joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180071210
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x180071235
cvtsi2ss xmm0, rdx
jmp 0x18007124a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x180304644]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x180071278
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x180071278
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1800712aa
cmp rbx, 0x200
jae 0x1800712a7
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1800712aa
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18006f000
Function at 0x18007f7c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x18007f821
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x18007f7e0
mov ecx, dword [r9]
jmp 0x18007f90b
cmp ecx, 0x4e0
jb 0x18007f90b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x18007f840
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x18007f890
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x180082650
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1800826da
cmp byte [0x180318057], 0
jne 0x180082697
mov byte [0x180318057], 1
lea rcx, [rsp + 0x58]
call fcn.180081bf0
mov rcx, qword [rax]
mov qword [0x180318058], rcx
cmp byte [0x180318057], 0
je 0x1800826e1
lea rcx, [rsp + 0x58]
call fcn.180081bf0
mov rcx, qword [rsp + 0x58]
sub rcx, qword [0x180318058]
movabs rax, 0x431bde82d7b634db
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rax, dword [0x1803150bc]
cmp rdx, rax
jl 0x18008285d
jmp 0x1800826e1
mov byte [0x180318057], 0
cmp byte [0x18031803d], 0
je 0x18008285d
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18008285d
mov rdi, qword [0x180319a50]
cmp qword [rdi + 8], 0
je 0x18008285d
mov rbx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x14
lea rdx, str.rightClickDelayTimer
lea rcx, [rsp + 0x20]
call fcn.180005bc0
nop
lea rdx, [rsp + 0x20]
lea rcx, [0x180318170]
call fcn.18006db30
mov r8, qword [rbx]
mov r9, qword [r8 + 0x320]
mov r8, rax
mov rdx, qword [rdi + 8]
mov rcx, rbx
call r9
mov ebx, eax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1800827aa
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800827a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800827a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18009eb84
cmp ebx, 4
jne 0x18008285d
mov rdi, qword [0x180319a50]
cmp qword [rdi + 8], 0
je 0x18008285d
mov rbx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x14
lea rdx, str.rightClickDelayTimer
lea rcx, [rsp + 0x20]
call fcn.180005bc0
nop
lea rdx, [rsp + 0x20]
lea rcx, [0x180318170]
call fcn.18006db30
mov r8, qword [rbx]
mov r10, qword [r8 + 0x368]
xor r9d, r9d
mov r8, rax
mov rdx, qword [rdi + 8]
mov rcx, rbx
call r10
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x18008285d
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180082858
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180082858
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18009eb84
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180084dc0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x180084de8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x180084e0e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180084e10
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180084e69
test ecx, ecx
jle 0x180084e49
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180084e69
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180084e69
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x180084e90
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180084eb2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x180084ec8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180084ee4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180084ee6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180084f22
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180084fbe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x180084f5d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x180084f9e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x180084fbe
cmp rbx, rax
ja 0x180084f70
test rbx, rbx
je 0x180084fbe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x180085420
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180315040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18008544d
xor eax, eax
jmp 0x1800855b9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180085487
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180085487
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1800855b9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1800855ac
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1800854ca
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1800854f5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800855b1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180085564
sub eax, 1
je 0x180085564
cmp eax, 2
jne 0x1800855ac
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800855b1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180085592
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1800855ac
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1800855b1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18009e5c0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1800859e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180315040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180085ab3
cmp byte [rcx + 0x71], 0
je 0x180085ab3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180085aaf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180085a74
sub eax, 1
je 0x180085a78
cmp eax, 2
jne 0x180085aaf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18009e5c0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180085aa6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180085aaf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180085a5c
xor al, al
jmp 0x180085a5c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18009e5c0
add rsp, 0x60
pop rbx
ret
Function at 0x18008b7f0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180315040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18008b864
cmp byte [0x180318091], 0
jne 0x18008b840
lea rcx, [rsp + 0x20]
mov byte [0x180318091], 1
call fcn.180081bf0
cmp byte [0x180318091], 0
mov rcx, qword [rax]
mov qword [0x180318098], rcx
je 0x18008b86b
lea rcx, [rsp + 0x30]
call fcn.180081bf0
mov rax, qword [rsp + 0x30]
sub rax, qword [0x180318098]
cmp rax, 0xa21fe80
jl 0x18008b9b3
jmp 0x18008b86b
mov byte [0x180318091], 0
cmp byte [0x180318051], 0
je 0x18008b9b3
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18008b9b3
mov ecx, dword [0x1803165d4]
mov rax, qword gs:[0x58]
mov edx, 4
mov qword [rsp + 0x40], rbx
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x180319c78], ecx
jle 0x18008b8e1
lea rcx, [0x180319c78]
call fcn.18009e688
cmp dword [0x180319c78], 0xffffffff
jne 0x18008b8e1
lea rcx, [0x180319c70]
call fcn.180081bf0
lea rcx, [0x180319c78]
call fcn.18009e61c
lea rcx, [rsp + 0x20]
call fcn.180081bf0
cvttss2si eax, dword [0x1803150e4]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], eax
cvttss2si eax, dword [0x1803150cc]
mov dword [rsp + 0x34], eax
call fcn.18007f550
mov rbx, qword [rsp + 0x20]
mov ecx, eax
mov eax, 0x3e8
cdq
idiv ecx
mov rcx, rbx
sub rcx, qword [0x180319c70]
movsxd r8, eax
movabs rax, 0x431bde82d7b634db
imul rcx
sar rdx, 0x12
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
cmp rdx, r8
je 0x18008b94b
jl 0x18008b9ae
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
movzx r9d, word [rsp + 0x2c]
mov edx, 0x204
movzx eax, word [rsp + 0x28]
mov r8d, 2
mov rcx, qword [0x180318028]
shl r9d, 0x10
or r9, rax
call qword [sym.imp.USER32.dll_PostMessageA]
movzx r9d, word [rsp + 0x2c]
xor r8d, r8d
movzx eax, word [rsp + 0x28]
mov edx, 0x205
mov rcx, qword [0x180318028]
shl r9d, 0x10
or r9, rax
call qword [sym.imp.USER32.dll_PostMessageA]
mov qword [0x180319c70], rbx
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18009e5c0
add rsp, 0x48
ret
Function at 0x18008ba40
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
cmp byte [0x180318054], 0
mov rbx, r8
mov rdi, rcx
je 0x18008bb34
mov ecx, 0x5a
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18008bb34
mov rcx, rbx
call fcn.1800623d0
test al, al
je 0x18008bb34
movaps xmmword [rsp + 0x70], xmm6
lea rdx, [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm7
mov rcx, rbx
movaps xmmword [rsp + 0x50], xmm8
call fcn.1800620b0
movss xmm7, dword [rdi + 0x20]
lea rdx, [rsp + 0x20]
mov rcx, rbx
cvtps2pd xmm7, xmm7
call fcn.180061f10
movsd xmm0, qword [rax + 8]
movsd xmm8, qword [rax]
mulsd xmm0, qword [0x180304468]
mulsd xmm8, qword [0x180304468]
call sub.api_ms_win_crt_math_l1_1_0.dll_cos
movaps xmm6, xmm0
movaps xmm0, xmm8
mulsd xmm6, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sin
movsd xmm1, qword [rsp + 0x30]
mulsd xmm0, xmm6
subsd xmm1, xmm0
movaps xmm0, xmm8
movsd qword [rsp + 0x30], xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_cos
movsd xmm1, qword [rsp + 0x40]
lea rdx, [rsp + 0x30]
mulsd xmm0, xmm6
mov rcx, rbx
addsd xmm1, xmm0
movsd qword [rsp + 0x40], xmm1
call fcn.1800629c0
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x70]
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret

Function at 0x18008bd90
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180315040]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [0x180318050], 0
je 0x18008beee
mov ecx, 0x46
mov qword [rsp + 0x40], rbx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
shr ebx, 0xf
and bl, 1
cmp qword [0x180318028], 0
je 0x18008bee3
cmp byte [0x180318050], 0
je 0x18008bee3
test bl, bl
je 0x18008bee3
cmp byte [0x1803180a0], 0
jne 0x18008bee3
cmp byte [0x1803180a1], 0
sete al
mov byte [0x1803180a1], al
test al, al
je 0x18008bee3
movzx ecx, word [0x18031514c]
mov edx, dword [0x1803150e0]
add cx, 0x30
call fcn.18008bcf0
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
movzx r9d, word [rsp + 0x2c]
mov edx, 0x204
movzx eax, word [rsp + 0x28]
mov r8d, 2
mov rcx, qword [0x180318028]
shl r9d, 0x10
or r9, rax
call qword [sym.imp.USER32.dll_PostMessageA]
movsxd rax, dword [0x1803150ec]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.180083e10
movzx r9d, word [rsp + 0x2c]
xor r8d, r8d
movzx eax, word [rsp + 0x28]
mov edx, 0x205
mov rcx, qword [0x180318028]
shl r9d, 0x10
or r9, rax
call qword [sym.imp.USER32.dll_PostMessageA]
movsxd rax, dword [0x1803150ec]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.180083e10
mov ecx, 0x31
lea edx, [rcx - 0x2c]
call fcn.18008bcf0
mov eax, dword [0x18031514c]
inc eax
mov dword [0x18031514c], eax
cmp eax, 8
jle 0x18008bed9
mov dword [0x18031514c], 3
mov dword [0x180315150], 1
mov byte [0x1803180a0], bl
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18009e5c0
add rsp, 0x48
ret
Function at 0x18008c140
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
cmp byte [0x180318054], 0
mov rdi, r8
mov rbx, rcx
je 0x18008c275
lea rdx, [rsp + 0x30]
mov rcx, r8
call fcn.1800620b0
mov ecx, 0x5a
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18008c217
movaps xmmword [rsp + 0x70], xmm6
lea rdx, [rsp + 0x20]
movaps xmmword [rsp + 0x60], xmm7
mov rcx, rdi
movss xmm7, dword [rbx + 0x20]
cvtps2pd xmm7, xmm7
movaps xmmword [rsp + 0x50], xmm8
call fcn.180061f10
movsd xmm0, qword [rax + 8]
movsd xmm8, qword [rax]
mulsd xmm0, qword [0x180304468]
mulsd xmm8, qword [0x180304468]
call sub.api_ms_win_crt_math_l1_1_0.dll_cos
movaps xmm6, xmm0
movaps xmm0, xmm8
mulsd xmm6, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sin
movsd xmm1, qword [rsp + 0x30]
mulsd xmm0, xmm6
subsd xmm1, xmm0
movaps xmm0, xmm8
movsd qword [rsp + 0x30], xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_cos
movsd xmm1, qword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
mulsd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x70]
addsd xmm1, xmm0
movsd qword [rsp + 0x40], xmm1
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18008c231
movss xmm0, dword [rbx + 0x20]
cvtps2pd xmm0, xmm0
jmp 0x18008c256
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18008c253
movss xmm0, dword [rbx + 0x20]
xorps xmm0, xmmword [0x180304860]
cvtss2sd xmm0, xmm0
jmp 0x18008c256
xorps xmm0, xmm0
mov rcx, rdi
movsd qword [rsp + 0x38], xmm0
call fcn.1800623d0
test al, al
jne 0x18008c275
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1800629c0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x180090440
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x180315040]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor esi, esi
call fcn.18006a1c0
call fcn.180089bd0
mov rbx, qword [0x180319a50]
test rbx, rbx
je 0x18009048b
mov rcx, rbx
call fcn.1800906e0
mov edx, 0xf8
mov rcx, rbx
call fcn.18009eb84
mov qword [0x180319a50], rsi
mov rcx, qword [0x180316600]
test rcx, rcx
je 0x1800904d2
call fcn.18006b5b0
mov rdi, qword [rax + 0x10]
mov rbx, qword [rdi]
nop word [rax + rax]
cmp rbx, rdi
je 0x1800904d2
mov rcx, qword [0x180316600]
mov rax, qword [rcx]
mov r8, qword [rax + 0xb0]
mov rdx, qword [rbx + 0x30]
call r8
mov rbx, qword [rbx]
jmp 0x1800904b0
mov rcx, qword [0x180318008]
test rcx, rcx
je 0x1800904ea
mov rax, qword [rcx]
mov rdx, qword [rax + 0x3f0]
call rdx
call fcn.180069170
mov rcx, qword [0x180316820]
test rcx, rcx
je 0x180090501
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [0x180316830]
test rcx, rcx
je 0x180090513
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [0x180316828]
test rcx, rcx
je 0x180090525
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rcx, qword [0x180317fd0]
test rcx, rcx
je 0x18009053c
call fcn.180090620
mov rcx, qword [0x180317fc0]
test rcx, rcx
je 0x18009054d
call fcn.180090620
cmp qword [0x180317f40], 0
je 0x180090563
lea rcx, [0x180317f40]
call fcn.1800911b0
mov qword [0x180316600], rsi
mov ecx, 0x10
call fcn.18009e700
mov r9, rax
mov rax, qword [0x1803180b8]
mov qword [r9], rax
mov qword [rsp + 0x50], r9
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
lea r8, [0x180091180]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180090606
cmp dword [rsp + 0x38], 0
jne 0x1800905c1
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x1800905e7
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18009e5c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov dword [rsp + 0x38], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
jmp 0x1800905e7
Function at 0x180090620
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180315040]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx], 0
mov rbx, rcx
jne 0x1800906b5
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], 0
cmp byte [rcx], 0xe9
jne 0x180090691
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180090691
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
call sub.VCRUNTIME140.dll_memcpy
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbx + 0x20]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, 0x38
mov rcx, rbx
call fcn.18009eb84
mov rax, rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18009e5c0
add rsp, 0x30
pop rbx
ret