joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016580
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011640
movzx eax, al
test eax, eax
jne 0x1400165a0
mov ecx, 7
call fcn.14001151e
nop
mov byte [rsp + 0x20], 0
call fcn.14001155a
mov byte [rsp + 0x21], al
cmp dword [0x140023b78], 1
jne 0x1400165c4
mov ecx, 7
call fcn.14001151e
nop
jmp 0x14001661c
cmp dword [0x140023b78], 0
jne 0x140016617
mov dword [0x140023b78], 1
lea rdx, [0x14001e660]
lea rcx, [0x14001e330]
call fcn.1400112c1
test eax, eax
je 0x1400165f8
mov eax, 0xff
jmp 0x140016721
lea rdx, [0x14001e220]
lea rcx, [section..rdata]
call fcn.140011546
mov dword [0x140023b78], 2
jmp 0x14001661c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011505
call fcn.14001145b
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140016679
mov rcx, qword [rsp + 0x30]
call fcn.14001122b
movzx eax, al
test eax, eax
je 0x140016679
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14002a020]
nop
call fcn.1400114a6
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400166ad
mov rcx, qword [rsp + 0x38]
call fcn.14001122b
movzx eax, al
test eax, eax
je 0x1400166ad
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400115e6
nop
call fcn.1400167d0
mov dword [rsp + 0x28], eax
call fcn.140011433
movzx eax, al
test eax, eax
jne 0x1400166cc
mov ecx, dword [rsp + 0x28]
call fcn.140011069
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400166db
call fcn.1400115f5
nop
xor edx, edx
mov cl, 1
call fcn.140011203
mov eax, dword [rsp + 0x28]
jmp 0x140016721
add rsp, 0x68
ret
Function at 0x140036630
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1400aa7a0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x1400366be
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x140036662
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x1400366d0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1400aa7a0]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x1400367d4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x1400367cf
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x1400367a4
cmp qword [rsp + 0x38], 2
jb 0x1400367a4
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400367a4
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400367a4
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140036717
jmp 0x140036866
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x140036866
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x14003683c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14003683c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14003683c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x1400367d4
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x140050800
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss dword [rsp + 0x20], xmm3
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, qword [rsp + 0x80]
call fcn.140002e00
nop
mov eax, dword [rsp + 0x88]
and eax, 1
test eax, eax
je 0x1400508db
mov edx, dword [rsp + 0x90]
mov ecx, shutdown
call fcn.1400505d0
movss dword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, reloc.WS2_32.dll_send
call fcn.1400505d0
movss xmm1, dword [rsp + 0x20]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x28], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, shutdown
call fcn.1400505d0
movss dword [rsp + 0x24], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, send
call fcn.1400505d0
movss xmm1, dword [rsp + 0x24]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x2c], xmm0
movss xmm2, dword [rsp + 0x28]
movss xmm1, dword [rsp + 0x2c]
lea rcx, [rsp + 0x50]
call fcn.140002e00
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.140031e80
nop
mov eax, dword [rsp + 0x88]
and eax, 2
test eax, eax
je 0x14005098a
mov edx, dword [rsp + 0x90]
mov ecx, 7
call fcn.1400505d0
movss dword [rsp + 0x30], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 6
call fcn.1400505d0
movss xmm1, dword [rsp + 0x30]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x38], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 5
call fcn.1400505d0
movss dword [rsp + 0x34], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 4
call fcn.1400505d0
movss xmm1, dword [rsp + 0x34]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x3c], xmm0
movss xmm2, dword [rsp + 0x38]
movss xmm1, dword [rsp + 0x3c]
lea rcx, [rsp + 0x58]
call fcn.140002e00
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.140031e80
nop
mov eax, dword [rsp + 0x88]
and eax, 4
test eax, eax
je 0x140050a39
mov edx, dword [rsp + 0x90]
mov ecx, 0xb
call fcn.1400505d0
movss dword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 0xa
call fcn.1400505d0
movss xmm1, dword [rsp + 0x40]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x48], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 9
call fcn.1400505d0
movss dword [rsp + 0x44], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 8
call fcn.1400505d0
movss xmm1, dword [rsp + 0x44]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x4c], xmm0
movss xmm2, dword [rsp + 0x48]
movss xmm1, dword [rsp + 0x4c]
lea rcx, [rsp + 0x60]
call fcn.140002e00
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.140031e80
nop
movss xmm0, dword [rsp + 0x98]
ucomiss xmm0, dword [0x1400edf50]
jp 0x140050a4d
je 0x140050a75
mov ecx, 0xe
call fcn.140035500
movzx eax, al
test eax, eax
je 0x140050a75
movss xmm1, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x80]
call fcn.140031e30
nop
movss xmm0, dword [rsp + 0xa0]
ucomiss xmm0, dword [0x1400edf50]
jp 0x140050a89
je 0x140050ab1
mov ecx, send
call fcn.140035500
movzx eax, al
test eax, eax
je 0x140050ab1
movss xmm1, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x80]
call fcn.140031e30
nop
mov rax, qword [rsp + 0x80]
add rsp, 0x78
ret
Function at 0x140063eb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x78
mov rax, qword [0x1400f5aa8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
movzx eax, byte [rsp + 0x88]
test eax, eax
je 0x140063fc9
mov rax, qword [rsp + 0x40]
add rax, 0x2fe0
mov rcx, rax
call fcn.1400667b0
mov qword [rsp + 0x28], rax
jmp 0x140063f20
mov rax, qword [rsp + 0x40]
add rax, 0x2fe0
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
call fcn.140066750
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140063fc9
cmp dword [rsp + 0x80], 0
je 0x140063f51
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x80]
cmp dword [rax + 0x14], ecx
je 0x140063f51
mov dword [rsp + 0x38], 0
jmp 0x140063f59
mov dword [rsp + 0x38], 1
movzx eax, byte [rsp + 0x38]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140063faf
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x14], 0
je 0x140063faf
mov rax, qword [rsp + 0x28]
mov edx, dword [rax + 0x14]
mov rcx, qword [rsp + 0x48]
call fcn.140059bc0
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140063faf
mov rcx, qword [rsp + 0x50]
call fcn.140035590
mov ecx, dword [rsp + 0x80]
cmp dword [rax], ecx
jne 0x140063faf
mov byte [rsp + 0x20], 1
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140063fc4
mov rax, qword [rsp + 0x28]
mov dword [rax + 0x14], 0
jmp 0x140063efc
mov dword [rsp + 0x24], 0
jmp 0x140063fdd
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x1b38]
cmp dword [rsp + 0x24], eax
jge 0x1400640cc
mov rax, qword [rsp + 0x40]
add rax, 0x1b38
mov qword [rsp + 0x68], rax
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x68]
call fcn.140066250
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
cmp dword [rsp + 0x80], 0
je 0x14006407d
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x448], 0
je 0x14006404d
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x448]
call fcn.140035590
mov ecx, dword [rsp + 0x80]
cmp dword [rax], ecx
je 0x14006407d
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x450], 0
je 0x140064073
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x450]
mov ecx, dword [rsp + 0x80]
cmp dword [rax], ecx
je 0x14006407d
mov dword [rsp + 0x3c], 0
jmp 0x140064085
mov dword [rsp + 0x3c], 1
movzx eax, byte [rsp + 0x3c]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x1400640c7
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x458]
mov dword [rsp + 0x58], eax
movzx r8d, byte [rsp + 0x88]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
call fcn.14005b010
nop
movzx eax, byte [rsp + 0x88]
jmp 0x140063fd3
add rsp, 0x78
ret
Function at 0x14008adf0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1400f5040]
xor rax, rsp
mov qword [rsp + 0x60], rax
call fcn.14003b140
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1400f5d38]
call qword [sym.imp.USER32.dll_GetClientRect]
nop
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x54]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm0, eax
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm1, eax
movaps xmm2, xmm0
lea rcx, [rsp + 0x3c]
call fcn.140002e00
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 8], rax
movzx eax, byte [0x1400f50c1]
test eax, eax
je 0x14008ae6a
call fcn.14008adb0
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x1400f5d40]
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, rcx
cvtsi2ss xmm0, rax
cvtsi2ss xmm1, qword [0x1400f5d48]
divss xmm0, xmm1
mov rax, qword [rsp + 0x20]
movss dword [rax + 0x10], xmm0
mov rax, qword [rsp + 0x58]
mov qword [0x1400f5d40], rax
mov ecx, send
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14008aece
mov dword [rsp + 0x28], 1
jmp 0x14008aed6
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x28]
mov byte [rax + 0x134], cl
mov ecx, send
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14008af05
mov dword [rsp + 0x2c], 1
jmp 0x14008af0d
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x2c]
mov byte [rax + 0x135], cl
mov ecx, shutdown
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14008af3c
mov dword [rsp + 0x30], 1
jmp 0x14008af44
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x30]
mov byte [rax + 0x136], cl
mov rax, qword [rsp + 0x20]
mov byte [rax + 0x137], 0
call fcn.14008a370
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0xc8]
test eax, eax
je 0x14008af7f
mov dword [rsp + 0x34], 0xffffffff
jmp 0x14008af88
call fcn.140040d30
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
cmp dword [reloc.WS2_32.dll_htons], eax
je 0x14008afac
mov eax, dword [rsp + 0x38]
mov dword [reloc.WS2_32.dll_htons], eax
call fcn.14008a240
nop
call fcn.14008a580
nop
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14009eff0
add rsp, 0x78
ret
Function at 0x1400993e0
Capabilities:
Execute command

Disassembly:
sub rsp, 0x28
lea rcx, str.start_https:__discord.gg_UJwp3BH69J
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
add rsp, 0x28
ret

Function at 0x140099400
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0x2c0
mov rax, qword [0x1400f5040]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x1a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0xc8]
call fcn.140011e30
nop
mov r8, 0xffffffffffffffff
lea rdx, [0x1400b9ee4]
lea rcx, [rsp + 0xc8]
call fcn.14009bd10
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xc8]
call fcn.14009bcb0
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0xc8]
call fcn.140011d30
lea rcx, [rsp + 0x70]
call fcn.140011cc0
nop
lea rdx, str.St4rInjector.exe
lea rcx, [rsp + 0x108]
call fcn.140011e30
nop
lea r8, [0x1400b9efc]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x90]
call fcn.14009cce0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x108]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0xe8]
call fcn.14009ce00
nop
lea rcx, [rsp + 0x90]
call fcn.140011cc0
nop
lea rax, [rsp + 0xb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rsp + 0x130]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rsp + 0x130], 0x68
mov eax, dword [rsp + 0x16c]
or eax, 1
mov dword [rsp + 0x16c], eax
mov eax, 5
mov word [rsp + 0x170], ax
lea rcx, [rsp + 0xe8]
call fcn.140011890
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x130]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], shutdown
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400995fd
lea rdx, str.Process_started_successfully_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14009ce50
mov qword [rsp + 0x68], rax
lea rdx, [0x14009d230]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x14009960a
lea rcx, str.Could_not_start_the_process.
call fcn.1400993b0
nop
lea rcx, [rsp + 0xe8]
call fcn.140011cc0
nop
lea rcx, [rsp + 0x108]
call fcn.140011cc0
nop
lea rcx, [rsp + 0xc8]
call fcn.140011cc0
nop
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14009eff0
add rsp, 0x2c0
pop rdi
ret
Function at 0x140099f00
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1400f5040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movss xmm0, dword [0x1400ee1a8]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x1400ee130]
movss xmm2, dword [0x1400ee130]
movss xmm1, dword [0x1400ee130]
lea rcx, [rsp + 0x60]
call fcn.140002e40
mov rdx, rax
xor ecx, ecx
call fcn.140037a20
nop
mov rdx, qword [rsp + 0xa0]
lea rcx, [0x1400ba404]
call fcn.14008d490
mov rdx, qword [rsp + 0xa8]
lea rcx, [0x1400ba408]
call fcn.14008d6c0
mov ecx, 1
call fcn.140037ae0
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1400f6760], eax
jle 0x140099fff
lea rcx, [0x1400f6760]
call fcn.14009f0b8
cmp dword [0x1400f6760], 0xffffffff
jne 0x140099fff
mov edx, 0x350
lea rcx, [0x1400f6410]
call fcn.1400062d0
lea rcx, [0x1400f6410]
call fcn.140003490
lea rcx, [0x1400a3080]
call fcn.14009f634
nop
lea rcx, [0x1400f6760]
call fcn.14009f04c
nop
call fcn.14000f8a0
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
lea rcx, [0x1400f6410]
call fcn.140003940
nop
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x40]
call fcn.140011e30
nop
lea rdx, [rsp + 0x40]
lea rcx, [0x1400f6410]
call fcn.1400098d0
nop
lea rcx, [rsp + 0x40]
call fcn.140011cc0
nop
movss xmm0, dword [0x1400ee2f4]
movss dword [rsp + 0x20], xmm0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.14003ffc0
movss xmm0, dword [0x1400ee22c]
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rsp + 0x74]
addss xmm0, dword [0x1400ee22c]
addss xmm0, dword [0x1400ee22c]
movss xmm1, dword [rsp + 0x70]
addss xmm1, dword [0x1400ee22c]
addss xmm1, dword [0x1400ee278]
movaps xmm2, xmm0
lea rcx, [rsp + 0x78]
call fcn.140002e00
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, qword [rsp + 0xa0]
lea rcx, [0x1400f6410]
call fcn.140009780
nop
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14009eff0
add rsp, 0x98
ret
Function at 0x14009a0f0
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x2b8
mov rax, qword [0x1400f5040]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov dword [rsp + 0x24], 0
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x14009a1b4
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14009a1a8
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x38]
call fcn.14009bc10
mov qword [rsp + 0x30], rax
lea rdx, str.RobloxPlayerBeta.exe
mov rcx, qword [rsp + 0x30]
call fcn.14009d2b0
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x38]
call fcn.14009bbe0
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14009a194
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x24], eax
jmp 0x14009a1a8
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14009a14b
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14009eff0
add rsp, 0x2b8
ret

Function at 0x14009a570
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x70]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x30], eax
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, 2
mov rcx, qword [rsp + 0x48]
mul rcx
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call fcn.14009f7c8
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x70]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
nop
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.14009f654
cmp qword [rsp + 0x40], 0
jne 0x14009a63c
mov qword [rsp + 0x58], 0
jmp 0x14009a64f
mov qword [rsp + 0x38], 0x8123
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
add rsp, 0x68
ret
Function at 0x14009ff60
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14009ffaa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14009ffaa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14009ffaa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14009ffaa
cmp dword [rcx + 0x84], 0xe
jbe 0x14009ffaa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14009ffac
xor al, al
add rsp, 0x28
ret
Function at 0x140015a50
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140015a5d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140015a6d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140015a55
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140015a85
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140015a72
sub eax, 3
jb 0x140015a9f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140015ad6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140015ac6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140015ac4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140015ab3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140015a12
jmp 0x140015a5d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x7800
mov dl, 3
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140015b22
cmp rsi, rcx
jae 0x140015b2a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140015b09
cmp al, 0x8f
ja 0x140015b09
cmp byte [rsi - 2], 0xf
je 0x140015b0f
sub al, 0xe8
cmp al, 1
ja 0x140015af3
cmp rsi, rcx
jae 0x140015b2a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140015af9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140015b2a
lodsb al, byte [rsi]
jmp 0x140015b09
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x12000]
mov eax, dword [rdi]
or eax, eax
je 0x140015b87
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x16338]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140015b37
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140015b81
mov qword [rbx], rax
add rbx, 8
jmp 0x140015b57
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140015bc1
cmp al, 0xef
ja 0x140015bb3
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140015b93
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140015ba2
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140015c15
sub rsp, 0xffffffffffffff80
jmp 0x140007368

Function at 0x1800196a0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800196c8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800196c8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret