joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001deb0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140068be8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001df13
mov qword [rsp], rbx
lea rbx, [0x140057570]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001def3
cmp byte [r8], r9b
jne 0x14001def3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001dee0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5fe8]
not eax
mov r8, qword [r10 + 0x5ff0]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x14001df3f
cmp dword [r8 + 8], eax
je 0x14001df46
add r8, 0x48
cmp r8, rcx
jne 0x14001df30
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x140041300
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x140068040]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov rdi, rcx
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x18
lea rdx, str.PphZLqlq6m1vclDp_3bBbg
lea rcx, [rsp + 0x30]
call fcn.14004ff50
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140040d90
nop
cmp qword [rax + 0x18], 0xf
jbe 0x140041382
mov rax, qword [rax]
mov r8d, 8
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.14004e0c0
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x10], rax
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0xc], edx
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400413fa
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400413f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400413f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052e10
movdqa xmm0, xmmword [0x14005d250]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14004144d
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041448
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041448
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052e10
movdqa xmm0, xmmword [0x14005d250]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
cmp qword [rbp + 0x98], 0
je 0x14004151c
lea rdx, str.tWeo7hC1R5N8Vzev5o7ljw
lea rcx, [rsp + 0x70]
call fcn.14004ec20
nop
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x10]
call fcn.140040d90
mov rbx, rax
lea rcx, [rbp - 0x30]
call fcn.140041250
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.14004fbe0
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.14004fb70
nop
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.14004f820
mov rcx, rax
lea rdx, [0x14004fc00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp - 0x70]
call fcn.14004ebc0
nop
lea rcx, [rbp - 0x50]
call fcn.14004ebc0
nop
lea rcx, [rbp - 0x30]
call fcn.14004ebc0
nop
lea rcx, [rbp - 0x10]
call fcn.14004ebc0
nop
lea rcx, [rsp + 0x70]
call fcn.14004ebc0
lea rcx, [rbp + 0x10]
call fcn.14004e080
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14004d7b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14004d7d8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14004d7fe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14004d800
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14004d859
test ecx, ecx
jle 0x14004d839
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14004d859
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14004d859
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14004d880
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14004d8a2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14004d8b8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14004d8d4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14004d8d6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14004d912
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14004d9ae
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14004d94d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14004d98e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14004d9ae
cmp rbx, rax
ja 0x14004d960
test rbx, rbx
je 0x14004d9ae
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x14004de10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140068040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14004de3d
xor eax, eax
jmp 0x14004dfa9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14004de77
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14004de77
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14004dfa9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14004df9c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14004deba
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14004dee5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004dfa1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004df54
sub eax, 1
je 0x14004df54
cmp eax, 2
jne 0x14004df9c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004dfa1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14004df82
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14004df9c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14004dfa1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140052b90
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14004f2d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140068040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14004f3a3
cmp byte [rcx + 0x71], 0
je 0x14004f3a3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14004f39f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004f364
sub eax, 1
je 0x14004f368
cmp eax, 2
jne 0x14004f39f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140052b90
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14004f396
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14004f39f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14004f34c
xor al, al
jmp 0x14004f34c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140052b90
add rsp, 0x60
pop rbx
ret
Function at 0x140050ce0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140050d47
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x140050d02
mov ecx, dword [r10]
jmp 0x140050e68
cmp ecx, 0x270
jb 0x140050e68
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
nop word [rax + rax]
mov r9, qword [rbx + 8]
mov r8, rbx
add rbx, 8
mov rdx, r9
xor rdx, rax
and rdx, 0xffffffff80000000
xor rdx, r9
movzx eax, dl
and al, 1
neg al
mov rax, r9
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4e0]
xor rcx, rdx
mov qword [r8 - 0x9c0], rcx
sub rdi, 1
jne 0x140050d80
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 8]
mov rdx, rbx
xor r9, r8
add rbx, 8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rdx - 0xea0]
xor rcx, r9
mov r9, r8
mov qword [rdx - 0x9c0], rcx
sub rdi, 1
jne 0x140050de0
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret

Function at 0x140053764
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400537ae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400537ae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400537ae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400537ae
cmp dword [rcx + 0x84], 0xe
jbe 0x1400537ae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400537b0
xor al, al
add rsp, 0x28
ret
Function at 0x140001140
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0x38
mov eax, dword [0x1400371e8]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140001196
lea rdx, str.Failed_to_allocate_memory.
lea rcx, [0x1400384a0]
call fcn.140001360
lea rdx, [0x140001d10]
mov rcx, rax
call fcn.140002f30
mov eax, 1
jmp 0x1400011f5
mov eax, dword [0x1400371e8]
mov r8d, eax
lea rdx, section..data
mov rcx, qword [rsp + 0x20]
call fcn.140008e50
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea r8, [0x1400223ac]
lea rdx, str.Before_executing_shellcode
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [rsp + 0x28]
xor r9d, r9d
lea r8, str.Debug
lea rdx, str.After_executing_shellcode
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
add rsp, 0x38
ret

Function at 0x140011d78
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140011ba4
Function at 0x140004204
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000424e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000424e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000424e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000424e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000424e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004250
xor al, al
add rsp, 0x28
ret
Function at 0x5a2f80
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
xor rax, rax
xor rcx, rcx
sub edx, 1
cmp ecx, edx
jg 0x5a2fc2
add edx, 1
mov r9d, eax
and r9w, 0xf800
movzx r9d, r9w
shr r9d, 0xb
shl eax, 5
or r9w, ax
mov eax, r9d
movzx r9w, byte [r8]
xor ax, r9w
add r8, 1
add ecx, 1
cmp ecx, edx
jne 0x5a2f93
nop
ret
Function at 0x1400286e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push r15
sub rsp, 0x58
mov rax, qword [0x1400b7040]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [r8 + 0x18], 0xf
mov r15, rdx
mov r10, qword [r8 + 0x10]
mov rdx, r8
movzx ebp, r9b
mov rsi, rcx
jbe 0x140028714
mov rdx, qword [r8]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x140028743
movabs r11, 0x100000001b3
nop
movzx eax, byte [rdx + rcx]
inc rcx
xor r9, rax
imul r9, r11
cmp rcx, r10
jb 0x140028730
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x20]
call fcn.140001b60
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x14002875e
mov rcx, qword [rsi + 0x28]
cmp rcx, qword [rsi + 0x28]
je 0x140028885
cmp byte [rsp + 0xa0], 0
mov qword [rsp + 0x98], rdi
lea rdi, [rcx + 0x30]
mov qword [rsp + 0x50], r14
lea r14, [rcx + 0x50]
je 0x1400287d9
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsx eax, word [rsp + 0x3e]
sub eax, dword [r15 + 0x10]
movsx ecx, word [rsp + 0x3a]
sub eax, ecx
inc eax
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x1400287d9
mov ebx, eax
nop dword [rax]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140098450]
call fcn.140001580
sub rbx, 1
jne 0x1400287c0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140098458]
call fcn.140001580
cmp qword [rdi + 0x18], 0xf
mov r8, qword [rdi + 0x10]
jbe 0x1400287fa
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rax
call fcn.140001f70
cmp qword [r14 + 0x18], 0xf
mov r8, qword [r14 + 0x10]
mov rdi, qword [rsp + 0x98]
jbe 0x14002881b
mov r14, qword [r14]
mov rdx, r14
mov rcx, rax
call fcn.140001f70
cmp qword [rsi + 0x18], 0xf
mov r8, qword [rsi + 0x10]
mov r14, qword [rsp + 0x50]
jbe 0x140028839
mov rsi, qword [rsi]
mov rdx, rsi
mov rcx, rax
call fcn.140001f70
lea rdx, [0x140098454]
mov rcx, rax
call fcn.140001580
cmp qword [r15 + 0x18], 0xf
mov r8, qword [r15 + 0x10]
jbe 0x140028861
mov r15, qword [r15]
mov rdx, r15
mov rcx, rax
call fcn.140001f70
test bpl, bpl
jne 0x140028885
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140002530]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140075e10
add rsp, 0x58
pop r15
pop rsi
pop rbp
pop rbx
ret
Function at 0x140028a30
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400b7040]
xor rax, rsp
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
mov rdi, rcx
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
mov rcx, qword [0x1400b7940]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [0x1400b7940]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, qword [0x1400b7940]
lea rcx, [rsp + 0x38]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140028aba
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageA]
call fcn.140038bc0
mov rcx, qword [0x1400b7940]
mov rbx, rax
mov qword [rax + 0xc0], rcx
lea rcx, [rsp + 0x30]
mov dword [rax + 0x10], 0x3c888889
call qword [sym.imp.USER32.dll_GetCursorPos]
movd xmm0, dword [rsp + 0x30]
mov ecx, 1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0xdf8], xmm0
movd xmm0, dword [rsp + 0x34]
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0xdfc], xmm0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140028b30
mov byte [rbx + 0xe00], 1
mov eax, dword [rbx + 0xdfc]
mov dword [rbx + 0x36e8], eax
mov byte [rbx + 0x3738], 1
jmp 0x140028b37
mov byte [rbx + 0xe00], 0
mov rcx, qword [0x1400b7930]
xor r8d, r8d
cmp byte [0x1400a901d], r8b
mov rax, qword [rcx]
je 0x140028b54
mov edx, 1
jmp 0x140028b56
xor edx, edx
call qword [rax + 0x40]
call fcn.14005cee0
call fcn.14005ddc0
call fcn.14003fb90
mov rcx, qword [0x1400b74d8]
call fcn.140004630
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140028b91
cmp byte [0x1400b6edb], 0
sete byte [0x1400b6edb]
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140028c71
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.Fortnite
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowA]
cmp byte [0x1400b6edb], 0
je 0x140028bd3
cmp rbx, rax
jne 0x140028bd3
mov rcx, rdi
call fcn.140008120
call fcn.140041a40
mov rcx, qword [0x1400b7928]
lea r8, [0x1400b7938]
xorps xmm0, xmm0
xor r9d, r9d
movups xmmword [rsp + 0x68], xmm0
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x108]
mov rcx, qword [0x1400b7928]
lea r8, [rsp + 0x68]
mov rdx, qword [0x1400b7938]
mov rax, qword [rcx]
call qword [rax + 0x190]
call fcn.1400387b0
mov rcx, rax
call fcn.14005cf20
cmp dword [rsp + 0x40], 0x12
jne 0x140028a61
call fcn.14005db90
call fcn.14005e0d0
xor ecx, ecx
call fcn.140036280
mov rcx, qword [0x1400b7940]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140075e10
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
mov rcx, qword [0x1400b7940]
call qword [sym.imp.USER32.dll_DestroyWindow]
lea rcx, [0x14002a680]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3