joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004da10
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test edx, edx
lea rax, str.SCROLLX
lea rdi, str.SCROLLY
mov rbx, rcx
cmove rdi, rax
cmp dword [rcx + 0x130], 0
jg 0x14004da54
mov r8d, 0x7e8
lea rdx, str.D:VSSource_repos_sharpmacro_old_sharpmacroimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, dword [rbx + 0x130]
xor edx, edx
mov r8, qword [rbx + 0x138]
mov rcx, rdi
mov r8d, dword [r8 + rax*4 - 4]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400091e0
Function at 0x140064f20
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14010f040]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, qword [rcx]
lea rdi, [rsp + 0x30]
mov qword [rsp + 0x68], rax
lea rsi, [rsp + 0x60]
mov r9d, edx
mov dword [rsp + 0x60], 1
mov ecx, r8d
lea rbp, [rsp + 0x60]
movabs rax, 0x20c49ba5e353f7cf
imul r8
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3e8
mov dword [rsp + 0x30], edx
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [rsp + 0x34], eax
xor eax, eax
test r8, r8
cmovs rdi, rax
cmp r9d, 1
mov qword [rsp + 0x20], rdi
cmovne rsi, rax
test r9d, r9d
mov r8, rsi
cmovne rbp, rax
xor r9d, r9d
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140064ffa
nop dword [rax]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
jne 0x140065000
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov r8, rsi
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
cmp eax, 0xffffffff
je 0x140064fd0
test ebx, ebx
je 0x14006502a
jmp 0x140065007
cmp ebx, 0xffffffff
je 0x14006504d
jmp 0x140064ffa
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400cc3e0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.Request_timed_out
lea rcx, [rsp + 0x38]
call fcn.140065090
lea rdx, [0x14010a4c0]
lea rcx, [rsp + 0x38]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea r9, str.Failed_to_select_socket
lea rcx, [rsp + 0x38]
call fcn.140063570
lea rdx, [0x14010a250]
lea rcx, [rsp + 0x38]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140069090
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x2f0
mov rax, qword [0x14010f040]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
xorps xmm0, xmm0
mov dword [rsp + 0x70], WSAGetLastError
xor eax, eax
mov rbx, rcx
lea rcx, [rsp + 0xe1]
mov dword [rsp + 0xd4], eax
xor edx, edx
mov qword [rsp + 0x60], rax
mov r8d, 0x1f3
mov byte [rsp + 0xe0], al
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rsp + 0x84], xmm0
movups xmmword [rsp + 0x94], xmm0
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0x50], xmm0
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rcx, rbx
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.1400cc3e0
add rsp, 0x2f0
pop rbx
ret
Function at 0x140069190
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, qword [rdi + 0x10]
lea rbx, [rdi + 0x10]
inc rdx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
jne 0x1400691eb
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_CloseClipboard]
cmp qword [rdi + 0x18], 0xf
jbe case.default.0x14006923f
mov rdi, qword [rdi]
mov rbx, qword [rbx]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rsi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_GlobalFree]
cmpsd dword [rsi], dword [rdi]
jo 0x1401e155d
mov bh, 6
cdq
invalid
sub eax, 0x23798f86
xchg edx, eax
ret
invalid
mov ch, dh
int1
pop rsi
sub al, 0xcc
scasq rax, qword [rdi]
add ebx, edx
sal dword [rdi - 0x6067e29a], 0xd6
sbb ax, 0x9f98
invalid
xlatb
retf
adc eax, 0x67aee322
in al, dx
jbe 0x1401e1697
xor ch, dl
fcom st(4)
invalid
invalid
xchg ebp, eax
mov eax, 0x74c974e7
je 0x1401e1695
pop rdi
jle 0x1401e16c2
fidivr dword [rsi + 0x5073ccc9]
jae 0x1401e16b0
invalid
xchg edx, eax
outsb dx, byte [rsi]
imul ebp, dword [rdx], 0x2d368754
invalid
invalid
invalid
enter 0x1c9a, 0xffffffffffffffc7
jp 0x1401e1733
fiadd word [rsi + 0x2259a1cf]
invalid
sal byte [rsi + rbp*2 - 0x4e2d4aba], 0x8c
popfq
out dx, al
cwde
sti
rcl byte [rbx + 0x59], 0x3c
push rbx
pop rcx
cmp al, 0x79
invalid
insd dword [rdi], dx
hlt
in al, dx
lodsb al, byte [rsi]
jae str.gc:a
invalid
adc bh, byte [rax + rdi*8 - 0x48]
cld
and eax, 0x2cfc3abc
ret 0x5c6
invalid
invalid
mov esp, 0xe23ec835
mov cs, word [rdi - 0x1f0e8978]
sti
xchg dword [rdi - 9], ecx
popfq
xchg ebp, eax
invalid
xchg ebx, eax
and dl, dh
std
insd dword [rdi], dx
in eax, dx
shr dh, 1
mov cl, 0xc2
cli
adc ebp, dword [rdx - 0x140c5899]
hlt
adc dword [rcx - 0x46], ebp
xor al, 0xf8
invalid
sbb eax, 0x5d8bb195
invalid
push rsi
jg 0x1401e41f3
invalid
invalid
Function at 0x1400696c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x2f0
mov rax, qword [0x14010f040]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
lea rdx, str.C:Users_
lea rcx, [rsp + 0xb0]
call fcn.140068e90
nop
lea rdx, str.AppDataRoaming
lea rcx, [rsp + 0x70]
call fcn.140068e90
nop
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x28]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.140068e90
nop
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rsp + 0x60]
sub rax, rcx
mov rdx, qword [rsp + 0x80]
cmp rax, rdx
jb 0x14006983e
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova r9, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
cmp qword [rsp + 0x88], 7
cmova rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x90]
call fcn.1400bc400
nop
lea r8d, [rdi + 0xb]
lea rdx, str.SharpMacro
lea rcx, [rsp + 0x90]
call fcn.1400b4370
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rcx, [rsp + 0x90]
call fcn.1400b6060
nop
lea rcx, [rsp + 0x50]
call fcn.1400b6060
nop
lea rcx, [rsp + 0x70]
call fcn.1400b6060
nop
lea rcx, [rsp + 0xb0]
call fcn.1400b6060
mov rax, rbx
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.1400cc3e0
mov rbx, qword [rsp + 0x308]
add rsp, 0x2f0
pop rdi
ret
call fcn.1400630f0
nop
int3
Function at 0x140069850
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x2f0
mov rax, qword [0x14010f040]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
lea rdx, str.C:Users_
lea rcx, [rsp + 0xb0]
call fcn.140068e90
nop
lea rdx, str.AppDataRoaming
lea rcx, [rsp + 0x70]
call fcn.140068e90
nop
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x28]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.140068e90
nop
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rsp + 0x60]
sub rax, rcx
mov rdx, qword [rsp + 0x80]
cmp rax, rdx
jb 0x1400699ce
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova r9, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
cmp qword [rsp + 0x88], 7
cmova rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x90]
call fcn.1400bc400
nop
lea r8d, [rdi + 0x19]
lea rdx, str..minecraft_resourcepacks
lea rcx, [rsp + 0x90]
call fcn.1400b4370
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rcx, [rsp + 0x90]
call fcn.1400b6060
nop
lea rcx, [rsp + 0x50]
call fcn.1400b6060
nop
lea rcx, [rsp + 0x70]
call fcn.1400b6060
nop
lea rcx, [rsp + 0xb0]
call fcn.1400b6060
mov rax, rbx
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.1400cc3e0
mov rbx, qword [rsp + 0x308]
add rsp, 0x2f0
pop rdi
ret
call fcn.1400630f0
nop
int3
Function at 0x1400699e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x2f0
mov rax, qword [0x14010f040]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
lea rdx, str.C:Users_
lea rcx, [rsp + 0xb0]
call fcn.140068e90
nop
lea rdx, str.AppDataRoaming
lea rcx, [rsp + 0x70]
call fcn.140068e90
nop
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x28]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.140068e90
nop
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rsp + 0x60]
sub rax, rcx
mov rdx, qword [rsp + 0x80]
cmp rax, rdx
jb 0x140069b5e
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova r9, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
cmp qword [rsp + 0x88], 7
cmova rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x90]
call fcn.1400bc400
nop
lea r8d, [rdi + 0x10]
lea rdx, str..minecraftlogs
lea rcx, [rsp + 0x90]
call fcn.1400b4370
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rcx, [rsp + 0x90]
call fcn.1400b6060
nop
lea rcx, [rsp + 0x50]
call fcn.1400b6060
nop
lea rcx, [rsp + 0x70]
call fcn.1400b6060
nop
lea rcx, [rsp + 0xb0]
call fcn.1400b6060
mov rax, rbx
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.1400cc3e0
mov rbx, qword [rsp + 0x308]
add rsp, 0x2f0
pop rdi
ret
call fcn.1400630f0
nop
int3
Function at 0x14006a0a0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x14010f040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
cmp qword [rcx + 0x18], 7
jbe 0x14006a0d1
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmkdir]
mov edx, eax
lea rcx, [rsp + 0xb0]
call fcn.1400637e0
mov rdi, rax
cmp qword [rbx + 0x18], 7
jbe 0x14006a0fd
mov rdx, qword [rbx]
mov rcx, qword [rbx + 0x10]
lea r8, [rdx + rcx*2]
jmp 0x14006a108
mov rax, qword [rbx + 0x10]
lea r8, [rbx + rax*2]
mov rdx, rbx
lea rcx, [rsp + 0x90]
call fcn.1400b89c0
nop
mov r9d, socket
lea r8, str._CreateDir____Dir__
mov rcx, rax
call fcn.140079670
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], recv
mov byte [rax], 0
mov r8d, send
lea rdx, str._Return_value_
lea rcx, [rsp + 0x50]
call fcn.1400b45f0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x80], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], recv
mov byte [rax], 0
mov r9, rdi
lea r8, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.1400bc550
lea rcx, [rsp + 0x28]
call fcn.140069c10
nop
mov rdx, qword [rsp + 0x88]
cmp rdx, 0xf
jbe 0x14006a1ff
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006a1f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006a1f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cc760
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14006a23f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006a23a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006a23a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cc760
movdqa xmm0, xmmword [0x1400f6b40]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
lea rcx, [rsp + 0x90]
call fcn.1400798f0
nop
lea rcx, [rsp + 0xb0]
call fcn.1400798f0
nop
mov rcx, rbx
call fcn.1400b6060
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400cc3e0
mov rbx, qword [rsp + 0xf8]
add rsp, 0xe0
pop rdi
ret
Function at 0x14006a510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14010f040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor eax, eax
mov dword [rsp + 0x20], eax
movdqa xmm0, xmmword [0x1400f6f10]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400f6ef0]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x1400f6ed0]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x4d4e4256
mov dword [rsp + 0x64], 0x33323130
mov dword [rsp + 0x68], 0x37363534
mov word [rsp + 0x6c], 0x3938
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], recv
mov byte [rcx], al
mov dword [rsp + 0x20], 1
test edx, edx
jle 0x14006a608
mov edi, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, eax
mov eax, 0x84210843
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e
sub ecx, eax
movsxd rax, ecx
movzx r9d, byte [rsp + rax + 0x30]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14006a5fa
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x14006a5ef
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14006a602
mov rcx, rbx
call fcn.1400bb210
sub rdi, 1
jne 0x14006a5a5
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400cc3e0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
Function at 0x1400718f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14010f040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov rbx, qword [0x14020db48]
mov rsi, qword [0x14020db50]
cmp rbx, rsi
je 0x140071953
nop dword [rax]
mov ecx, dword [rbx + 4]
cmp ecx, 0xffffffff
jne 0x14007193c
xor eax, eax
jmp 0x140071943
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0xf
test al, 1
jne 0x1400719c6
add rbx, 0x28
cmp rbx, rsi
jne 0x140071930
mov byte [rdi], 0
mov dword [rdi + 4], 0
xorps xmm0, xmm0
movups xmmword [rdi + 8], xmm0
mov qword [rdi + 0x18], 0
mov qword [rdi + 0x20], recv
mov byte [rdi + 8], 0
mov dword [rdi + 4], 0xffffffff
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14006d690
mov rdx, rax
lea rcx, [rdi + 8]
call fcn.1400b46e0
lea rcx, [rsp + 0x30]
call fcn.1400798f0
nop
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400cc3e0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
movzx ecx, byte [rbx]
mov byte [rdi], cl
mov ecx, dword [rbx + 4]
mov dword [rdi + 4], ecx
lea rdx, [rbx + 8]
lea rcx, [rdi + 8]
call fcn.14006d370
jmp 0x1400719a3

Function at 0x140071a70
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov rdi, rcx
add rcx, 0x18
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x140071a97
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [rdi + 0x64], 0x7fffffff
jne 0x140071ab3
mov ecx, 6
mov dword [rdi + 0x64], 0x7ffffffe
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov qword [rsp + 0x30], rbx
mov rbx, qword [rdi + 0x70]
mov qword [rsp + 0x38], rsi
mov rsi, qword [rdi + 0x78]
cmp rbx, rsi
je 0x140071aef
nop word [rax + rax]
mov ecx, dword [rbx + 4]
cmp ecx, 0xffffffff
jne 0x140071adc
xor al, al
jmp 0x140071ae2
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 1
mov byte [rbx], al
add rbx, 0x28
cmp rbx, rsi
jne 0x140071ad0
mov rax, qword [rdi]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
cmp rax, qword [rdi + 8]
je case.default.0x140071b18
mov qword [rdi + 8], rax
lea rcx, [rdi + 0x18]
mov byte [rdi + 0x68], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.MSVCP140.dll__Mtx_unlock]
Function at 0x140071b20
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
push r14
sub rsp, 0x28
cmp byte [rcx + 0x98], 0
mov rdi, rcx
jne 0x140071b40
call fcn.140071a70
mov byte [rdi + 0x98], 1
lea rcx, [rdi + 0x18]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x140071b5a
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [rdi + 0x64], 0x7fffffff
jne 0x140071b76
mov ecx, 6
mov dword [rdi + 0x64], 0x7ffffffe
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x20], r15
xor r15b, r15b
mov qword [rsp + 0x40], rdi
cmp byte [rdi + 0x94], r15b
je 0x140071ba2
call fcn.14006a2a0
test al, al
je 0x140071ba2
mov r15b, 1
xor sil, sil
jmp 0x140071baf
lea rcx, [rsp + 0x40]
call fcn.140071c50
movzx esi, al
cmp dword [rdi + 0x90], 1
jne 0x140071c19
test sil, sil
jne 0x140071c19
mov qword [rsp + 0x48], rbx
mov rbx, qword [rdi + 0x70]
mov qword [rsp + 0x50], rbp
mov rbp, qword [rdi + 0x78]
mov rcx, rbp
sub rcx, rbx
sub rcx, 0x28
cmp rcx, 0x28
jb 0x140071be4
test r15b, r15b
je 0x140071c0f
cmp rbx, rbp
je 0x140071c0f
nop dword [rax]
mov ecx, dword [rbx + 4]
cmp ecx, 0xffffffff
jne 0x140071bfc
xor al, al
jmp 0x140071c02
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 1
mov byte [rbx], al
add rbx, 0x28
cmp rbx, rbp
jne 0x140071bf0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
cmp byte [rdi + 0x97], 0
mov r15, qword [rsp + 0x20]
je 0x140071c2b
xor sil, 1
lea rcx, [rdi + 0x18]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
movzx eax, sil
mov rsi, qword [rsp + 0x58]
add rsp, 0x28
pop r14
pop rdi
ret
Function at 0x140071ec0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0x6666666666666667
mov rcx, qword [rcx]
mov rdi, qword [rcx + 0x78]
mov rbx, qword [rcx + 0x70]
mov rdx, rdi
sub rdx, rbx
imul rdx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x140071fe9
mov ecx, dword [rcx + 0x90]
test ecx, ecx
je 0x140071ffb
cmp ecx, 1
jne 0x140071fe9
cmp rbx, rdi
je 0x140071f59
cmp byte [rbx], 0
mov ecx, dword [rbx + 4]
je 0x140071f3d
cmp ecx, 0xffffffff
jne 0x140071f33
xor al, al
not al
jmp 0x140071f4c
call qword [sym.imp.USER32.dll_GetKeyState]
not al
jmp 0x140071f4c
cmp ecx, 0xffffffff
jne 0x140071f46
xor al, al
jmp 0x140071f4c
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x140071f6b
add rbx, 0x28
cmp rbx, rdi
jne 0x140071f20
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rsi]
mov rdi, qword [rax + 0x78]
mov rbx, qword [rax + 0x70]
cmp rbx, rdi
je 0x140071fe9
nop dword [rax + rax]
mov ecx, dword [rbx + 4]
cmp ecx, 0xffffffff
jne 0x140071f8c
xor eax, eax
jmp 0x140071f93
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0xf
test al, 1
jne 0x140071fe0
cmp byte [rbx], 0
mov ecx, dword [rbx + 4]
je 0x140071fb7
cmp ecx, 0xffffffff
jne 0x140071fad
xor al, al
not al
jmp 0x140071fc6
call qword [sym.imp.USER32.dll_GetKeyState]
not al
jmp 0x140071fc6
cmp ecx, 0xffffffff
jne 0x140071fc0
xor al, al
jmp 0x140071fc6
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x140071fe0
mov ecx, dword [rbx + 4]
cmp ecx, 0xffffffff
jne 0x140071fd6
xor al, al
jmp 0x140071fdc
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 1
mov byte [rbx], al
add rbx, 0x28
cmp rbx, rdi
jne 0x140071f80
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rsi + 8]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x70]
mov rdi, qword [rcx + 0x78]
cmp rbx, rdi
je 0x140071f59
mov ecx, dword [rbx + 4]
cmp ecx, 0xffffffff
jne 0x14007201f
xor eax, eax
jmp 0x140072026
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0xf
test al, 1
je 0x140071fe9
add rbx, 0x28
cmp rbx, rdi
jne 0x140072013
mov rbx, qword [rsp + 0x30]
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140074330
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
lea rcx, [0x14020da30]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x140074351
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x14020da7c], 0x7fffffff
jne 0x140074373
mov ecx, 6
mov dword [0x14020da7c], 0x7ffffffe
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp byte [0x14020c165], 0
je 0x140074532
cmp dword [0x14020c360], 0xb06b
sete al
xor r8d, r8d
cmp dword [0x14020c364], 0xa124
mov ecx, r8d
mov edx, r8d
cmove ecx, eax
cmp dword [0x14020c368], 3
movzx eax, cl
mov ecx, r8d
cmove edx, eax
cmp dword [0x14020c36c], 4
movzx eax, dl
mov edx, r8d
cmove ecx, eax
cmp dword [0x14020c370], 5
movzx eax, cl
mov ecx, r8d
cmove edx, eax
cmp dword [0x14020c374], 0x28a2e
movzx eax, dl
mov edx, r8d
cmove ecx, eax
cmp dword [0x14020c378], 0x141289
movzx eax, cl
mov ecx, r8d
cmove edx, eax
cmp dword [0x14020c37c], 0x85d0
movzx eax, dl
mov edx, r8d
cmove ecx, eax
cmp dword [0x14020c380], 0x185a
movzx eax, cl
mov ecx, r8d
cmove edx, eax
cmp dword [0x14020c384], 0xd7c
movzx eax, dl
mov edx, r8d
cmove ecx, eax
cmp dword [0x14020c388], 1
movzx eax, cl
mov ecx, r8d
cmove edx, eax
cmp dword [0x14020c38c], 0x1472
movzx eax, dl
mov edx, r8d
cmove ecx, eax
cmp dword [0x14020c390], 0x2a1
movzx eax, cl
mov ecx, r8d
cmove edx, eax
cmp dword [0x14020c394], 1
movzx eax, dl
mov edx, r8d
cmove ecx, eax
cmp dword [0x14020c398], 0xcc82
movzx eax, cl
mov ecx, r8d
cmove edx, eax
cmp dword [0x14020c39c], 0xfff777a3
movzx eax, dl
mov edx, r8d
cmove ecx, eax
cmp dword [0x14020c3a0], 0xffe9f0c5
movzx eax, cl
mov ecx, r8d
cmove edx, eax
cmp dword [0x14020c3a4], 0xffffe881
movzx eax, dl
mov edx, r8d
cmove ecx, eax
cmp dword [0x14020c3a8], 0xfffb149f
movzx eax, cl
mov ecx, r8d
cmove edx, eax
cmp dword [0x14020c3ac], 0xfffffa8d
movzx eax, dl
mov edx, r8d
cmove ecx, eax
cmp dword [0x14020c3b0], 0xfff8e13b
movzx eax, cl
cmove edx, eax
cmp dword [0x14020c3b4], 0xfffff037
movzx eax, dl
cmove r8d, eax
test r8b, r8b
jne 0x140074532
lea rdx, str._ERROR__3__Exiting_with_code_0_
lea rcx, [rsp + 0x20]
call fcn.140068bd0
mov rcx, rax
call fcn.140069c10
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x14020da30]
add rsp, 0x48
jmp qword [sym.imp.MSVCP140.dll__Mtx_unlock]