joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14024b240
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x100]
xor eax, eax
mov qword [rbp - 0x78], rax
xorps xmm4, xmm4
movaps xmmword [rbp - 0x70], xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
mov qword [rbp - 0x40], rax
mov edi, edx
mov rbx, r8
mov rsi, r9
mov r14, qword [rbp + 0x30]
mov r15, qword [rbp + 0x38]
mov r13, qword [rbp + 0x40]
mov r12, qword [rbp + 0x48]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1402276a0
nop
lea rcx, [r12 + 0x10]
xor edx, edx
test r12, r12
cmove rcx, rdx
mov qword [rbp - 0x50], rcx
lea rdx, [r13 + 0x10]
xor r8d, r8d
test r13, r13
cmove rdx, r8
mov qword [rbp - 0x58], rdx
lea r8, [r15 + 0x10]
xor r9d, r9d
test r15, r15
cmove r8, r9
mov qword [rbp - 0x60], r8
lea r9, [r14 + 0x10]
xor eax, eax
test r14, r14
cmove r9, rax
mov qword [rbp - 0x68], r9
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x78], rbx
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rcx, qword [rax + 8]
mov qword [rbp - 0x84], rcx
mov edx, edi
mov dword [rbp - 0x7c], edx
mov r8, rbx
mov qword [rbp - 0x8c], r8
mov r9, rsi
mov qword [rbp - 0x94], r9
lea rcx, [rbp - 0xc0]
call fcn.140007300
mov rcx, qword [rbp - 0x84]
mov edx, dword [rbp - 0x7c]
mov r8, qword [rbp - 0x8c]
mov r9, qword [rbp - 0x94]
call sub.ADVAPI32.dll_RegEnumKeyExW
mov ebx, eax
lea rcx, [rbp - 0xc0]
call fcn.140007350
nop
xor ecx, ecx
mov qword [rbp - 0x78], rcx
xor ecx, ecx
mov qword [rbp - 0x70], rcx
xor ecx, ecx
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x60], rcx
xor ecx, ecx
mov qword [rbp - 0x58], rcx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x14024b39d
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1402276e0
mov eax, ebx
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14024b690
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rdx
mov rsi, r8
mov rdi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1402276a0
nop
test rbx, rbx
je 0x14024b6e6
add rbx, 0xc
mov rdx, rbx
jmp 0x14024b6e8
xor edx, edx
mov qword [rbp - 0x50], rdx
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rbx
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x60], rdx
mov r8, rsi
mov qword [rbp - 0x68], r8
mov r9, rdi
mov qword [rbp - 0x70], r9
lea rcx, [rbp - 0x98]
call fcn.140007300
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
call sub.ADVAPI32.dll_RegQueryValueExW
mov ebx, eax
lea rcx, [rbp - 0x98]
call fcn.140007350
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x14024b765
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1402276e0
mov eax, ebx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1402c8050
Capabilities:
Get token membership

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xorps xmm4, xmm4
movups xmmword [rbp - 0x58], xmm4
xor eax, eax
mov qword [rbp - 0x48], rax
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov dword [rbp - 0x40], edx
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp + 0x20], rsi
xor edx, edx
cmp byte [rsi], 0
setne dl
mov dword [rbp - 0x40], edx
mov qword [rbp - 0x50], rcx
lea rdx, [rbp - 0x48]
cmp dword [rcx], ecx
call fcn.1402276a0
nop
lea rdi, [rbx + 0x10]
xor ecx, ecx
test rbx, rbx
cmove rdi, rcx
mov qword [rbp - 0x58], rdi
mov rcx, qword [rbp - 0x50]
mov rbx, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
lea r8, [rbp - 0x40]
mov qword [rbp - 0x60], r8
mov rcx, rbx
mov qword [rbp - 0x68], rcx
mov rdx, rdi
mov qword [rbp - 0x70], rdx
lea rcx, [rbp - 0x98]
call fcn.140007300
mov r8, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x70]
call sub.ADVAPI32.dll_CheckTokenMembership
mov ebx, eax
lea rcx, [rbp - 0x98]
call fcn.140007350
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor ecx, ecx
mov qword [rbp - 0x58], rcx
test ebx, ebx
setne bl
movzx ebx, bl
cmp dword [rbp - 0x40], 0
setne cl
mov rdi, qword [rbp + 0x20]
mov byte [rdi], cl
cmp byte [rbp - 0x48], 0
je 0x1402c813f
mov rcx, qword [rbp - 0x50]
cmp byte [rcx], cl
xor edx, edx
call fcn.1402276e0
call fcn.140003af4
mov dword [rax + 0xf0], esi
movzx eax, bl
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140385a00
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x38
cmp r8d, 8
jge 0x140385a9d
xor eax, eax
cmp r8d, 4
jl 0x140385a51
add r8d, 0xfffffffc
movsx r10, word [rcx + rax*2]
movsx r9, dx
cmp r10d, r9d
je 0x140385a98
nop dword [rax]
movsx r10, word [rcx + rax*2 + 2]
cmp r10d, r9d
je 0x140385a91
movsx r10, word [rcx + rax*2 + 4]
cmp r10d, r9d
je 0x140385a89
movsx r10, word [rcx + rax*2 + 6]
cmp r10d, r9d
je 0x140385a81
add rax, 4
test r8d, r8d
jle 0x140385c7a
movsx r9, dx
nop
dec r8d
movsx rdx, word [rcx + rax*2]
cmp edx, r9d
je 0x140385a98
inc rax
test r8d, r8d
jg 0x140385a60
jmp 0x140385c7a
add eax, 3
jmp 0x140385c75
add eax, 2
jmp 0x140385c75
inc eax
jmp 0x140385c75
jmp 0x140385c75
movsx r9, dx
movd xmm0, r9d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov rax, rcx
lea edx, [r8 - 8]
movsxd rdx, edx
add rdx, rdx
lea r10, [rax + rdx]
movups xmm1, xmmword [rax]
pcmpeqw xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
xorps xmm2, xmm2
pcmpeqw xmm1, xmm2
pmovmskb r9d, xmm1
cmp r9d, 0xffff
jne 0x140385bb6
add rax, 0x10
cmp rax, r10
jbe 0x140385ac0
mov eax, r8d
test al, 7
je 0x140385c7a
movups xmm1, xmmword [r10]
pcmpeqw xmm0, xmm1
movaps xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x140385c7a
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
jne 0x140385c6c
mov ecx, 0x20
jmp 0x140385c6f
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
jne 0x140385c5d
mov r8d, 0x20
jmp 0x140385c61
bsf r8d, edx
sub rax, rcx
shr rax, 1
add eax, r8d
jmp 0x140385c75
bsf ecx, eax
shr rdx, 1
lea eax, [rdx + rcx]
add rsp, 0x38
ret
mov eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x14038fda0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
cmp r9d, 8
jge 0x14038fdf1
movzx r10d, dx
sub r8d, r10d
movzx eax, r8w
xor edx, edx
test r9d, r9d
jle 0x14039001b
movsxd r8, edx
movzx r8d, word [rcx + r8*2]
sub r8d, r10d
movzx r8d, r8w
cmp r8d, eax
jle 0x14038fde5
inc edx
cmp edx, r9d
jl 0x14038fdc5
jmp 0x14039001b
mov eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
movzx r10d, dx
movd xmm0, r10d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov eax, r8d
sub eax, r10d
movzx eax, ax
movd xmm1, eax
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
mov rax, rcx
add r9d, 0xfffffff8
mov edx, r9d
add rdx, rdx
lea r8, [rax + rdx]
movups xmm2, xmmword [0x1405aa890]
movaps xmm3, xmm1
psubw xmm3, xmm2
movups xmm4, xmmword [rax]
psubw xmm4, xmm0
movaps xmm5, xmm4
psubw xmm5, xmm2
movaps xmm6, xmm3
pcmpgtw xmm6, xmm5
pcmpeqw xmm4, xmm1
por xmm4, xmm6
movaps xmmword [rsp + 0x20], xmm4
xorps xmm5, xmm5
pcmpeqw xmm4, xmm5
pmovmskb r10d, xmm4
cmp r10d, 0xffff
jne 0x14038ff5b
add rax, 0x10
cmp rax, r8
jb 0x14038fe38
movups xmm4, xmmword [r8]
psubw xmm4, xmm0
movaps xmm0, xmm4
psubw xmm0, xmm2
pcmpgtw xmm3, xmm0
pcmpeqw xmm1, xmm4
por xmm1, xmm3
movaps xmmword [rsp + 0x20], xmm1
xorps xmm0, xmm0
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x14039001b
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
bsf ecx, eax
mov r8d, 0x20
test eax, eax
cmove ecx, r8d
mov eax, ecx
shr rdx, 1
add eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
bsf r8d, edx
mov r10d, 0x20
test edx, edx
cmove r8d, r10d
sub rax, rcx
shr rax, 1
add eax, r8d
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov eax, 0xffffffff
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x180005550
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x630
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180005570
mov byte [0x180063cca], 1
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18000558e
cmp byte [0x180063c69], 0
sete byte [0x180063c69]
lea rcx, [rsp + 0x20]
call fcn.180048d70
mov rbx, rax
mov rdx, qword [rax]
test rdx, rdx
je 0x18000570e
mov rax, qword [rax + 8]
test rax, rax
jne 0x1800055ce
mov rcx, qword [0x180063ff8]
mov r8, qword [rcx]
call qword [r8 + pe_nt_image_headers64]
mov qword [rbx + 8], rax
test rax, rax
je 0x18000570e
movzx eax, byte [rbx + 0x3a0]
test al, al
jne 0x1800056d8
mov r8, qword [rbx + 0x398]
test r8, r8
jne 0x1800056bb
cmp byte [0x180063ce1], r8b
mov qword [rsp + 0x640], rdi
jne 0x180005640
mov rcx, qword [0x180063ff8]
lea rdx, str.net_minecraftforge_common_ForgeVersion
mov byte [0x180063ce1], 1
mov rax, qword [rcx]
mov r8, qword [rax + 0x30]
call r8
test rax, rax
je 0x180005640
mov rcx, qword [0x180063ff8]
mov rdx, rax
mov r8, qword [rcx]
call qword [r8 + 0xb8]
mov al, 1
mov byte [0x180063ce2], al
jmp 0x180005647
movzx eax, byte [0x180063ce2]
mov r8, qword [rbx]
lea rcx, str.field_71415_G
test al, al
lea rdi, [0x180057acc]
cmovne rdi, rcx
test r8, r8
jne 0x180005667
xor edx, edx
jmp 0x18000568a
mov rdx, qword [rbx + 8]
test rdx, rdx
jne 0x18000568a
mov rcx, qword [0x180063ff8]
mov rdx, r8
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
mov rdx, rax
mov qword [rbx + 8], rax
mov rcx, qword [0x180063ff8]
lea r9, [0x180057e0c]
mov r8, rdi
mov rax, qword [rcx]
call qword [rax + 0x2f0]
mov rdi, qword [rsp + 0x640]
mov r8, rax
mov qword [rbx + 0x398], rax
test rax, rax
je 0x18000570e
mov rcx, qword [0x180063ff8]
mov rdx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x300]
mov byte [rbx + 0x3a0], al
test al, al
je 0x18000570e
mov ecx, 0x55
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180005704
cmp byte [0x180063c74], 0
sete byte [0x180063c74]
cmp byte [0x180063cc9], 0
sete byte [0x180063cc9]
call fcn.180007c30
call fcn.1800079e0
add rsp, 0x630
pop rbx
ret
Function at 0x1800079e0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x638
cmp byte [0x180063cb0], 0
je 0x180007bac
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180007bac
mov eax, dword [0x1800630c0]
sub eax, dword [0x180063c70]
inc dword [0x180063c70]
test eax, eax
js 0x180007b5e
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x640], rbx
call fcn.180048d70
mov rbx, rax
mov rdx, qword [rax]
test rdx, rdx
je 0x180007b56
mov rax, qword [rax + 8]
test rax, rax
jne 0x180007a6a
mov rcx, qword [0x180063ff8]
mov r8, qword [rcx]
call qword [r8 + pe_nt_image_headers64]
mov qword [rbx + 8], rax
test rax, rax
je 0x180007b56
mov rax, qword [rbx + 0x378]
test rax, rax
jne 0x180007b44
cmp byte [0x180063ce1], al
mov qword [rsp + 0x630], rdi
jne 0x180007acc
mov rcx, qword [0x180063ff8]
lea rdx, str.net_minecraftforge_common_ForgeVersion
mov byte [0x180063ce1], 1
mov rax, qword [rcx]
mov r8, qword [rax + 0x30]
call r8
test rax, rax
je 0x180007acc
mov rcx, qword [0x180063ff8]
mov rdx, rax
mov r8, qword [rcx]
call qword [r8 + 0xb8]
mov al, 1
mov byte [0x180063ce2], al
jmp 0x180007ad3
movzx eax, byte [0x180063ce2]
mov r8, qword [rbx]
lea rcx, str.func_147116_af
test al, al
lea rdi, [0x1800597b8]
cmovne rdi, rcx
test r8, r8
jne 0x180007af3
xor edx, edx
jmp 0x180007b16
mov rdx, qword [rbx + 8]
test rdx, rdx
jne 0x180007b16
mov rcx, qword [0x180063ff8]
mov rdx, r8
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
mov rdx, rax
mov qword [rbx + 8], rax
mov rcx, qword [0x180063ff8]
lea r9, [0x180057878]
mov r8, rdi
mov rax, qword [rcx]
call qword [rax + 0x108]
mov rdi, qword [rsp + 0x630]
mov qword [rbx + 0x378], rax
test rax, rax
je 0x180007b56
mov rdx, qword [rbx]
mov r8, rax
mov rcx, qword [0x180063ff8]
call fcn.180047fe0
mov rbx, qword [rsp + 0x640]
cmp byte [0x1800630ac], 0
je 0x180007b99
mov rcx, qword [0x180063ee0]
xor r9d, r9d
mov edx, 0x204
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [0x180063ee0]
xor r9d, r9d
mov edx, 0x205
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x180063c70], 0x14
jl 0x180007bac
mov dword [0x180063c70], 0
cmp byte [0x180063cc0], 0
je 0x180007c26
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180007c26
mov ecx, dword [0x180063c70]
mov eax, dword [0x1800630bc]
sub eax, ecx
inc ecx
mov dword [0x180063c70], ecx
test eax, eax
js 0x180007c17
mov rcx, qword [0x180063ee0]
xor r9d, r9d
mov edx, 0x204
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [0x180063ee0]
xor r9d, r9d
mov edx, 0x205
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x180063c70]
cmp ecx, 0x14
jl 0x180007c26
mov dword [0x180063c70], 0
add rsp, 0x638
ret
Function at 0x180007c30
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x808
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180007e0d
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180007e0d
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180007e0d
cmp byte [0x180063cc6], 0
je 0x180007e0d
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180007ca4
mov ecx, 0x45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180007e0d
lea rcx, [rsp + 0x1f8]
mov qword [rsp + 0x810], rbx
call fcn.180048d70
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.18004afc0
mov rbx, rax
mov rdx, qword [rax + 0x160]
test rdx, rdx
je 0x180007e05
mov rax, qword [rax + 0x168]
test rax, rax
jne 0x180007d05
mov rcx, qword [0x180063ff8]
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
mov qword [rbx + 0x168], rax
test rax, rax
je 0x180007e05
mov rax, qword [rbx + 0x1c8]
test rax, rax
jne 0x180007de9
cmp byte [0x180063ce1], al
mov qword [rsp + 0x800], rdi
jne 0x180007d67
mov rcx, qword [0x180063ff8]
lea rdx, str.net_minecraftforge_common_ForgeVersion
mov byte [0x180063ce1], 1
mov rax, qword [rcx]
mov r8, qword [rax + 0x30]
call r8
test rax, rax
je 0x180007d67
mov rcx, qword [0x180063ff8]
mov rdx, rax
mov r8, qword [rcx]
call qword [r8 + 0xb8]
mov al, 1
mov byte [0x180063ce2], al
jmp 0x180007d6e
movzx eax, byte [0x180063ce2]
mov r8, qword [rbx + 0x160]
lea rcx, str.func_70031_b
test al, al
lea rdi, [0x1800594d8]
cmovne rdi, rcx
test r8, r8
jne 0x180007d92
xor edx, edx
jmp 0x180007dbb
mov rdx, qword [rbx + 0x168]
test rdx, rdx
jne 0x180007dbb
mov rcx, qword [0x180063ff8]
mov rdx, r8
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
mov rdx, rax
mov qword [rbx + 0x168], rax
mov rcx, qword [0x180063ff8]
lea r9, str._Z_V
mov r8, rdi
mov rax, qword [rcx]
call qword [rax + 0x108]
mov rdi, qword [rsp + 0x800]
mov qword [rbx + 0x1c8], rax
test rax, rax
je 0x180007e05
mov rdx, qword [rbx + 0x160]
mov r9d, 1
mov rcx, qword [0x180063ff8]
mov r8, rax
call fcn.180047fe0
mov rbx, qword [rsp + 0x810]
add rsp, 0x808
ret
Function at 0x18000ac80
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x180063040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r8d, 4
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
xorps xmm0, xmm0
lea r8, [rsp + 0x38]
mov rbx, rax
mov r9d, 0x24
xor eax, eax
xor edx, edx
mov dword [rsp + 0x58], eax
mov rcx, rbx
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18004f530
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret

Function at 0x18000bc10
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x18000bc53
mov qword [0x180063cd0], rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x18000b760]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18000bc53
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret

Function at 0x18000c200
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x18000c228
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x18000c24e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18000c250
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x18000c2a9
test ecx, ecx
jle 0x18000c289
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x18000c2a9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18000c2a9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x18000c2d0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x18000c2f2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x18000c308
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18000c324
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18000c326
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18000c362
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18000c3fe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18000c39d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18000c3de
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x18000c3fe
cmp rbx, rax
ja 0x18000c3b0
test rbx, rbx
je 0x18000c3fe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret