joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000cec0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000cf0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000cf0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000cf0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000cf0a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000cf0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000cf0c
xor al, al
add rsp, 0x28
ret

Function at 0x14000fbd4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fc43
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fc43
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fc43
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fc43
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fc43
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fc43
cmp dword [rcx + 0xf8], 0
je 0x14000fc43
mov ecx, ebx
call fcn.14000fcf4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000fad0
nop
cmp dword [rbp + 0x20], 0
je 0x14000fc91
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000fc9c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000fbd4

Function at 0x14000fdd8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fc43
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fc43
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fc43
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fc43
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fc43
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fc43
cmp dword [rcx + 0xf8], 0
je 0x14000fc43
mov ecx, ebx
call fcn.14000fcf4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000fad0
nop
cmp dword [rbp + 0x20], 0
je 0x14000fc91
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000fc9c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000fbd4
Function at 0x1400193c4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001944b
mov rsi, rbx
cmp word [rax], bp
je 0x14001940a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400193f4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400193f0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140016bf4
mov rdi, rax
test rax, rax
je 0x140019438
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140020630
mov rbp, rdi
xor ecx, ecx
call fcn.140015c18
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001ba14
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001ba2a
mov al, 1
jmp 0x14001ba8a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001ba3b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001ba88
mov ecx, dword [rcx + 0x18]
nop
call fcn.140019b68
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001ba88
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001ba88
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001ba88
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001ba8a
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001fea0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001fec8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001fec8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140059520
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x1400e8350]
mov ecx, dword [0x1400e040c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005955d
lea rcx, [0x1400e8348]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14004c6d0
lea rcx, [0x1400e8350]
call fcn.14005ac00
cmp dword [0x1400e8350], 0xffffffff
jne 0x140059549
mov qword [0x1400e8348], 0
lea rcx, [0x1400e8348]
xor edx, edx
call fcn.14002cb70
lea rcx, [0x1400e8350]
call fcn.14005ac98
jmp 0x140059549

Function at 0x14005a710
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1400e8360]
mov ecx, dword [0x1400e040c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005a7b2
lea rcx, [0x1400e8358]
xor edx, edx
call fcn.14004c6d0
mov eax, dword [0x1400e8370]
mov ecx, dword [0x1400e040c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005a776
lea rcx, [0x1400e8370]
call fcn.14005ac00
cmp dword [0x1400e8370], 0xffffffff
lea rcx, [0x1400e8360]
call fcn.14005ac00
cmp dword [0x1400e8360], 0xffffffff
jne 0x14005a735
mov qword [0x1400e8358], 0
lea rcx, [0x1400e8358]
xor edx, edx
call fcn.14002cb70
lea rcx, [0x1400e8360]
call fcn.14005ac98
jmp 0x14005a735

Function at 0x140066e8c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140066fbc
Function at 0x140b3e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140b3e1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140b3e089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b3e06f
add dl, dl
jne 0x140b3e096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b3e0f6
xor eax, eax
add dl, dl
jne 0x140b3e0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b3e1ad
add dl, dl
jne 0x140b3e0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b3e0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b3e0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b3e0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140b3e0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140b3e07e
mov eax, 1
add dl, dl
jne 0x140b3e106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b3e113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b3e0fb
sub eax, ebx
mov ebx, 1
jne 0x140b3e14c
mov ecx, 1
add dl, dl
jne 0x140b3e12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b3e13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b3e123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b3e07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140b3e168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b3e175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b3e15d
cmp eax, 0x7d00
jae 0x140b3e19b
cmp eax, 0x500
jb 0x140b3e196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b3e07e
cmp eax, 0x7f
ja 0x140b3e19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b3e07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140b3e1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140b3e07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400296e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.14002a200
nop
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x14002f4b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x14002f4d3
mov rcx, qword [rsp + 0x40]
call fcn.14002f590
nop
jmp 0x14002f4eb
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x14002f4eb
mov rcx, qword [rsp + 0x40]
call fcn.14002f640
nop
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x14002f590
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x14002f5b1
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x14002f635
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x14002f600
mov dword [rsp + 4], 0x9908b0df
jmp 0x14002f608
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14002f5a4
add rsp, 0x18
ret
Function at 0x14002f640
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x14002f670
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x14002f6f2
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x14002f6be
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x14002f6c6
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14002f665
mov qword [rsp + 8], 0xe3
jmp 0x14002f70a
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x14002f791
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x14002f75b
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x14002f763
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14002f6fd
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x14002f7e5
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x14002f7ed
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x140031c60
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
movss dword [rsp + 0x20], xmm3
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140031c96
mov rax, qword [rsp + 0x38]
mov byte [rax], 1
jmp 0x140031cfb
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
test eax, eax
je 0x140031cfb
xor edx, edx
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov r8d, 8
movzx edx, al
movzx ecx, byte [rsp + 0x40]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov r8d, 2
movzx edx, al
movzx ecx, byte [rsp + 0x40]
call qword [sym.imp.USER32.dll_keybd_event]
mov rax, qword [rsp + 0x38]
mov byte [rax], 0
add rsp, 0x28
ret

Function at 0x140031d30
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x48
movzx eax, byte [0x140240308]
test eax, eax
jne 0x140031d41
jmp 0x140031d93
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.https:__discord.com_invite_VgRrxwesPz
lea rdx, [0x140139340]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movzx eax, byte [0x140240308]
test eax, eax
jne 0x140031d80
mov dword [rsp + 0x30], 1
jmp 0x140031d88
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
mov byte [0x140240308], al
add rsp, 0x48
ret

Function at 0x140031da0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x48
movzx eax, byte [0x140240310]
test eax, eax
jne 0x140031db1
jmp 0x140031e03
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.https:__github.com_CowNowK_AimStar
lea rdx, [0x14013936c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movzx eax, byte [0x140240310]
test eax, eax
jne 0x140031df0
mov dword [rsp + 0x30], 1
jmp 0x140031df8
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
mov byte [0x140240310], al
add rsp, 0x48
ret
Function at 0x140031e10
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
movzx eax, byte [0x140240318]
test eax, eax
jne 0x140031e24
jmp 0x14003207c
mov dword [rsp + 0x24], 0x20
movss xmm0, dword [0x140166848]
call fcn.14005ce70
nop
xorps xmm2, xmm2
movss xmm1, dword [0x140166cb8]
lea rcx, [rsp + 0x28]
call fcn.14000ce50
xor edx, edx
mov rcx, rax
call fcn.14005cd60
nop
mov r8d, dword [rsp + 0x24]
xor edx, edx
lea rcx, str.Cheats_List
call fcn.140057c10
nop
movzx eax, byte [0x14023ffa9]
test eax, eax
je 0x140031ea2
movzx eax, byte [0x14023ffb6]
test eax, eax
jne 0x140031e95
mov ecx, dword [0x1401ca3f4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140031ea2
lea rcx, str.Aimbot__Toggle_
call fcn.14009cc10
nop
movzx edx, byte [0x14023ffb5]
lea rcx, [0x140139398]
call fcn.140031be0
movzx edx, byte [0x140240307]
lea rcx, [0x1401393a4]
call fcn.140031be0
movzx edx, byte [0x14024031d]
lea rcx, [0x1401393b0]
call fcn.140031be0
movzx edx, byte [0x14023ff8b]
lea rcx, str.Crosshair
call fcn.140031be0
movzx edx, byte [0x140240319]
lea rcx, [0x1401393d0]
call fcn.140031be0
movzx edx, byte [0x1401793c1]
lea rcx, [0x1401393e0]
call fcn.140031be0
movzx edx, byte [0x140240321]
lea rcx, str.External_Radar
call fcn.140031be0
movzx edx, byte [0x140240306]
lea rcx, [0x1401393f8]
call fcn.140031be0
movzx edx, byte [0x14024031f]
lea rcx, [0x140139408]
call fcn.140031be0
nop
movss xmm0, dword [0x140240300]
ucomiss xmm0, dword [0x140166720]
je 0x140031f6c
lea rcx, str.Flash_Immunity
call fcn.14009cc10
nop
movzx edx, byte [0x14024031a]
lea rcx, [0x140139428]
call fcn.140031be0
nop
cmp dword [0x1401ca3d4], 0x5a
je 0x140031f96
lea rcx, str.Fov_Changer
call fcn.14009cc10
nop
movzx edx, byte [0x14023ffa1]
lea rcx, [0x140139448]
call fcn.140031be0
cmp dword [0x140240314], 0
je 0x140031fb9
mov byte [rsp + 0x20], 1
jmp 0x140031fbe
mov byte [rsp + 0x20], 0
movzx edx, byte [rsp + 0x20]
lea rcx, str.HitSound
call fcn.140031be0
movzx edx, byte [0x140240309]
lea rcx, str.Money_Service
call fcn.140031be0
movzx edx, byte [0x1402402fc]
lea rcx, [0x140139478]
call fcn.140031be0
movzx edx, byte [0x140240341]
lea rcx, [0x140139488]
call fcn.140031be0
movzx edx, byte [0x14023ffa8]
lea rcx, [0x140139494]
call fcn.140031be0
movzx edx, byte [0x14024031c]
lea rcx, [0x140139498]
call fcn.140031be0
movzx edx, byte [0x14024031b]
lea rcx, [0x1401394a8]
call fcn.140031be0
nop
movzx eax, byte [0x14023ff98]
test eax, eax
je 0x140032076
movzx eax, byte [0x14023ffa2]
test eax, eax
jne 0x140032069
mov ecx, dword [0x14023ffb8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140032076
lea rcx, str.TriggerBot__Toggle_
call fcn.14009cc10
nop
call fcn.14005b680
nop
add rsp, 0x38
ret
Function at 0x140032410
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
movzx eax, byte [0x14024031f]
test eax, eax
jne 0x140032424
jmp 0x1400324d2
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14003243e
jmp 0x1400324d2
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140032455
jmp 0x1400324d2
movss xmm3, dword [0x140166c24]
mov r8d, 0x44
lea rdx, [0x14023dcfe]
mov ecx, 0x41
call fcn.140031c60
movss xmm3, dword [0x140166c24]
mov r8d, 0x41
lea rdx, [0x14023dd1c]
mov ecx, 0x44
call fcn.140031c60
movss xmm3, dword [0x140166c24]
mov r8d, 0x53
lea rdx, [0x14023dcff]
mov ecx, 0x57
call fcn.140031c60
movss xmm3, dword [0x140166c24]
mov r8d, 0x57
lea rdx, [0x14023dcfd]
mov ecx, 0x53
call fcn.140031c60
nop
add rsp, 0x28
ret

Function at 0x140032ef0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140179340]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, byte [0x140240307]
test eax, eax
jne 0x140032f18
jmp 0x140032fee
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140032f2f
mov byte [rsp + 0x21], 1
jmp 0x140032f34
mov byte [rsp + 0x21], 0
movzx eax, byte [rsp + 0x21]
mov byte [rsp + 0x20], al
mov rcx, qword [rsp + 0x50]
call fcn.14000edc0
mov byte [rsp + 0x22], al
lea rdx, [rsp + 0x30]
lea rcx, [0x140240550]
call fcn.140036d00
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140032fa3
movzx eax, byte [rsp + 0x22]
test eax, eax
je 0x140032fa3
mov dword [rsp + 0x24], 0x11
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x28]
call fcn.140026fa0
mov rcx, rax
call fcn.140026fc0
nop
mov edx, 0x10001
lea rcx, [0x140240550]
call fcn.140036cc0
nop
jmp 0x140032fee
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140032fc9
movzx eax, byte [rsp + 0x22]
test eax, eax
jne 0x140032fc9
mov edx, 0x100
lea rcx, [0x140240550]
call fcn.140036cc0
nop
jmp 0x140032fee
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140032fee
cmp dword [rsp + 0x30], 0x10001
jne 0x140032fee
mov edx, 0x100
lea rcx, [0x140240550]
call fcn.140036cc0
nop
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140125580
add rsp, 0x48
ret
Function at 0x140036700
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x4d0
lea rbp, [rsp + 0x20]
mov rax, qword [0x140179340]
xor rax, rbp
mov qword [rbp + 0x4a0], rax
mov dword [rbp + 0x60], 0x438
mov rax, qword [rbp + 0x4c0]
mov edx, dword [rax + 0x10]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
call fcn.140036660
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x90]
mov qword [rbp + 0x20], rax
cmp qword [rbp + 0x20], 0
jne 0x14003677d
mov qword [rbp + 0x30], 0
jmp 0x14003681b
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 8]
cmp word [rax + rcx*2], 0
jne 0x14003678d
mov rax, qword [rbp + 8]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x1400367bc
mov qword [rbp + 0x28], 0
jmp 0x140036813
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x40], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x1400367e4
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.1401268a0
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x40]
mov r8d, ecx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call fcn.140036670
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x30], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.140024d60
mov rcx, qword [rbp + 0x30]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x140036841
inc rcx
test dl, dl
jne 0x14003682e
xor eax, eax
jmp 0x140036846
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140036872
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.1400099b0
mov rax, qword [rbp + 0x48]
jmp 0x1400368ab
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x14003675e
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov qword [rbp + 0x50], 0
mov rcx, qword [rbp + 0x4c8]
call fcn.1400099b0
mov rax, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x4a0]
xor rcx, rbp
call fcn.140125580
lea rsp, [rbp + 0x4b0]
pop rbp
ret