joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a5d70
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [0x1401bc798]
cmp byte [rax + 0x5fb0], 0
je 0x1400a5f00
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rsi, qword [0x1401bb260]
mov qword [r11 - 0x10], r12
mov r12, qword [0x1401bb250]
mov qword [r11 - 0x18], r13
lea r13, [0x1401bb250]
mov qword [r11 - 0x20], r14
mov r14, qword [0x1401bc5e8]
mov qword [r11 - 0x28], r15
mov rbp, r14
mov r15, qword [0x1401bb268]
mov rbx, qword [r14 + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400a5e23
mov qword [r11 - 8], rdi
nop dword [rax + rax]
mov rdi, qword [rbx + 0x30]
lea rcx, [rbx + 0x20]
cmp r15, 0xf
mov rdx, r13
cmova rdx, r12
cmp qword [rcx + 0x18], 0xf
jbe 0x1400a5dfd
mov rcx, qword [rcx]
cmp rsi, rdi
mov r8, rdi
cmovb r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a5e5d
js 0x1400a5e62
mov rbp, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1400a5de0
mov rdi, qword [rsp + 0x60]
cmp byte [rbp + 0x19], 0
jne 0x1400a5e6d
cmp qword [rbp + 0x38], 0xf
lea rdx, [rbp + 0x20]
mov rbx, qword [rdx + 0x10]
jbe 0x1400a5e3b
mov rdx, qword [rdx]
cmp r15, 0xf
mov rcx, r13
mov r8, rsi
cmova rcx, r12
cmp rbx, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a5e68
js 0x1400a5e6d
jmp 0x1400a5e70
cmp rdi, rsi
jae 0x1400a5e12
mov rbx, qword [rbx + 0x10]
jmp 0x1400a5e18
cmp rsi, rbx
jae 0x1400a5e70
mov rbp, r14
mov r15, qword [rsp + 0x40]
cmp rbp, r14
mov r14, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x80]
mov r12, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x78]
je 0x1400a5efb
mov rdx, r13
lea rcx, [0x1401bc5e8]
call fcn.14009da30
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400a5efb
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], reloc.WLDAP32.dll_Ordinal_200
call fcn.140021460
xor eax, eax
lea rdx, str.actioninput_ntext__
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x20], xmm0
lea r8d, [rax + 0x15]
call fcn.140015bf0
lea rcx, [rsp + 0x20]
call fcn.140054940
mov r13, qword [rsp + 0x50]
add rsp, 0x68
ret
Function at 0x1400a5f10
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rax, qword [0x1401bc798]
cmp byte [rax + 0x5fb0], 0
je 0x1400a60fe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rsi, qword [0x1401bba50]
mov qword [r11 - 0x10], r12
mov r12, qword [0x1401bba40]
mov qword [r11 - 0x18], r13
lea r13, [0x1401bba40]
mov qword [r11 - 0x20], r14
mov r14, qword [0x1401bc5e8]
mov qword [r11 - 0x28], r15
mov rbp, r14
mov r15, qword [0x1401bba58]
mov rbx, qword [r14 + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400a5fc6
mov qword [r11 - 8], rdi
nop
mov rdi, qword [rbx + 0x30]
lea rcx, [rbx + 0x20]
cmp r15, 0xf
mov rdx, r13
cmova rdx, r12
cmp qword [rcx + 0x18], 0xf
jbe 0x1400a5f9d
mov rcx, qword [rcx]
cmp rsi, rdi
mov r8, rdi
cmovb r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a6000
js 0x1400a6005
mov rbp, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1400a5f80
mov rdi, qword [rsp + 0x80]
cmp byte [rbp + 0x19], 0
jne 0x1400a6010
cmp qword [rbp + 0x38], 0xf
lea rdx, [rbp + 0x20]
mov rbx, qword [rdx + 0x10]
jbe 0x1400a5fde
mov rdx, qword [rdx]
cmp r15, 0xf
mov rcx, r13
mov r8, rsi
cmova rcx, r12
cmp rbx, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a600b
js 0x1400a6010
jmp 0x1400a6013
cmp rdi, rsi
jae 0x1400a5fb2
mov rbx, qword [rbx + 0x10]
jmp 0x1400a5fb8
cmp rsi, rbx
jae 0x1400a6013
mov rbp, r14
mov r15, qword [rsp + 0x60]
cmp rbp, r14
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x98]
je 0x1400a60f9
mov rdx, r13
lea rcx, [0x1401bc5e8]
call fcn.14009da30
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400a60f9
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], reloc.WLDAP32.dll_Ordinal_200
call fcn.140021460
mov rcx, qword [0x14017b6a8]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x19
jb 0x1400a6106
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
lea rax, [0x14017b698]
movzx edx, byte [rsp + 0x90]
lea r9, str.actioninput_ntext_pull
cmova rax, qword [0x14017b698]
lea r8, [0x14017b698]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], Ordinal_27
call fcn.140005390
mov rcx, qword [0x1401bc798]
lea r8, [rsp + 0x40]
mov r9d, 2
xor edx, edx
call fcn.1400bb080
mov r13, qword [rsp + 0x70]
add rsp, 0x88
ret
call fcn.140005690
int3
Function at 0x1400a6110
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rax, qword [0x1401bc798]
cmp byte [rax + 0x5fb0], 0
je 0x1400a62ef
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rsi, qword [0x1401bba90]
mov qword [r11 - 0x10], r12
mov r12, qword [0x1401bba80]
mov qword [r11 - 0x18], r13
lea r13, [0x1401bba80]
mov qword [r11 - 0x20], r14
mov r14, qword [0x1401bc5e8]
mov qword [r11 - 0x28], r15
mov rbp, r14
mov r15, qword [0x1401bba98]
mov rbx, qword [r14 + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400a61c6
mov qword [r11 - 8], rdi
nop
mov rdi, qword [rbx + 0x30]
lea rcx, [rbx + 0x20]
cmp r15, 0xf
mov rdx, r13
cmova rdx, r12
cmp qword [rcx + 0x18], 0xf
jbe 0x1400a619d
mov rcx, qword [rcx]
cmp rsi, rdi
mov r8, rdi
cmovb r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a6200
js 0x1400a6205
mov rbp, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1400a6180
mov rdi, qword [rsp + 0x80]
cmp byte [rbp + 0x19], 0
jne 0x1400a6210
cmp qword [rbp + 0x38], 0xf
lea rdx, [rbp + 0x20]
mov rbx, qword [rdx + 0x10]
jbe 0x1400a61de
mov rdx, qword [rdx]
cmp r15, 0xf
mov rcx, r13
mov r8, rsi
cmova rcx, r12
cmp rbx, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a620b
js 0x1400a6210
jmp 0x1400a6213
cmp rdi, rsi
jae 0x1400a61b2
mov rbx, qword [rbx + 0x10]
jmp 0x1400a61b8
cmp rsi, rbx
jae 0x1400a6213
mov rbp, r14
mov r15, qword [rsp + 0x60]
cmp rbp, r14
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x98]
je 0x1400a62ea
mov rdx, r13
lea rcx, [0x1401bc5e8]
call fcn.14009da30
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400a62ea
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], reloc.WLDAP32.dll_Ordinal_200
call fcn.140021460
mov rcx, qword [0x1401bb6b8]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x14
jb 0x1400a62f7
cmp qword [0x1401bb6c0], 0xf
lea rax, [0x1401bb6a8]
movzx edx, byte [rsp + 0x90]
lea r9, str.actioninput_ntext_
cmova rax, qword [0x1401bb6a8]
lea r8, [0x1401bb6a8]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_sendto
call fcn.140005390
lea rcx, [rsp + 0x40]
call fcn.140054940
mov r13, qword [rsp + 0x70]
add rsp, 0x88
ret
call fcn.140005690
int3
Function at 0x1400a6300
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rax, qword [0x1401bc798]
cmp byte [rax + 0x5fb0], 0
je 0x1400a64df
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rsi, qword [0x1401bb508]
mov qword [r11 - 0x10], r12
mov r12, qword [0x1401bb4f8]
mov qword [r11 - 0x18], r13
lea r13, [0x1401bb4f8]
mov qword [r11 - 0x20], r14
mov r14, qword [0x1401bc5e8]
mov qword [r11 - 0x28], r15
mov rbp, r14
mov r15, qword [0x1401bb510]
mov rbx, qword [r14 + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400a63b6
mov qword [r11 - 8], rdi
nop
mov rdi, qword [rbx + 0x30]
lea rcx, [rbx + 0x20]
cmp r15, 0xf
mov rdx, r13
cmova rdx, r12
cmp qword [rcx + 0x18], 0xf
jbe 0x1400a638d
mov rcx, qword [rcx]
cmp rsi, rdi
mov r8, rdi
cmovb r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a63f0
js 0x1400a63f5
mov rbp, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1400a6370
mov rdi, qword [rsp + 0x80]
cmp byte [rbp + 0x19], 0
jne 0x1400a6400
cmp qword [rbp + 0x38], 0xf
lea rdx, [rbp + 0x20]
mov rbx, qword [rdx + 0x10]
jbe 0x1400a63ce
mov rdx, qword [rdx]
cmp r15, 0xf
mov rcx, r13
mov r8, rsi
cmova rcx, r12
cmp rbx, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a63fb
js 0x1400a6400
jmp 0x1400a6403
cmp rdi, rsi
jae 0x1400a63a2
mov rbx, qword [rbx + 0x10]
jmp 0x1400a63a8
cmp rsi, rbx
jae 0x1400a6403
mov rbp, r14
mov r15, qword [rsp + 0x60]
cmp rbp, r14
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x98]
je 0x1400a64da
mov rdx, r13
lea rcx, [0x1401bc5e8]
call fcn.14009da30
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400a64da
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], reloc.WLDAP32.dll_Ordinal_200
call fcn.140021460
mov rcx, qword [0x1401bb588]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x14
jb 0x1400a64e7
cmp qword [0x1401bb590], 0xf
lea rax, [0x1401bb578]
movzx edx, byte [rsp + 0x90]
lea r9, str.actioninput_ntext_
cmova rax, qword [0x1401bb578]
lea r8, [0x1401bb578]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_sendto
call fcn.140005390
lea rcx, [rsp + 0x40]
call fcn.140054940
mov r13, qword [rsp + 0x70]
add rsp, 0x88
ret
call fcn.140005690
int3
Function at 0x1400a64f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rax, qword [0x1401bc798]
cmp byte [rax + 0x5fb0], 0
je 0x1400a66cf
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rsi, qword [0x1401bb430]
mov qword [r11 - 0x10], r12
mov r12, qword [0x1401bb420]
mov qword [r11 - 0x18], r13
lea r13, [0x1401bb420]
mov qword [r11 - 0x20], r14
mov r14, qword [0x1401bc5e8]
mov qword [r11 - 0x28], r15
mov rbp, r14
mov r15, qword [0x1401bb438]
mov rbx, qword [r14 + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400a65a6
mov qword [r11 - 8], rdi
nop
mov rdi, qword [rbx + 0x30]
lea rcx, [rbx + 0x20]
cmp r15, 0xf
mov rdx, r13
cmova rdx, r12
cmp qword [rcx + 0x18], 0xf
jbe 0x1400a657d
mov rcx, qword [rcx]
cmp rsi, rdi
mov r8, rdi
cmovb r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a65e0
js 0x1400a65e5
mov rbp, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1400a6560
mov rdi, qword [rsp + 0x80]
cmp byte [rbp + 0x19], 0
jne 0x1400a65f0
cmp qword [rbp + 0x38], 0xf
lea rdx, [rbp + 0x20]
mov rbx, qword [rdx + 0x10]
jbe 0x1400a65be
mov rdx, qword [rdx]
cmp r15, 0xf
mov rcx, r13
mov r8, rsi
cmova rcx, r12
cmp rbx, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a65eb
js 0x1400a65f0
jmp 0x1400a65f3
cmp rdi, rsi
jae 0x1400a6592
mov rbx, qword [rbx + 0x10]
jmp 0x1400a6598
cmp rsi, rbx
jae 0x1400a65f3
mov rbp, r14
mov r15, qword [rsp + 0x60]
cmp rbp, r14
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x98]
je 0x1400a66ca
mov rdx, r13
lea rcx, [0x1401bc5e8]
call fcn.14009da30
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400a66ca
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], reloc.WLDAP32.dll_Ordinal_200
call fcn.140021460
mov rcx, qword [0x1401bb470]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x14
jb 0x1400a66d7
cmp qword [0x1401bb478], 0xf
lea rax, [0x1401bb460]
movzx edx, byte [rsp + 0x90]
lea r9, str.actioninput_ntext_
cmova rax, qword [0x1401bb460]
lea r8, [0x1401bb460]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_sendto
call fcn.140005390
lea rcx, [rsp + 0x40]
call fcn.140054940
mov r13, qword [rsp + 0x70]
add rsp, 0x88
ret
call fcn.140005690
int3
Function at 0x1400a66e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rax, qword [0x1401bc798]
cmp byte [rax + 0x5fb0], 0
je 0x1400a68bf
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rsi, qword [0x1401bb368]
mov qword [r11 - 0x10], r12
mov r12, qword [0x1401bb358]
mov qword [r11 - 0x18], r13
lea r13, [0x1401bb358]
mov qword [r11 - 0x20], r14
mov r14, qword [0x1401bc5e8]
mov qword [r11 - 0x28], r15
mov rbp, r14
mov r15, qword [0x1401bb370]
mov rbx, qword [r14 + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400a6796
mov qword [r11 - 8], rdi
nop
mov rdi, qword [rbx + 0x30]
lea rcx, [rbx + 0x20]
cmp r15, 0xf
mov rdx, r13
cmova rdx, r12
cmp qword [rcx + 0x18], 0xf
jbe 0x1400a676d
mov rcx, qword [rcx]
cmp rsi, rdi
mov r8, rdi
cmovb r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a67d0
js 0x1400a67d5
mov rbp, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1400a6750
mov rdi, qword [rsp + 0x80]
cmp byte [rbp + 0x19], 0
jne 0x1400a67e0
cmp qword [rbp + 0x38], 0xf
lea rdx, [rbp + 0x20]
mov rbx, qword [rdx + 0x10]
jbe 0x1400a67ae
mov rdx, qword [rdx]
cmp r15, 0xf
mov rcx, r13
mov r8, rsi
cmova rcx, r12
cmp rbx, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a67db
js 0x1400a67e0
jmp 0x1400a67e3
cmp rdi, rsi
jae 0x1400a6782
mov rbx, qword [rbx + 0x10]
jmp 0x1400a6788
cmp rsi, rbx
jae 0x1400a67e3
mov rbp, r14
mov r15, qword [rsp + 0x60]
cmp rbp, r14
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x98]
je 0x1400a68ba
mov rdx, r13
lea rcx, [0x1401bc5e8]
call fcn.14009da30
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400a68ba
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], reloc.WLDAP32.dll_Ordinal_200
call fcn.140021460
mov rcx, qword [0x1401bb4e8]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x14
jb 0x1400a68c7
cmp qword [0x1401bb4f0], 0xf
lea rax, [0x1401bb4d8]
movzx edx, byte [rsp + 0x90]
lea r9, str.actioninput_ntext_
cmova rax, qword [0x1401bb4d8]
lea r8, [0x1401bb4d8]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_sendto
call fcn.140005390
lea rcx, [rsp + 0x40]
call fcn.140054940
mov r13, qword [rsp + 0x70]
add rsp, 0x88
ret
call fcn.140005690
int3
Function at 0x1400a68d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rax, qword [0x1401bc798]
cmp byte [rax + 0x5fb0], 0
je 0x1400a6aaf
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rsi, qword [0x1401bb280]
mov qword [r11 - 0x10], r12
mov r12, qword [0x1401bb270]
mov qword [r11 - 0x18], r13
lea r13, [0x1401bb270]
mov qword [r11 - 0x20], r14
mov r14, qword [0x1401bc5e8]
mov qword [r11 - 0x28], r15
mov rbp, r14
mov r15, qword [0x1401bb288]
mov rbx, qword [r14 + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400a6986
mov qword [r11 - 8], rdi
nop
mov rdi, qword [rbx + 0x30]
lea rcx, [rbx + 0x20]
cmp r15, 0xf
mov rdx, r13
cmova rdx, r12
cmp qword [rcx + 0x18], 0xf
jbe 0x1400a695d
mov rcx, qword [rcx]
cmp rsi, rdi
mov r8, rdi
cmovb r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a69c0
js 0x1400a69c5
mov rbp, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1400a6940
mov rdi, qword [rsp + 0x80]
cmp byte [rbp + 0x19], 0
jne 0x1400a69d0
cmp qword [rbp + 0x38], 0xf
lea rdx, [rbp + 0x20]
mov rbx, qword [rdx + 0x10]
jbe 0x1400a699e
mov rdx, qword [rdx]
cmp r15, 0xf
mov rcx, r13
mov r8, rsi
cmova rcx, r12
cmp rbx, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a69cb
js 0x1400a69d0
jmp 0x1400a69d3
cmp rdi, rsi
jae 0x1400a6972
mov rbx, qword [rbx + 0x10]
jmp 0x1400a6978
cmp rsi, rbx
jae 0x1400a69d3
mov rbp, r14
mov r15, qword [rsp + 0x60]
cmp rbp, r14
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x98]
je 0x1400a6aaa
mov rdx, r13
lea rcx, [0x1401bc5e8]
call fcn.14009da30
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400a6aaa
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], reloc.WLDAP32.dll_Ordinal_200
call fcn.140021460
mov rcx, qword [0x1401bb3c8]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x14
jb 0x1400a6ab7
cmp qword [0x1401bb3d0], 0xf
lea rax, [0x1401bb3b8]
movzx edx, byte [rsp + 0x90]
lea r9, str.actioninput_ntext_
cmova rax, qword [0x1401bb3b8]
lea r8, [0x1401bb3b8]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_sendto
call fcn.140005390
lea rcx, [rsp + 0x40]
call fcn.140054940
mov r13, qword [rsp + 0x70]
add rsp, 0x88
ret
call fcn.140005690
int3
Function at 0x1400a6ac0
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rax, qword [0x1401bc798]
cmp byte [rax + 0x5fb0], 0
je 0x1400a6c9f
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rsi, qword [0x1401bb698]
mov qword [r11 - 0x10], r12
mov r12, qword [0x1401bb688]
mov qword [r11 - 0x18], r13
lea r13, [0x1401bb688]
mov qword [r11 - 0x20], r14
mov r14, qword [0x1401bc5e8]
mov qword [r11 - 0x28], r15
mov rbp, r14
mov r15, qword [0x1401bb6a0]
mov rbx, qword [r14 + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400a6b76
mov qword [r11 - 8], rdi
nop
mov rdi, qword [rbx + 0x30]
lea rcx, [rbx + 0x20]
cmp r15, 0xf
mov rdx, r13
cmova rdx, r12
cmp qword [rcx + 0x18], 0xf
jbe 0x1400a6b4d
mov rcx, qword [rcx]
cmp rsi, rdi
mov r8, rdi
cmovb r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a6bb0
js 0x1400a6bb5
mov rbp, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1400a6b30
mov rdi, qword [rsp + 0x80]
cmp byte [rbp + 0x19], 0
jne 0x1400a6bc0
cmp qword [rbp + 0x38], 0xf
lea rdx, [rbp + 0x20]
mov rbx, qword [rdx + 0x10]
jbe 0x1400a6b8e
mov rdx, qword [rdx]
cmp r15, 0xf
mov rcx, r13
mov r8, rsi
cmova rcx, r12
cmp rbx, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a6bbb
js 0x1400a6bc0
jmp 0x1400a6bc3
cmp rdi, rsi
jae 0x1400a6b62
mov rbx, qword [rbx + 0x10]
jmp 0x1400a6b68
cmp rsi, rbx
jae 0x1400a6bc3
mov rbp, r14
mov r15, qword [rsp + 0x60]
cmp rbp, r14
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x98]
je 0x1400a6c9a
mov rdx, r13
lea rcx, [0x1401bc5e8]
call fcn.14009da30
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400a6c9a
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], reloc.WLDAP32.dll_Ordinal_200
call fcn.140021460
mov rcx, qword [0x1401bb640]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x14
jb 0x1400a6ca7
cmp qword [0x1401bb648], 0xf
lea rax, [0x1401bb630]
movzx edx, byte [rsp + 0x90]
lea r9, str.actioninput_ntext_
cmova rax, qword [0x1401bb630]
lea r8, [0x1401bb630]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_sendto
call fcn.140005390
lea rcx, [rsp + 0x40]
call fcn.140054940
mov r13, qword [rsp + 0x70]
add rsp, 0x88
ret
call fcn.140005690
int3
Function at 0x1400a6cb0
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rax, qword [0x1401bc798]
cmp byte [rax + 0x5fb0], 0
je 0x1400a6e8f
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rsi, qword [0x1401bb320]
mov qword [r11 - 0x10], r12
mov r12, qword [0x1401bb310]
mov qword [r11 - 0x18], r13
lea r13, [0x1401bb310]
mov qword [r11 - 0x20], r14
mov r14, qword [0x1401bc5e8]
mov qword [r11 - 0x28], r15
mov rbp, r14
mov r15, qword [0x1401bb328]
mov rbx, qword [r14 + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400a6d66
mov qword [r11 - 8], rdi
nop
mov rdi, qword [rbx + 0x30]
lea rcx, [rbx + 0x20]
cmp r15, 0xf
mov rdx, r13
cmova rdx, r12
cmp qword [rcx + 0x18], 0xf
jbe 0x1400a6d3d
mov rcx, qword [rcx]
cmp rsi, rdi
mov r8, rdi
cmovb r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a6da0
js 0x1400a6da5
mov rbp, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1400a6d20
mov rdi, qword [rsp + 0x80]
cmp byte [rbp + 0x19], 0
jne 0x1400a6db0
cmp qword [rbp + 0x38], 0xf
lea rdx, [rbp + 0x20]
mov rbx, qword [rdx + 0x10]
jbe 0x1400a6d7e
mov rdx, qword [rdx]
cmp r15, 0xf
mov rcx, r13
mov r8, rsi
cmova rcx, r12
cmp rbx, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a6dab
js 0x1400a6db0
jmp 0x1400a6db3
cmp rdi, rsi
jae 0x1400a6d52
mov rbx, qword [rbx + 0x10]
jmp 0x1400a6d58
cmp rsi, rbx
jae 0x1400a6db3
mov rbp, r14
mov r15, qword [rsp + 0x60]
cmp rbp, r14
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x98]
je 0x1400a6e8a
mov rdx, r13
lea rcx, [0x1401bc5e8]
call fcn.14009da30
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400a6e8a
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], reloc.WLDAP32.dll_Ordinal_200
call fcn.140021460
mov rcx, qword [0x1401bb300]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x14
jb 0x1400a6e97
cmp qword [0x1401bb308], 0xf
lea rax, [0x1401bb2f0]
movzx edx, byte [rsp + 0x90]
lea r9, str.actioninput_ntext_
cmova rax, qword [0x1401bb2f0]
lea r8, [0x1401bb2f0]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_sendto
call fcn.140005390
lea rcx, [rsp + 0x40]
call fcn.140054940
mov r13, qword [rsp + 0x70]
add rsp, 0x88
ret
call fcn.140005690
int3