joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015c20
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [0x1400e69f0]
xor esi, esi
mov r15, rcx
mov dword [rdi + 0x2d9c], esi
test rcx, rcx
je 0x140015d4a
mov qword [rsp + 0x40], rbx
lea rbx, [rdi + 0x2da0]
mov dword [rdi + 0x2d9c], esi
mov r8d, dword [rbx + 4]
mov qword [rsp + 0x48], rbp
test r8d, r8d
jns 0x140015c7e
mov eax, r8d
mov rcx, rbx
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, r8d
test eax, eax
cmovg edx, eax
call fcn.140016d30
mov eax, esi
mov dword [rbx], esi
cmp dword [rbx + 4], eax
jne 0x140015c96
mov edx, 8
mov rcx, rbx
call fcn.140016d30
mov eax, dword [rbx]
movsxd rcx, eax
mov ebp, esi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], sil
inc dword [rbx]
cmp dword [rdi + 0x2db0], esi
jle 0x140015cea
mov qword [rsp + 0x50], r14
mov r14, rsi
nop word [rax + rax]
mov r9, qword [rdi + 0x2db8]
mov r8, rbx
add r9, r14
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add r14, 0x30
cmp ebp, dword [rdi + 0x2db0]
jl 0x140015cc0
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
cmp qword [rbx + 8], rsi
je 0x140015cf9
mov esi, dword [rbx]
dec esi
mov rax, qword [rdi + 0x2da8]
lea rdx, [0x14004cd84]
test rax, rax
movsxd rsi, esi
lea rdi, [0x1400e69e8]
mov rcx, r15
cmovne rdi, rax
call fcn.140005cf0
mov rbx, rax
test rax, rax
je 0x140015d45
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x140021700
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x1400218b7
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x140021796
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.1400210e0
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.140020710
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x140021787
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140016990
mov dword [rbx + 0x80], 0
jmp 0x1400218a3
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14001f640
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14003ae30
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x260
mov rbx, rdx
mov rdi, rcx
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor esi, esi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], si
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x14003ae83
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140046fa0
nop
mov r8d, 0x1f
lea rdx, str.SoftwareDistributionDownload_
lea rcx, [rsp + 0x20]
call fcn.140046a60
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14003af28
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003af23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003af23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004957c
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], si
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14003af48
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x40]
call fcn.140046a60
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14003afc4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003afbe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003afbe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004957c
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14003afff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14003affa
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003b026
mov rcx, r8
call fcn.14004957c
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rax, rdi
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003b030
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 8
mov dword [rsp + 0x50], ebp
jb 0x14003b052
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x14003b0e6
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14003b0c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14003b0c0
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003b192
mov rcx, r8
call fcn.14004957c
mov al, 1
mov rsi, qword [rsp + 0x68]
mov word [rdi], bp
mov qword [rdi + 0x10], rbp
mov rbp, qword [rsp + 0x60]
mov qword [rdi + 0x18], 7
add rsp, 0x40
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x14003b100
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14003b174
lea rdx, [rdx*2 + 2]
jmp 0x14003b14b
lea r9, [rsp + 0x50]
mov qword [rsp + 0x58], rbx
mov r8d, 0x21a00
mov qword [rsp + 0x20], rbp
lea rdx, [0x1400c3e80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x58]
jne 0x14003b17b
cmp rax, 8
jb 0x14003b174
lea rdx, [rax*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14003b16f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003b192
mov rcx, r8
call fcn.14004957c
xor al, al
jmp 0x14003b0c7
cmp rax, 8
jb 0x14003b0c5
lea rdx, [rax*2 + 2]
jmp 0x14003b098
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003b1a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 8
mov dword [rsp + 0x50], ebp
jb 0x14003b1c2
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x14003b256
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14003b235
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14003b230
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003b302
mov rcx, r8
call fcn.14004957c
mov al, 1
mov rsi, qword [rsp + 0x68]
mov word [rdi], bp
mov qword [rdi + 0x10], rbp
mov rbp, qword [rsp + 0x60]
mov qword [rdi + 0x18], 7
add rsp, 0x40
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x14003b270
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14003b2e4
lea rdx, [rdx*2 + 2]
jmp 0x14003b2bb
lea r9, [rsp + 0x50]
mov qword [rsp + 0x58], rbx
mov r8d, 0x1e00
mov qword [rsp + 0x20], rbp
lea rdx, [0x1400c2060]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x58]
jne 0x14003b2eb
cmp rax, 8
jb 0x14003b2e4
lea rdx, [rax*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14003b2df
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003b302
mov rcx, r8
call fcn.14004957c
xor al, al
jmp 0x14003b237
cmp rax, 8
jb 0x14003b235
lea rdx, [rax*2 + 2]
jmp 0x14003b208
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003b980
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x78
xor r8d, r8d
mov dword [rax - 0x38], 0xf9f7f9f6
mov word [rax - 0x18], r8w
mov edx, 0x656
mov dword [rax - 0x34], 0xf9f1f982
mov dword [rax - 0x30], 0xf9e8f9f8
mov dword [rax - 0x2c], 0xf9eef9fb
mov dword [rax - 0x28], 0xf9d4f9c4
mov dword [rax - 0x24], 0xf9d4f9df
mov dword [rax - 0x20], 0xf9d1f9f0
mov dword [rax - 0x1c], 0xf9dff9fd
mov byte [rax - 0x16], 1
mov eax, r8d
nop dword [rax]
nop word [rax + rax]
movzx ecx, ax
sub cx, dx
xor word [rsp + rax*2 + 0x40], cx
inc rax
cmp rax, 0x10
jb 0x14003b9e0
mov qword [rsp + 0x30], r8
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], r8d
xor r9d, r9d
mov byte [rsp + 0x62], r8b
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400e6b00], rax
dec rax
cmp rax, 0xfffffffffffffffd
setbe al
add rsp, 0x78
ret

Function at 0x14003ba40
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003baa4
nop dword [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x14003bac4
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003ba80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1400e6afc]
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov rbx, qword [rsp + 0x270]
mov dword [0x1400e6afc], eax
add rsp, 0x260
pop rdi
ret

Function at 0x14003baf0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
mov rsi, rcx
mov ebx, r8d
mov rcx, qword [0x1400e6b20]
mov rdi, rdx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14003bb26
lea ecx, [rax - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [0x1400e6afc]
lea r8, [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x38], rcx
mov edx, 0xafe78c
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
lea r9d, [rcx + 0x38]
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x61], ecx
mov word [rsp + 0x65], cx
mov byte [rsp + 0x67], cl
mov byte [rsp + 0x60], cl
mov rcx, qword [0x1400e6b00]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x68], 0x85aef4c
mov qword [rsp + 0x70], 0x85bcd6c
call qword [0x1400e6be8]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14003e990
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov r14, rcx
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov eax, 0x10
xor ebp, ebp
mov eax, dword [rax + rbx]
cmp dword [0x1400e7460], eax
jle 0x14003ea2e
lea rcx, [0x1400e7460]
call fcn.140049738
cmp dword [0x1400e7460], 0xffffffff
jne 0x14003ea2e
mov qword [0x1400e7480], rbp
mov qword [0x1400e7490], rbp
mov qword [0x1400e7498], 0xf
lea r8d, [rbp + 0x22]
lea rdx, str.0123456789abcdefghjklmnoprstuvqyzA
lea rcx, [0x1400e7480]
call fcn.140003f00
lea rcx, [0x14004b820]
call fcn.140049b50
nop
lea rcx, [0x1400e7460]
call fcn.1400496d8
mov r15d, 0x13a8
mov eax, dword [r15 + rbx]
mov ecx, 0x20
test al, 1
jne 0x14003ea9c
or eax, 1
mov dword [r15 + rbx], eax
mov edi, ecx
add rdi, rbx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rdi + 0x1384], 0xffffffff
mov dword [rdi + 4], eax
mov edx, 1
lea r8, [rdi + 8]
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [r8], eax
inc rdx
lea r8, [r8 + 4]
cmp rdx, 0x270
jb 0x14003ea70
mov dword [rdi], 0x270
mov eax, dword [r15 + rbx]
mov edi, 0x18
test al, 2
jne 0x14003eabb
or eax, 2
mov dword [r15 + rbx], eax
mov dword [rdi + rbx], ebp
mov eax, dword [0x1400e7490]
dec eax
mov dword [rdi + rbx + 4], eax
mov qword [r14], rbp
mov qword [r14 + 0x10], rbp
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov edx, 0x20
test rsi, rsi
cmovne rdx, rsi
mov rcx, r14
call fcn.1400472e0
cmp qword [r14 + 0x18], 0x10
jb 0x14003eaf4
mov rcx, qword [r14]
mov rdx, rcx
mov r15, rcx
jmp 0x14003eafd
mov r15, r14
mov rdx, r14
mov rcx, r14
mov r13, qword [r14 + 0x10]
add r13, rdx
cmp rcx, r13
je 0x14003ebdf
mov r12d, edi
add r12, rbx
mov esi, 0x20
add rsi, rbx
mov r8d, 0x80000000
mov edx, dword [r12 + 4]
mov ecx, dword [r12]
lea eax, [rcx - 0x80000000]
lea ebp, [rcx + r8]
cmp ecx, r8d
cmovae ebp, eax
lea eax, [rdx - 0x80000000]
lea ebx, [rdx + r8]
cmp edx, r8d
cmovae ebx, eax
sub ebx, ebp
cmp ebx, 0xffffffff
jne 0x14003eb5d
mov rcx, rsi
call fcn.140049320
mov edx, eax
jmp 0x14003eb99
lea edi, [rbx + 1]
xor r8d, r8d
xor eax, eax
test ebx, ebx
je 0x14003eb79
mov rcx, rsi
call fcn.140049320
mov r8d, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov r9d, edx
mov ecx, eax
xor edx, edx
mov eax, r8d
div edi
cmp eax, ecx
jb 0x14003eb92
cmp r9d, ebx
jne 0x14003eb60
xor edx, edx
mov eax, r8d
div edi
lea ecx, [rdx + rbp]
lea eax, [rcx - 0x80000000]
mov r8d, 0x80000000
lea edx, [rcx + r8]
cmp ecx, r8d
cmovae edx, eax
lea rcx, [0x1400e7480]
cmp qword [0x1400e7498], 0x10
cmovae rcx, qword [0x1400e7480]
movsxd rax, edx
movzx ecx, byte [rax + rcx]
mov byte [r15], cl
inc r15
cmp r15, r13
jne 0x14003eb21
mov rax, r14
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14003f570
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x18], r8
push rbp
lea rbp, [rax - 0xc8]
sub rsp, 0x1c0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
mov rbx, r8
mov rsi, rcx
lea eax, [rdx + rdx*2]
shl eax, 4
movsxd rdx, eax
add rdx, qword [r8 + 0x10]
lea rcx, [rbp]
call fcn.140047df0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbp - 0x60], xmm0
mov rdi, qword [rbx + 8]
add rdi, 0x250
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x20], xmm0
mov rcx, qword [0x1400e6b20]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14003f60f
lea ecx, [rax - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x61], ecx
mov word [rsp + 0x65], cx
mov byte [rsp + 0x67], cl
mov qword [rsp + 0x48], rdi
lea rax, [rbp - 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x30
mov eax, dword [0x1400e6afc]
mov dword [rsp + 0x40], eax
mov byte [rsp + 0x60], cl
mov qword [rsp + 0x68], 0x85aef4c
mov qword [rsp + 0x70], 0x85bcd6c
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
lea r9d, [rcx + 0x38]
lea r8, [rsp + 0x40]
mov edx, 0xafe78c
mov rcx, qword [0x1400e6b00]
call qword [0x1400e6be8]
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rbp - 0x30]
movups xmmword [rbp + 0x10], xmm1
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rbp + 0x20], xmm0
lea rdx, [rbp - 0x40]
lea rcx, [rbp]
call fcn.14003ec00
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
movups xmm8, xmmword [rax + 0x20]
movups xmm9, xmmword [rax + 0x30]
lea rdx, [rbp]
lea rcx, [rbp - 0x80]
call fcn.14003ec00
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x60], xmm8
movaps xmmword [rsp + 0x70], xmm9
movups xmm0, xmmword [rax]
movaps xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax + 0x20]
movaps xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rbp - 0x50], xmm1
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x40]
call fcn.14003ed80
movups xmm1, xmmword [rax + 0x30]
movss dword [rsi], xmm1
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x55
movss dword [rsi + 4], xmm0
shufps xmm1, xmm1, 0xaa
movss dword [rsi + 8], xmm1
mov rcx, rbx
call fcn.14003f190
mov rax, rsi
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop rbp
ret
Function at 0x140045ff0
Capabilities:
Check for debugger via api
Check for outputdebugstring error
Execute command
Log keystrokes via polling
Print debug messages
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea rcx, str.qwertyssddsjdfkjd
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov edx, 0x46
lea rcx, [rsp + 0x28]
call fcn.14003e990
nop
lea rcx, [rsp + 0x28]
call fcn.140003e50
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.14003caa0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140004560
lea rcx, str.qwertyssddsjdfkjd
call qword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
movzx eax, ax
test eax, eax
jne 0x140046068
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x20], 0
jne 0x14004608a
cmp dword [rsp + 0x20], 1
jne 0x140046092
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, str.Using_a_debugger_
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400460b9
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.140004560
lea rcx, str.qwertyssddsjdfkjd
call qword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
movzx eax, ax
test eax, eax
jne 0x1400460da
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x20], 0
jne 0x1400460fc
cmp dword [rsp + 0x20], 1
jne 0x140046104
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, str.Using_a_debugger_
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14004612b
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea rdx, [0x14004cca6]
lea rcx, [0x1400e5ed0]
call fcn.140047b60
movzx eax, al
test eax, eax
je 0x1400461bf
call fcn.14003b980
movzx eax, al
test eax, eax
je 0x140046155
jmp 0x140046165
call fcn.14003b310
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400b72b4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Please_open_the_game_and_press_F1_in_the_Lobby..
call fcn.140003d30
xor eax, eax
cmp eax, 1
je 0x140046199
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140046197
jmp 0x140046199
jmp 0x14004617e
lea rcx, str.VALORANT_Win64_Shipping.exe
call fcn.14003ba40
cmp dword [0x1400e6afc], 0
je 0x1400461bf
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140045cf0
nop
lea rcx, [rsp + 0x28]
call fcn.140003e60
jmp 0x1400461cd
xor eax, eax
add rsp, 0x58
ret