joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800031d0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor r13d, r13d
mov qword [rbp - 0x28], 0xf
mov rax, rdx
mov qword [rsp + 0x30], r13
mov r15, rcx
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov qword [rbp - 0x30], r13
lea r8d, [r13 + 1]
mov byte [rbp - 0x40], r13b
mov rcx, qword [rax]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x180003376
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, eax
test eax, eax
je 0x180003376
mov rcx, qword [rbp - 0x30]
cmp r12, rcx
ja 0x180003278
cmp qword [rbp - 0x28], 0x10
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x30], r12
cmovae rcx, qword [rbp - 0x40]
mov byte [rcx + r12], r13b
jmp 0x1800032d8
mov rdx, qword [rbp - 0x28]
mov qword [rsp + 0xb0], rdi
mov rax, rdx
mov rdi, r12
sub rax, rcx
sub rdi, rcx
cmp rdi, rax
ja 0x1800032bc
cmp rdx, 0x10
mov qword [rbp - 0x30], r12
lea rbx, [rbp - 0x40]
mov r8, rdi
cmovae rbx, qword [rbp - 0x40]
xor edx, edx
add rbx, rcx
mov rcx, rbx
call fcn.180024ab0
mov byte [rbx + rdi], r13b
jmp 0x1800032d0
mov r9, rdi
mov byte [rsp + 0x20], r13b
mov rdx, rdi
lea rcx, [rbp - 0x40]
call fcn.180003ca0
mov rdi, qword [rsp + 0xb0]
cmp qword [rbp - 0x28], 0x10
lea rbx, [rbp - 0x40]
jb 0x1800032f0
mov rbx, qword [rbp - 0x40]
test rbx, rbx
je 0x180003376
mov r8, r12
xor edx, edx
mov rcx, rbx
call fcn.180024ab0
lea r9, [rbp + 0x38]
mov dword [rbp + 0x38], r13d
mov r8d, r12d
mov qword [rsp + 0x20], r13
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rcx, [r15 + 8]
mov byte [r15], 1
lea rdx, [rbp - 0x40]
call fcn.1800040e0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x180003413
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000340e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003439
jmp 0x18000340e
movdqa xmm0, xmmword [0x18003e580]
lea rcx, [r15 + 8]
lea rdx, [rbp - 0x20]
mov byte [rbp - 0x20], r13b
movdqu xmmword [rbp - 0x10], xmm0
mov byte [r15], r13b
call fcn.1800040e0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1800033ce
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800033c9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003433
call fcn.180005cf4
test r14, r14
je 0x1800033dc
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x180003413
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000340e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003433
call fcn.180005cf4
lea r11, [rsp + 0x80]
mov rax, r15
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18002776c
int3
call fcn.18002776c
int3
Function at 0x1800083b0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1800083c3
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1800089d0
lea rdx, [0x1800456a8]
lea rcx, [rsp + 0x20]
call fcn.180023f64
int3

Function at 0x180014134
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x18004ab78]
xor edx, edx
jmp fcn.1800083b0

Function at 0x180014ad0
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x18004ab78]
jmp fcn.1800083b0

Function at 0x180020748
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x180020804]
mov r9, qword [r9 + 8]
jmp fcn.180010608

Function at 0x1800207dc
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x180020814]
mov r9, qword [r9 + 8]
jmp fcn.180010608
Function at 0x14012e976
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x140171b94

Function at 0x14012ea9c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x18]
jmp 0x140171b94

Function at 0x14012f236
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sar r11w, 0x81
lea r9, [rsp + r9 + 0x18]
pop r11
mov r11d, 0x62ae1587
movzx r11w, byte [r9 + r11 - 0x62ae1587]
sbb rbx, 2
push 0xffffffff9e36cab3
mov word [rbx], r11w
jmp 0x14013cd94

Function at 0x14013098b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rbx, 4
mov dword [rbx], eax
push 0x4484e897
lea rsp, [rsp + 0x18]
jmp 0x140171b94

Function at 0x140133118
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xffffffffd0b9978f
mov dword [r11 + 0xc], eax
jmp 0x14014bab8
mov qword [rsp + 8], 0xffffffffcd3930b3
not byte [rsp + 6]
mov dword [r11 + 8], ebx
mov dword [r11 + 4], ecx
mov dword [r11], edx
mov rbx, qword [rsp + 0x18]
mov rbx, r11
lea rsp, [rsp + 0x20]
jmp 0x140171b94

Function at 0x140133c96
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14013db72
lea rsp, [rsp + 8]
jmp 0x14015e004

Function at 0x14013711c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x20]
jmp 0x140171b94

Function at 0x1401398e6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [r11 + rbx - 0x6e0b3db8], edx
mov rbx, qword [rsp + rbx - 0x6e0b3db0]
push 0xffffffffb4b6f7bc
mov rbx, r11
lea rsp, [rsp + 0x18]
jmp 0x140171b94
mov qword [rsp], 0xffffffffcc994e30
inc byte [rsp + 3]
sub r11, 0xc
mov dword [r11 + 0xc], eax
mov dword [r11 + 8], ebx
jmp 0x1401680a0
mov dword [r11 + 4], ecx
mov ebx, 0x6e0b3db8
jmp 0x140135c5f

Function at 0x14013ab20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x18]
jmp 0x140171b94

Function at 0x14013be58
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rdi, rbx
push 0x42ac9f20
sub rbx, 4
mov dword [rbx], edi
jmp 0x1401646fb
lea rsp, [rsp + 0x10]
jmp 0x140171b94

Function at 0x14013c720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140152b65
lea rsp, [rsp + 0x20]
jmp 0x140171b94

Function at 0x140140ce7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x48]
jmp 0x140171b94

Function at 0x140145529
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x140171b94

Function at 0x140146803
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sbb rbx, 2
jmp 0x140154cb1
mov word [rbx], cx
lea rsp, [rsp + 8]
jmp 0x140171b94

Function at 0x140148251
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rbx], rax
lea rsp, [rsp + 0x20]
jmp 0x140171b94

Function at 0x1401495ee
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x20]
jmp 0x140171b94
lea rdi, [rsp + rdi + 0x20]
mov rsi, qword [rdi + rsi*2 - 0x52580000]
sbb rbx, 8
mov qword [rbx], rsi
jmp 0x140134de9

Function at 0x140149b1a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rsi, rbx
sub rbx, 8
mov qword [rbx], rsi
lea rsp, [rsp + 8]
jmp 0x140171b94
Function at 0x14014ab18
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14013aa7d
lea rsp, [rsp + 0x18]
jmp 0x140171b94
push 0x3592bb3a
mov dword [rbx], edx
jmp 0x14012f231

Function at 0x14014ab96
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x18]
jmp 0x140171b94

Function at 0x14014b19d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rbx, r9
push 0x163d6e35
lea rsp, [rsp + 0x28]
jmp 0x140171b94
mov qword [rsp + 8], 0xffffffff8f3e782e
mov dword [r9 + 8], ebx
mov dword [r9 + 4], ecx
push 0xffffffffd2975933
mov dword [r9], edx
mov rbx, qword [rsp + 0x18]
mov qword [rsp + 8], 0xffffffffadb07ab4
not dword [rsp + 4]
jmp 0x14014466a

Function at 0x14014b7a1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [rbx], r9w
lea rsp, [rsp + 0x10]
jmp 0x140171b94

Function at 0x14014cc9a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x140171b94

Function at 0x140152aac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x140171b94

Function at 0x14015387a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x532052ab
mov word [rbx], di
lea rsp, [rsp + 0x28]
jmp 0x140171b94
sub rbx, 2
jmp 0x14014b457

Function at 0x14015d0a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x21a93d90
lea rsp, [rsp + 0x10]
jmp 0x140171b94
mov bx, word [rbx]
jmp 0x140150e51

Function at 0x14015d9b6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 8]
jmp 0x140171b94

Function at 0x14015dff4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x49bced1d
neg eax
mov rax, qword [rbp + rbx*8 + 0x20]
mov qword [rsp], rax

Function at 0x14015e535
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rbx, 2
mov word [rbx], r9w
lea rsp, [rsp + 0x20]
jmp 0x140171b94

Function at 0x140160f5c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rbx, qword [rbx]
mov qword [rsp], 0xffffffffc3046492
lea rsp, [rsp + 8]
jmp 0x140171b94

Function at 0x140163539
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rbx], r11
lea rsp, [rsp + 0x18]
jmp 0x140171b94

Function at 0x1401665d7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rbx], edx
lea rsp, [rsp + 0x10]
jmp 0x140171b94

Function at 0x14016990c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0xe7a6b00e
mov rax, qword [rbp + rbx*8]
cmp ebx, 1
call fcn.14014ee63
jmp 0x14016114d
lea rsp, [rsp + 0x10]
jne 0x14013d030
push 0x549579a6
mov rax, qword [rbp + riz]
sub rsp, 0x18
call rax
mov esi, 0xf705e53e
push rsi
mov rsp, qword [rbp + riz - 0x10]
movzx r8d, sil
xchg r8d, esi
mov rbp, qword [rsi + rbp - 0x46]
mov qword [rbp + rsi*2 - 0x7c], rax
mov r10d, r8d
mov r8, rbp
pop rsi
push r10
mov r10, qword [rsp + 8]
jmp 0x14014cd42
lea rsp, [rsp + 8]
jmp 0x140171b94
jmp 0x14016be46
push 0x50db8af
push 0x3e265416
dec ebx
jmp 0x1401496e2
mov eax, 0x50138391
rdtsc
jmp 0x140154521
mov rdx, rax
lea rsp, [rsp + 8]
jmp 0x14015e004
sub rbx, 8
mov dword [rbx + 4], eax
mov dword [rbx], edx
push 0x5833fb1a
jmp 0x14014f74f
Function at 0x14016b4c2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov bx, word [rbx]
lea rsp, [rsp + 8]
jmp 0x140171b94

Function at 0x14016dda1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x18]
jmp 0x140171b94

Function at 0x14016e45c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xffffffff8789bcab
lea rsp, [rsp + 0x10]
jmp 0x140171b94
mov ebx, dword [rbx]
jmp 0x140153a2e

Function at 0x14016ff59
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and r9, 0xfffffffffffffff0
shr esi, 0x58
movzx edi, si
sbb r9, rcx
mov rsp, r9
pushfq
or sil, dil
ror sil, 0xe1
or rsi, rax
neg dil
or rdi, r9
jmp 0x140160f42
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
jmp 0x14014b843
mov eax, 0x8222d9ab
mov rax, rsp
mov r9d, 0xc70efe2d
movzx esi, r9w
lea ecx, [rsi - 0xfce5]
lea r9, [r9*2 + 0x8a8f710]
lea r9, [rbx + rsi*2 - 0x1fcda]
sal sil, 6
jbe 0x14013038b
jmp 0x140143eff
mov ebx, 0xd0a71516
lea rbx, [rbx*4 + 0x44358230]
movzx ebx, word [r11]
add r11, 2
xor bx, r8w
push 0xffffffff8ea77abe
add bx, 0x8980
shr word [rsp + 1], 0xa1
not bx
mov edx, dword [rsp + 2]
call fcn.14015af5d
mov rcx, qword [rsp + rdx - 0x1b]
sub rbx, 0x583df29f
movzx r14d, di
bswap rdx
mov r9, qword [rsp + r10*2 - 0x776edc46]
mov qword [rsp + r10 - 0x3bb76e2b], 0xffffffff96acc798
mov r14, qword [rsp + r10 - 0x3bb76e0b]
mov qword [rsp + r10 - 0x3bb76e13], rdx
pop rdi
push qword [rsp + 0x28]
popfq
movsx ebp, bx
push rbx
mov rdi, qword [rsp + r10 - 0x3bb76dfb]
pop rdx
not dword [rsp + rdx + 0x583df26c]
mov rdx, qword [rsp + r10 - 0x3bb76dfb]
pop r10
mov r10, qword [rsp + rbp - 0xd5c]
mov rbp, qword [rsp + rbx + 0x583df2ac]
mov rbx, qword [rsp + rbx + 0x583df2b4]
mov qword [rsp + 0x20], 0xffffffff8380c315
lea rsp, [rsp + 0x50]
ret
push 0x233adb0a
cld
push 0xfffffffff8b3072c
neg dword [rsp]
rep movsb byte [rdi], byte [rsi]
not dword [rsp + 8]
jne 0x14013841b
sub rbx, 8
mov qword [rbx], rdi
lea rsp, [rsp + 8]
jmp 0x140171b94
lea r9, [rsp + 0x1c8]
cmp rbx, r9
push 0xffffffffcd219035
lea rsp, [rsp + 8]
ja 0x14014b843
jmp 0x14013fe1c

Function at 0x140171ced
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [rbx], ax
lea rsp, [rsp + 8]
jmp 0x140171b94
Function at 0x140006880
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1401076d0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x14000690e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x1400068b2
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x140006920
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1401076d0]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x140006a24
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x140006a1f
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x1400069f4
cmp qword [rsp + 0x38], 2
jb 0x1400069f4
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400069f4
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400069f4
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140006967
jmp 0x140006ab6
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x140006ab6
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x140006a8c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140006a8c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140006a8c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140006a24
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x140006cc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.1400c46f4
add rsp, 0x28
ret
Function at 0x14001cd70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss dword [rsp + 0x20], xmm3
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, qword [rsp + 0x80]
call fcn.140001f90
mov eax, dword [rsp + 0x88]
and eax, 1
test eax, eax
je 0x14001ce49
mov edx, dword [rsp + 0x90]
mov ecx, socket
call fcn.14001cb40
movss dword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, reloc.WS2_32.dll_send
call fcn.14001cb40
movss xmm1, dword [rsp + 0x20]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x28], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, send
call fcn.14001cb40
movss dword [rsp + 0x24], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, send
call fcn.14001cb40
movss xmm1, dword [rsp + 0x24]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x2c], xmm0
movss xmm2, dword [rsp + 0x28]
movss xmm1, dword [rsp + 0x2c]
lea rcx, [rsp + 0x50]
call fcn.140001f90
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.140002a10
mov eax, dword [rsp + 0x88]
and eax, 2
test eax, eax
je 0x14001cef7
mov edx, dword [rsp + 0x90]
mov ecx, 7
call fcn.14001cb40
movss dword [rsp + 0x30], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 6
call fcn.14001cb40
movss xmm1, dword [rsp + 0x30]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x38], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 5
call fcn.14001cb40
movss dword [rsp + 0x34], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 4
call fcn.14001cb40
movss xmm1, dword [rsp + 0x34]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x3c], xmm0
movss xmm2, dword [rsp + 0x38]
movss xmm1, dword [rsp + 0x3c]
lea rcx, [rsp + 0x58]
call fcn.140001f90
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.140002a10
mov eax, dword [rsp + 0x88]
and eax, 4
test eax, eax
je 0x14001cfa5
mov edx, dword [rsp + 0x90]
mov ecx, 0xb
call fcn.14001cb40
movss dword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 0xa
call fcn.14001cb40
movss xmm1, dword [rsp + 0x40]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x48], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 9
call fcn.14001cb40
movss dword [rsp + 0x44], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 8
call fcn.14001cb40
movss xmm1, dword [rsp + 0x44]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x4c], xmm0
movss xmm2, dword [rsp + 0x48]
movss xmm1, dword [rsp + 0x4c]
lea rcx, [rsp + 0x60]
call fcn.140001f90
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.140002a10
movss xmm0, dword [rsp + 0x98]
ucomiss xmm0, dword [0x14010d968]
jp 0x14001cfb9
je 0x14001cfe0
mov ecx, recv
call fcn.140005520
movzx eax, al
test eax, eax
je 0x14001cfe0
movss xmm1, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x80]
call fcn.140002ab0
movss xmm0, dword [rsp + 0xa0]
ucomiss xmm0, dword [0x14010d968]
jp 0x14001cff4
je 0x14001d01b
mov ecx, send
call fcn.140005520
movzx eax, al
test eax, eax
je 0x14001d01b
movss xmm1, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x80]
call fcn.140002ab0
mov rax, qword [rsp + 0x80]
add rsp, 0x78
ret
Function at 0x14003ea30
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140128218]
xor rax, rsp
mov qword [rsp + 0x60], rax
call fcn.14000b490
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140168d60]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x54]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm0, eax
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm1, eax
movaps xmm2, xmm0
lea rcx, [rsp + 0x3c]
call fcn.140001f90
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 8], rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x140168d68]
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, rcx
cvtsi2ss xmm0, rax
cvtsi2ss xmm1, qword [0x140168d70]
divss xmm0, xmm1
mov rax, qword [rsp + 0x20]
movss dword [rax + 0x10], xmm0
mov rax, qword [rsp + 0x58]
mov qword [0x140168d68], rax
mov ecx, send
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14003eafc
mov dword [rsp + 0x28], 1
jmp 0x14003eb04
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x28]
mov byte [rax + 0x140], cl
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14003eb33
mov dword [rsp + 0x2c], 1
jmp 0x14003eb3b
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x2c]
mov byte [rax + 0x141], cl
mov ecx, send
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14003eb6a
mov dword [rsp + 0x30], 1
jmp 0x14003eb72
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x30]
mov byte [rax + 0x142], cl
mov rax, qword [rsp + 0x20]
mov byte [rax + 0x143], 0
call fcn.14003e290
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0xc0]
test eax, eax
je 0x14003ebad
mov dword [rsp + 0x34], 0xffffffff
jmp 0x14003ebb6
call fcn.14000f850
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
cmp dword [reloc.WS2_32.dll_htons], eax
je 0x14003ebd9
mov eax, dword [rsp + 0x38]
mov dword [reloc.WS2_32.dll_htons], eax
call fcn.14003e160
call fcn.14003e3c0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400afe40
add rsp, 0x78
ret
Function at 0x1400426f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1401676e8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x1908]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
movss xmm0, dword [rax + 0x1910]
movss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x50]
movss xmm0, dword [rsp + 0x24]
divss xmm0, dword [rax + 0x14]
movss dword [rsp + 0x3c], xmm0
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, qword [rsp + 0x70]
call fcn.140001f90
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x80]
cmp qword [rsp + 0x30], rax
jae 0x14004283e
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xa
jne 0x140042800
movss xmm1, dword [rsp + 0x20]
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax]
call fcn.140022b20
mov rax, qword [rsp + 0x70]
movss dword [rax], xmm0
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
movss dword [rax + 4], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0x98]
test eax, eax
je 0x1400427fb
jmp 0x14004283e
jmp 0x140042771
cmp dword [rsp + 0x28], 0xd
jne 0x14004280c
jmp 0x140042771
movzx edx, word [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.14003f3f0
mulss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x40], xmm0
movss xmm0, dword [rsp + 0x20]
addss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x20], xmm0
jmp 0x140042771
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [rax]
jbe 0x14004285d
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rsp + 0x20]
movss dword [rax], xmm0
cmp qword [rsp + 0x90], 0
je 0x140042899
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
movaps xmm2, xmm0
movss xmm1, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.140001f90
mov rax, qword [rax]
mov rcx, qword [rsp + 0x90]
mov qword [rcx], rax
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [0x14010d968]
ja 0x1400428bd
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
ucomiss xmm0, dword [0x14010d968]
jp 0x1400428d7
jne 0x1400428d7
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
movss dword [rax + 4], xmm0
cmp qword [rsp + 0x88], 0
je 0x1400428f2
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret