800261ea
xor edx, edx
lea rcx, [rbp + 0x250]
mov r8d, 0x104
call fcn.180002660
mov rcx, qword [rbp + 8]
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x18]
lea rax, [rbp + 0x250]
mov dword [rbp + 0x1a], 0x736c61
mov qword [rsp + 0x20], rax
mov word [rbp + 0x18], 0x7668
call fcn.1800257f0
test eax, eax
jne 0x1800261e1
cmp dword [rbp + 4], eax
jbe 0x1800261e1
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x104
call fcn.180002660
lea r9, [rbp]
mov word [rbp], 0x6425
mov edx, 0x104
mov byte [rbp + 2], 0
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rbx
lea rcx, [rbp + 0x140]
call fcn.180001270
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x250]
call fcn.180024e90
test rax, rax
je 0x1800261e1
mov rcx, qword [rbp + 8]
call fcn.180025460
mov rax, rbx
jmp 0x1800261f3
mov rcx, qword [rbp + 8]
call fcn.180025460
mov rcx, rbx
call qword [0x180063810]
mov rcx, qword [rbp + 0x360]
xor rcx, rbp
call fcn.180001330
mov rbx, qword [rbp + 0x388]
mov rdi, qword [rbp + 0x390]
lea rsp, [rbp + 0x370]
pop rbp
ret
Function at 0x180026220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x3a0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x388], rbx
mov qword [rbp + 0x390], rdi
mov rax, qword [0x180038010]
xor rax, rbp
mov qword [rbp + 0x360], rax
mov rbx, rcx
mov dword [rbp + 0x21], 0x5754464f
mov dword [rbp + 0x25], 0x5c455241
mov byte [rbp + 0x20], 0x53
mov byte [rbp + 0x29], 0
mov word [rbp + 0x10], 0x7325
mov word [rbp + 0x13], 0x73
mov byte [rbp + 0x12], 0x25
call fcn.180001290
xor edx, edx
lea rcx, [rbp + 0x30]
mov r8d, 0x104
mov edi, eax
call fcn.180002660
lea rax, str.RSpeedupTab
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1800262a0
inc ecx
cmp ecx, 0x3fffffff
jle 0x1800262b8
xor eax, eax
jmp 0x1800262f1
movsxd rax, ecx
lea r8d, [rcx + rcx]
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800262d5
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180014db0
sub rsp, rcx
mov r9d, edi
lea rcx, [rsp + 0x30]
call fcn.1800012a0
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x10]
lea rax, [rbp + 0x20]
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x30]
call fcn.180001270
lea rax, [rbp + 8]
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.180025510
test eax, eax
jne 0x1800263f5
xor edx, edx
lea rcx, [rbp + 0x250]
mov r8d, 0x104
call fcn.180002660
mov rcx, qword [rbp + 8]
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x18]
lea rax, [rbp + 0x250]
mov word [rbp + 0x1b], 0x736c
mov qword [rsp + 0x20], rax
mov word [rbp + 0x18], 0x7668
mov byte [rbp + 0x1d], 0
mov byte [rbp + 0x1a], 0x61
call fcn.1800257f0
test eax, eax
jne 0x1800263ec
cmp dword [rbp + 4], eax
jbe 0x1800263ec
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x104
call fcn.180002660
lea r9, [rbp]
mov word [rbp], 0x6425
mov edx, 0x104
mov byte [rbp + 2], 0
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rbx
lea rcx, [rbp + 0x140]
call fcn.180001270
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x250]
call fcn.180024e90
test rax, rax
je 0x1800263ec
mov rcx, qword [rbp + 8]
call fcn.180025460
mov eax, 1
jmp 0x1800263fe
mov rcx, qword [rbp + 8]
call fcn.180025460
mov rcx, rbx
call qword [0x180063800]
mov rcx, qword [rbp + 0x360]
xor rcx, rbp
call fcn.180001330
mov rbx, qword [rbp + 0x388]
mov rdi, qword [rbp + 0x390]
lea rsp, [rbp + 0x370]
pop rbp
ret
Function at 0x180026430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x3b8
lea rbp, [rsp + 0x40]
mov rax, qword [0x180038010]
xor rax, rbp
mov qword [rbp + 0x360], rax
mov r15d, r9d
mov word [rbp + 0x22], 0x5446
mov r14d, r8d
mov word [rbp + 0x28], 0x5c
mov rsi, rdx
mov word [rbp + 0x25], 0x5241
mov rbx, rcx
mov word [rbp + 0x20], 0x4f53
mov byte [rbp + 0x27], 0x45
mov byte [rbp + 0x24], 0x57
mov dword [rbp + 0x10], 0x73257325
mov byte [rbp + 0x14], 0
call fcn.180001290
xor edx, edx
lea rcx, [rbp + 0x30]
mov r8d, 0x104
mov edi, eax
call fcn.180002660
lea rax, str.RSpeedupTab
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1800264b3
inc ecx
cmp ecx, 0x3fffffff
jle 0x1800264cb
xor eax, eax
jmp 0x180026504
movsxd rax, ecx
lea r8d, [rcx + rcx]
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800264e8
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180014db0
sub rsp, rcx
mov r9d, edi
lea rcx, [rsp + 0x40]
call fcn.1800012a0
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x10]
lea rax, [rbp + 0x20]
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x30]
call fcn.180001270
lea rax, [rbp + 8]
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.180025510
test eax, eax
jne 0x180026601
xor edx, edx
lea rcx, [rbp + 0x250]
mov r8d, 0x104
call fcn.180002660
mov rcx, qword [rbp + 8]
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x18]
lea rax, [rbp + 0x250]
mov dword [rbp + 0x1a], 0x736c61
mov qword [rsp + 0x20], rax
mov word [rbp + 0x18], 0x7668
call fcn.1800257f0
test eax, eax
jne 0x1800265f8
cmp dword [rbp + 4], eax
jbe 0x1800265f8
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x104
call fcn.180002660
lea r9, [rbp]
mov word [rbp], 0x6425
mov edx, 0x104
mov byte [rbp + 2], 0
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rbx
lea rcx, [rbp + 0x140]
call fcn.180001270
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x250]
call fcn.180024e90
test rax, rax
je 0x1800265f8
mov rcx, qword [rbp + 8]
call fcn.180025460
mov eax, 1
jmp 0x180026631
mov rcx, qword [rbp + 8]
call fcn.180025460
mov eax, dword [rbp + 0x3e0]
mov r9d, r15d
mov dword [rsp + 0x30], eax
mov r8d, r14d
mov eax, dword [rbp + 0x3d8]
mov rdx, rsi
mov dword [rsp + 0x28], eax
mov rcx, rbx
mov eax, dword [rbp + 0x3d0]
mov dword [rsp + 0x20], eax
call qword [0x180063818]
mov rcx, qword [rbp + 0x360]
xor rcx, rbp
call fcn.180001330
lea rsp, [rbp + 0x378]
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180026660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.180025b00
test rax, rax
je 0x1800266c8
lea rdx, [rsp + 0x20]
mov word [rsp + 0x25], 0x6957
mov rcx, rax
mov dword [rsp + 0x20], 0x6e697242
mov dword [rsp + 0x27], 0x776f646e
mov dword [rsp + 0x2d], 0x706f54
mov byte [rsp + 0x24], 0x67
mov word [rsp + 0x2b], 0x6f54
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret

Function at 0x1800266e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.180025b00
test rax, rax
je 0x180026746
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2b], 0x776f646e
mov rcx, rax
mov dword [rsp + 0x25], 0x65766974
mov dword [rsp + 0x20], 0x41746553
mov word [rsp + 0x29], 0x6957
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x24], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret

Function at 0x180026760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.180025b00
test rax, rax
je 0x1800267d7
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x23], 0x65726f46
mov rcx, rax
mov dword [rsp + 0x2f], 0x776f646e
mov dword [rsp + 0x2a], 0x57646e75
mov word [rsp + 0x20], 0x6553
mov word [rsp + 0x27], 0x7267
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x33], 0
mov byte [rsp + 0x2e], 0x69
mov byte [rsp + 0x29], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret

Function at 0x1800267f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.180025b00
test rax, rax
je 0x180026853
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x21], 0x69577465
mov rcx, rax
mov dword [rsp + 0x28], 0x736f5077
mov word [rsp + 0x25], 0x646e
mov byte [rsp + 0x20], 0x53
mov byte [rsp + 0x2c], 0
mov byte [rsp + 0x27], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret
Function at 0x140008560
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
movzx eax, byte [0x14018a5fd]
test eax, eax
jne 0x140008579
jmp 0x140008614
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x1400085ad
mov rcx, qword [rsp + 0x30]
call fcn.140008520
movzx eax, al
test eax, eax
je 0x1400085ad
mov edx, 0x10001
lea rcx, [0x14018a690]
call fcn.1400215b0
jmp 0x140008614
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140008603
mov rcx, qword [rsp + 0x30]
call fcn.140008520
movzx eax, al
test eax, eax
jne 0x140008603
mov edx, 0x100
lea rcx, [0x14018a690]
call fcn.1400215b0
mov edx, 0x10001
lea rcx, [0x14018a690]
call fcn.1400215b0
mov edx, 0x100
lea rcx, [0x14018a690]
call fcn.1400215b0
jmp 0x140008614
mov edx, 0x100
lea rcx, [0x14018a690]
call fcn.1400215b0
add rsp, 0x28
ret

Function at 0x1400087f0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
movzx eax, byte [0x14018a60a]
test eax, eax
jne 0x140008804
jmp 0x140008976
mov dword [rsp + reloc.WLDAP32.dll_Ordinal_32], 0x20
vmovss xmm0, dword [0x14016127c]
call fcn.140048ef0
vxorps xmm2, xmm2, xmm2
vmovss xmm1, dword [0x14016163c]
lea rcx, [rsp + 0x24]
call fcn.1400077d0
xor edx, edx
mov rcx, rax
call fcn.140048de0
mov r8d, dword [rsp + 0x20]
xor edx, edx
lea rcx, str.Cheats_List
call fcn.140043ca0
movzx edx, byte [0x14018a5e5]
lea rcx, [0x14015fb9c]
call fcn.1400087c0
movzx eax, byte [0x14018a5ff]
test eax, eax
je 0x140008892
movzx eax, byte [0x14018a624]
test eax, eax
jne 0x140008886
mov ecx, dword [0x14017115c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140008892
lea rcx, str.Aimbot__Toggle_
call fcn.140087a60
movzx edx, byte [0x14018a5fe]
lea rcx, [0x14015fbb0]
call fcn.1400087c0
movzx edx, byte [0x14018a608]
lea rcx, str.Glow
call fcn.1400087c0
movzx edx, byte [0x14018a600]
lea rcx, str.Radar
call fcn.1400087c0
movzx eax, byte [0x14018a5f0]
test eax, eax
je 0x1400088fe
movzx eax, byte [0x14018a5f6]
test eax, eax
jne 0x1400088f2
mov ecx, dword [0x14018a628]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x1400088fe
lea rcx, str.TriggerBot__Toggle_
call fcn.140087a60
movzx edx, byte [0x14018a63f]
lea rcx, str.Crosshair
call fcn.1400087c0
movzx edx, byte [0x14018a5f5]
lea rcx, str.Headshot_Line
call fcn.1400087c0
movzx edx, byte [0x14018a5f7]
lea rcx, str.No_Flash
call fcn.1400087c0
movzx edx, byte [0x14018a5fd]
lea rcx, str.Bhop
call fcn.1400087c0
movzx edx, byte [0x14018a609]
lea rcx, str.HitSound
call fcn.1400087c0
movzx edx, byte [0x14018a615]
lea rcx, str.Bomb_Timer
call fcn.1400087c0
call fcn.140047710
nop
add rsp, 0x38
ret
Function at 0x1400211c0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x4d0
lea rbp, [rsp + 0x20]
mov rax, qword [0x140171080]
xor rax, rbp
mov qword [rbp + 0x4a0], rax
mov dword [rbp + 0x60], 0x438
mov rax, qword [rbp + 0x4c0]
mov edx, dword [rax + 0x10]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
call fcn.140021120
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x90]
mov qword [rbp + 0x20], rax
cmp qword [rbp + 0x20], 0
jne 0x14002123d
mov qword [rbp + 0x30], 0
jmp 0x1400212db
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 8]
cmp word [rax + rcx*2], 0
jne 0x14002124d
mov rax, qword [rbp + 8]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x14002127c
mov qword [rbp + 0x28], 0
jmp 0x1400212d3
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x40], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x1400212a4
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.14012a2d0
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x40]
mov r8d, ecx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call fcn.140021130
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x30], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.14001b540
mov rcx, qword [rbp + 0x30]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x140021301
inc rcx
test dl, dl
jne 0x1400212ee
xor eax, eax
jmp 0x140021306
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140021331
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.140004360
mov rax, qword [rbp + 0x48]
jmp 0x140021369
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x14002121e
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x50], 0
mov rcx, qword [rbp + 0x4c8]
call fcn.140004360
mov rax, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x4a0]
xor rcx, rbp
call fcn.1401296f0
lea rsp, [rbp + 0x4b0]
pop rbp
ret
Function at 0x140022840
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x2c0
lea rbp, [rsp + 0x20]
mov rax, qword [0x140171080]
xor rax, rbp
mov qword [rbp + 0x290], rax
mov dword [rbp + 0x50], 0x238
xor edx, edx
mov ecx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
call fcn.140021120
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x7c]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1400228b2
mov qword [rbp + 0x38], 0
jmp 0x140022950
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x40], rax
mov qword [rbp + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 8]
cmp word [rax + rcx*2], 0
jne 0x1400228c2
mov rax, qword [rbp + 8]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x1400228f1
mov qword [rbp + 0x30], 0
jmp 0x140022948
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x48], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x140022919
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.14012a2d0
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x48]
mov r8d, ecx
mov rdx, qword [rbp + 0x28]
mov rcx, rax
call fcn.140021130
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x38], rax
mov rcx, qword [rbp + 0x2b8]
call fcn.14001b540
mov rcx, qword [rbp + 0x38]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x140022976
inc rcx
test dl, dl
jne 0x140022963
xor eax, eax
jmp 0x14002297b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1400229a0
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x58]
mov dword [rbp + 0x1c], eax
mov rcx, qword [rbp + 0x2b8]
call fcn.140004360
mov eax, dword [rbp + 0x1c]
jmp 0x1400229d6
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140022896
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x20], 0
mov rcx, qword [rbp + 0x2b8]
call fcn.140004360
mov eax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x290]
xor rcx, rbp
call fcn.1401296f0
lea rsp, [rbp + 0x2a0]
pop rbp
ret