joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404e07a5
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
bswap ax
nop
movzx ax, cl
push rsi
mov al, spl
push rdi
push r14
movzx eax, sp
mov eax, 0x1450
jmp 0x1404e07d2
call fcn.14044cd9c
sub rsp, rax
and r10d, esp
shrd eax, r12d, 0xc
mov rax, qword [0x1400b7288]
ror bpl, cl
btr r10d, r10d
xor rax, rsp
mov qword [rsp + 0x1440], rax
rol si, cl
movsxd r10, edx
mov rdi, rcx
rcl edx, cl
add sil, bpl
test cx, 0x309d
mov rax, r10
sar ebp, cl
mov ebp, r9d
jmp 0x1404e0823
sar rax, 6
sar dx, 0xb7
not ch
shld r14w, r9w, 0xdc
lea rcx, [0x1400ba940]
sar si, 0x43
not r14b
and r10d, 0x3f
shl rsi, cl
stc
lea rbp, [rbp + r8]
shl si, 0x38
mov rsi, r8
sar r14b, 0xf7
cmc
btr rdx, 0xcd
mov rax, qword [rcx + rax*8]
ror r14b, 0x23
sub dx, 0x394f
movsx rdx, ax
lea rdx, [r10 + r10*8]
sar r14w, 0xd9
movsx r14d, r15w
mov r14, qword [rax + rdx*8 + 0x28]
sub eax, eax
jmp 0x1404e088d
mov qword [rdi], rax
cmp cl, 0x54
mov dword [rdi + 8], eax
cmc
cmp r8, rbp
jmp 0x1404e089f
jae 0x1404e09c1
lea rbx, [rsp + 0x40]
cmc
cmp rsi, rbp
jmp 0x1404e08b3
jae 0x1404e0927
movzx eax, word [rsi]
add rsi, 2
clc
cmp ax, 0xa
jmp 0x1404e08ca
jne 0x1404e08f9
add dword [rdi + 8], 2
xchg cx, cx
sar cx, cl
bts cx, si
mov ecx, 0xd
jmp 0x1404e08ec
mov word [rbx], cx
clc
add rbx, 2
clc
cmp r15b, 0xdd
mov word [rbx], ax
lahf
btr rax, rsp
bts ax, r8w
add rbx, 2
cdqe
movzx eax, di
lea rax, [rsp + 0x143e]
stc
cmc
cmp rbx, rax
jmp 0x1404e0921
jb 0x1404e08ab
and qword [rsp + 0x20], 0
inc rcx
lea rax, [rsp + 0x40]
sbb rcx, 0x355205f
sub rbx, rax
inc edx
cdq
shl r8w, cl
lea r9, [rsp + 0x30]
sar rbx, 1
or r8b, sil
lea rdx, [rsp + 0x40]
ror ch, 0x61
bsf r8w, r14w
add ebx, ebx
movzx r8d, bx
jmp 0x1404e0969
mov rcx, r14
movsx r8w, r11b
mov r8b, 0x15
mov r8d, ebx
jmp 0x1404e097c
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404e0989
je 0x1404e09b9
mov eax, dword [rsp + 0x30]
test bl, r14b
clc
add dword [rdi + 4], eax
cmc
test bpl, dl
cmp eax, ebx
jb 0x1404e09c1
cmp rsi, rbp
jmp 0x1404e09ae
jb 0x1404e08a5
jmp 0x1404e09c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
sar cx, 0xe3
mov rcx, qword [rsp + 0x1440]
cmp dl, 0x41
jmp 0x1404e09d8
xor rcx, rsp
jmp 0x1404e09e0
call fcn.1404a3d69
lea r11, [rsp + 0x1450]
movsx rbx, r12w
not esi
cmovo r14w, ax
mov rbx, qword [r11 + 0x20]
cmovg esi, r8d
movsx r14w, r13b
movsx esi, r8w
mov rbp, qword [r11 + 0x30]
movsxd r14, r9d
jmp 0x1404e0a18
mov rsp, r11
pop r14
bswap esi
jmp 0x1404e0a28
pop rdi
movsx rsi, si
setp sil
pop rsi
jmp 0x1404e0a37
ret
Function at 0x1404e4417
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
bswap r8w
push rdi
cmc
sub rsp, 0x20
mov rbx, rdx
sete dh
not r9b
lea r9, [0x1400c8ea8]
mov edi, ecx
lea rdx, [0x1400cf748]
mov ecx, 3
mov r8b, 0x8c
mov r8b, bl
jmp 0x1404e444f
lea r8, [0x1400c8ea0]
call fcn.1404e4555
mov rdx, rbx
mov ecx, edi
cmp rdi, rdi
test rax, rax
jmp 0x1404e446b
je 0x1404e447c
call qword [case.0x1404cf978.0]
jmp 0x1404e4482
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
bsf di, sp
clc
cmp r10b, spl
add rsp, 0x20
pop rdi
ret
Function at 0x1404e8636
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
shl r10d, cl
sub rsp, 0x30
shld r10, rax, 0xd
sub eax, eax
not r10b
adc r10, 0x793503e5
sub r10w, ax
mov r10d, ecx
jmp 0x1404e865c
test rdx, rdx
jmp 0x1404e8664
jne 0x1404e869b
call fcn.1404b95c8
mov ebx, 0x16
jmp 0x1404e8679
mov dword [rax], ebx
jmp 0x1404e8680
call fcn.1404ba291
mov eax, ebx
cmp spl, 0x52
add rsp, 0x30
movsx bx, r14b
pop rbx
jmp 0x1404e869a
ret
test r8, r8
jmp 0x1404e86a3
je 0x1404e866a
movzx ecx, byte [rsp + 0x60]
mov word [rdx], ax
lea rax, [rcx + 1]
cmp r8, rax
ja 0x1404e86d2
call fcn.1404b95c8
mov ebx, 0x22
jmp 0x1404e86cd
jmp 0x1404e8679
lea eax, [r9 - 2]
mov ebx, 0x22
cmp edx, ecx
test spl, 0x11
cmp eax, ebx
jmp 0x1404e86e8
ja 0x1404e866a
mov byte [rsp + 0x60], cl
adc ebx, r8d
mov ecx, r10d
add rsp, 0x30
pop rbx
jmp 0x1404e8702
jmp 0x1404e8707
mov qword [rsp + 8], rbx
sal r11w, cl
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
neg r11w
cmc
shr bl, 0xce
push rdi
and bpl, 0xc
shld bx, r12w, 0x14
push r14
movsx r11, r15w
neg r10d
push r15
add r11w, 0x3f72
sub rsp, 0x20
xor r15d, r15d
mov ebp, r9d
btr rbx, rcx
mov rdi, r8
movsx r11, dx
inc r10b
mov r11, rdx
setae bh
cmova r10, rdx
or ebx, eax
mov r10, rdx
or bx, di
mov ebx, r15d
cmc
cmp byte [rsp + 0x60], r15b
jmp 0x1404e8776
je 0x1404e87b5
lea eax, [r15 + 0x2d]
btc rsi, rsp
movzx r8, r9w
test r9b, bl
neg ecx
xor esi, ecx
mov word [rdx], ax
movzx r9d, r10w
ror bl, 0xfd
lea ebx, [rax - 0x2c]
movzx r8w, r13b
rcr r9w, 0x75
sal r10b, cl
lea r10, [rdx + 2]
rcl r8b, 0x46
mov r14w, r14w
mov r8, r10
mov al, 0xc
sub edx, edx
lea rsi, [r10 + 2]
test rcx, 0x784c1cb2
mov eax, ecx
cmp sil, sil
or ch, 0x2d
movsx r9w, bl
mov r9, r10
mov ch, 8
div ebp
movzx r14w, r13b
shr r14w, cl
mov ecx, eax
mov ax, 0x46fb
adc r14b, bpl
movsx rax, sp
cmp edx, 9
jmp 0x1404e87fa
mov eax, 0x57
movsx r14w, cl
cmovle r14w, r9w
bswap r14d
lea r14d, [rax - 0x27]
cmovbe ax, r14w
jmp 0x1404e881a
inc rbx
jmp 0x1404e8825
add ax, dx
mov word [r10], ax
test r11w, 0x2682
test ecx, ecx
jmp 0x1404e8839
je 0x1404e8854
mov r10, rsi
stc
test bl, r8b
cmp rbx, rdi
jmp 0x1404e884e
jb 0x1404e87ba
cmp rbx, rdi
jb 0x1404e8883
mov word [r11], r15w
call fcn.1404b95c8
mov ebx, 0x22
mov dword [rax], ebx
jmp 0x1404e8872
call fcn.1404ba291
mov eax, ebx
jmp 0x1404e887e
jmp 0x1404e88cd
mov word [rsi], r15w
movzx eax, word [r8]
and cl, r13b
movzx ecx, word [r9]
mov word [r9], ax
sub r9, 2
cmp dx, 0xab2
test r15b, 0x67
cmp r14d, r12d
mov word [r8], cx
cmp r12w, 0x7faa
test r10d, 0x62a62488
add r8, 2
clc
cmp r8, r9
jb 0x1404e8887
sub eax, eax
clc
jmp 0x1404e88cd
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
btr rdi, rbp
dec r14b
rcl r14d, 7
mov rsi, qword [rsp + 0x50]
dec r14b
bswap r14
add rsp, 0x20
pop r15
movsx r14, di
bswap rdi
pop r14
pop rdi
ret
Function at 0x140028280
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.140028d50
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x14002d3a0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x14002d3c2
mov rcx, qword [rsp + 0x40]
call fcn.14002d470
jmp 0x14002d3d9
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x14002d3d9
mov rcx, qword [rsp + 0x40]
call fcn.14002d520
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x14002d470
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x14002d491
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x14002d515
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x14002d4e0
mov dword [rsp + 4], 0x9908b0df
jmp 0x14002d4e8
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14002d484
add rsp, 0x18
ret
Function at 0x14002d520
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x14002d550
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x14002d5d2
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x14002d59e
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x14002d5a6
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14002d545
mov qword [rsp + 8], 0xe3
jmp 0x14002d5ea
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x14002d671
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x14002d63b
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x14002d643
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14002d5dd
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x14002d6c5
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x14002d6cd
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x14002fba0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
movss dword [rsp + 0x20], xmm3
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14002fbd6
mov rax, qword [rsp + 0x38]
mov byte [rax], 1
jmp 0x14002fc3b
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
test eax, eax
je 0x14002fc3b
xor edx, edx
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov r8d, 8
movzx edx, al
movzx ecx, byte [rsp + 0x40]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov r8d, 2
movzx edx, al
movzx ecx, byte [rsp + 0x40]
call qword [sym.imp.USER32.dll_keybd_event]
mov rax, qword [rsp + 0x38]
mov byte [rax], 0
add rsp, 0x28
ret

Function at 0x14002fc70
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x48
movzx eax, byte [0x1401d85ef]
test eax, eax
jne 0x14002fc81
jmp 0x14002fcd3
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.https:__discord.com_invite_VgRrxwesPz
lea rdx, [0x1401352d8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movzx eax, byte [0x1401d85ef]
test eax, eax
jne 0x14002fcc0
mov dword [rsp + 0x30], 1
jmp 0x14002fcc8
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
mov byte [0x1401d85ef], al
add rsp, 0x48
ret

Function at 0x14002fce0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x48
movzx eax, byte [0x1401d85f1]
test eax, eax
jne 0x14002fcf1
jmp 0x14002fd43
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.https:__github.com_CowNowK_AimStar
lea rdx, [0x140135304]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movzx eax, byte [0x1401d85f1]
test eax, eax
jne 0x14002fd30
mov dword [rsp + 0x30], 1
jmp 0x14002fd38
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
mov byte [0x1401d85f1], al
add rsp, 0x48
ret
Function at 0x14002fd50
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
movzx eax, byte [0x1401d85f3]
test eax, eax
jne 0x14002fd64
jmp 0x14002ff9f
mov dword [rsp + 0x20], 0x20
movss xmm0, dword [0x140161840]
call fcn.14005a910
xorps xmm2, xmm2
movss xmm1, dword [0x140161cb8]
lea rcx, [rsp + 0x24]
call fcn.14000ce30
xor edx, edx
mov rcx, rax
call fcn.14005a800
mov r8d, dword [rsp + 0x20]
xor edx, edx
lea rcx, str.Cheats_List
call fcn.1400556f0
movzx eax, byte [0x1401d82b9]
test eax, eax
je 0x14002fdde
movzx eax, byte [0x1401d82cd]
test eax, eax
jne 0x14002fdd2
mov ecx, dword [0x1401c43f0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x14002fdde
lea rcx, str.Aimbot__Toggle_
call fcn.14009a4e0
movzx edx, byte [0x1401d82cc]
lea rcx, [0x140135330]
call fcn.14002fb20
movzx edx, byte [0x1401d85ee]
lea rcx, [0x14013533c]
call fcn.14002fb20
movzx edx, byte [0x1401d85f8]
lea rcx, [0x140135348]
call fcn.14002fb20
movzx edx, byte [0x1401d829b]
lea rcx, str.Crosshair
call fcn.14002fb20
movzx edx, byte [0x1401d85f4]
lea rcx, [0x140135368]
call fcn.14002fb20
movzx edx, byte [0x1401733c1]
lea rcx, [0x140135378]
call fcn.14002fb20
movzx edx, byte [0x1401d85fc]
lea rcx, str.External_Radar
call fcn.14002fb20
movzx edx, byte [0x1401d85ed]
lea rcx, [0x140135390]
call fcn.14002fb20
movzx edx, byte [0x1401d85fa]
lea rcx, [0x1401353a0]
call fcn.14002fb20
movss xmm0, dword [0x1401d85e8]
ucomiss xmm0, dword [0x14016171c]
je 0x14002fea6
lea rcx, str.Flash_Immunity
call fcn.14009a4e0
movzx edx, byte [0x1401d85f5]
lea rcx, [0x1401353c0]
call fcn.14002fb20
cmp dword [0x1401c43d0], 0x5a
je 0x14002fece
lea rcx, str.Fov_Changer
call fcn.14009a4e0
movzx edx, byte [0x1401d82b1]
lea rcx, [0x1401353e0]
call fcn.14002fb20
movzx edx, byte [0x1401d85f2]
lea rcx, [0x1401353f0]
call fcn.14002fb20
movzx edx, byte [0x1401d85f0]
lea rcx, str.Money_Service
call fcn.14002fb20
movzx edx, byte [0x1401d85e4]
lea rcx, [0x140135410]
call fcn.14002fb20
movzx edx, byte [0x1401d8615]
lea rcx, [0x140135420]
call fcn.14002fb20
movzx edx, byte [0x1401d82b8]
lea rcx, [0x14013542c]
call fcn.14002fb20
movzx edx, byte [0x1401d85f7]
lea rcx, [0x140135430]
call fcn.14002fb20
movzx edx, byte [0x1401d85f6]
lea rcx, [0x140135440]
call fcn.14002fb20
movzx eax, byte [0x1401d82a8]
test eax, eax
je 0x14002ff99
movzx eax, byte [0x1401d82b2]
test eax, eax
jne 0x14002ff8d
mov ecx, dword [0x1401d82d0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x14002ff99
lea rcx, str.TriggerBot__Toggle_
call fcn.14009a4e0
call fcn.140059140
nop
add rsp, 0x38
ret
Function at 0x1400302c0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
movzx eax, byte [0x1401d85fa]
test eax, eax
jne 0x1400302d4
jmp 0x140030382
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400302ee
jmp 0x140030382
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140030305
jmp 0x140030382
movss xmm3, dword [0x140161c2c]
mov r8d, 0x44
lea rdx, [0x1401d600a]
mov ecx, 0x41
call fcn.14002fba0
movss xmm3, dword [0x140161c2c]
mov r8d, 0x41
lea rdx, [0x1401d601c]
mov ecx, 0x44
call fcn.14002fba0
movss xmm3, dword [0x140161c2c]
mov r8d, 0x53
lea rdx, [0x1401d600b]
mov ecx, 0x57
call fcn.14002fba0
movss xmm3, dword [0x140161c2c]
mov r8d, 0x57
lea rdx, [0x1401d6009]
mov ecx, 0x53
call fcn.14002fba0
nop
add rsp, 0x28
ret

Function at 0x140030d90
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140173340]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, byte [0x1401d85ee]
test eax, eax
jne 0x140030db8
jmp 0x140030e8a
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140030dcf
mov byte [rsp + 0x21], 1
jmp 0x140030dd4
mov byte [rsp + 0x21], 0
movzx eax, byte [rsp + 0x21]
mov byte [rsp + 0x20], al
mov rcx, qword [rsp + 0x50]
call fcn.14000e900
mov byte [rsp + 0x22], al
lea rdx, [rsp + 0x30]
lea rcx, [0x1401d8820]
call fcn.140034a90
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140030e40
movzx eax, byte [rsp + 0x22]
test eax, eax
je 0x140030e40
mov dword [rsp + 0x24], 0x11
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x28]
call fcn.140026260
mov rcx, rax
call fcn.140026280
mov edx, 0x10001
lea rcx, [0x1401d8820]
call fcn.140034a50
jmp 0x140030e8a
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140030e65
movzx eax, byte [rsp + 0x22]
test eax, eax
jne 0x140030e65
mov edx, 0x100
lea rcx, [0x1401d8820]
call fcn.140034a50
jmp 0x140030e8a
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140030e8a
cmp dword [rsp + 0x30], 0x10001
jne 0x140030e8a
mov edx, 0x100
lea rcx, [0x1401d8820]
call fcn.140034a50
nop
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401217b0
add rsp, 0x48
ret
Function at 0x140034510
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x4d0
lea rbp, [rsp + 0x20]
mov rax, qword [0x140173340]
xor rax, rbp
mov qword [rbp + 0x4a0], rax
mov dword [rbp + 0x60], 0x438
mov rax, qword [rbp + 0x4c0]
mov edx, dword [rax + 0x10]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
call fcn.140034470
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x90]
mov qword [rbp + 0x20], rax
cmp qword [rbp + 0x20], 0
jne 0x14003458d
mov qword [rbp + 0x30], 0
jmp 0x14003462b
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 8]
cmp word [rax + rcx*2], 0
jne 0x14003459d
mov rax, qword [rbp + 8]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x1400345cc
mov qword [rbp + 0x28], 0
jmp 0x140034623
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x40], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x1400345f4
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.1401229b0
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x40]
mov r8d, ecx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call fcn.140034480
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x30], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.140023c00
mov rcx, qword [rbp + 0x30]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x140034651
inc rcx
test dl, dl
jne 0x14003463e
xor eax, eax
jmp 0x140034656
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140034681
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.140009900
mov rax, qword [rbp + 0x48]
jmp 0x1400346b9
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x14003456e
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x50], 0
mov rcx, qword [rbp + 0x4c8]
call fcn.140009900
mov rax, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x4a0]
xor rcx, rbp
call fcn.1401217b0
lea rsp, [rbp + 0x4b0]
pop rbp
ret
Function at 0x140036020
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x2c0
lea rbp, [rsp + 0x20]
mov rax, qword [0x140173340]
xor rax, rbp
mov qword [rbp + 0x290], rax
mov dword [rbp + 0x50], 0x238
xor edx, edx
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
call fcn.140034470
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x7c]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140036092
mov qword [rbp + 0x38], 0
jmp 0x140036130
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x40], rax
mov qword [rbp + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 8]
cmp word [rax + rcx*2], 0
jne 0x1400360a2
mov rax, qword [rbp + 8]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x1400360d1
mov qword [rbp + 0x30], 0
jmp 0x140036128
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x48], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x1400360f9
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.1401229b0
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x48]
mov r8d, ecx
mov rdx, qword [rbp + 0x28]
mov rcx, rax
call fcn.140034480
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x38], rax
mov rcx, qword [rbp + 0x2b8]
call fcn.140023c00
mov rcx, qword [rbp + 0x38]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x140036156
inc rcx
test dl, dl
jne 0x140036143
xor eax, eax
jmp 0x14003615b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140036180
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x58]
mov dword [rbp + 0x1c], eax
mov rcx, qword [rbp + 0x2b8]
call fcn.140009900
mov eax, dword [rbp + 0x1c]
jmp 0x1400361b6
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140036076
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x20], 0
mov rcx, qword [rbp + 0x2b8]
call fcn.140009900
mov eax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x290]
xor rcx, rbp
call fcn.1401217b0
lea rsp, [rbp + 0x2a0]
pop rbp
ret

Function at 0x140036b80
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._C_taskkill__F__IM_cs2.exe
lea r8, str.cmd.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
add rsp, 0x38
ret

Function at 0x1400378e0
Capabilities:
Execute command
Terminate process

Disassembly:
sub rsp, 0x28
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
add rsp, 0x28
ret