joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003560
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov r10, qword [0x180090540]
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
test r10, r10
jne 0x18000361f
xorps xmm0, xmm0
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x30]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov r11d, dword [rsp + 0x38]
xor r9d, r9d
add r11d, 0xfffffffe
je 0x180003675
mov rbx, qword [rsp + 0x30]
lea rdi, [0x18007f16c]
nop word [rax + rax]
mov r10d, r9d
lea rdx, [0x18007f170]
add r10, rbx
mov al, 0x78
mov r8, r10
mov rcx, rdi
sub r8, rdi
cmp al, 0x78
jne 0x180003605
movzx eax, byte [r8 + rcx]
cmp byte [rdx], al
jne 0x180003669
movzx eax, byte [rcx + 1]
inc rcx
inc rdx
test al, al
jne 0x1800035f8
mov qword [0x180090540], r10
test r10, r10
je 0x180003680
lea rax, [fcn.180049d58]
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x50], rax
xor r9d, r9d
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x58], rax
movaps xmm0, xmm6
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.18003a0a0
mov rbx, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rdi
ret
inc r9d
cmp r9d, r11d
jb 0x1800035e0
mov qword [0x180090540], 0
xor r9d, r9d
lea r8, str.error
lea rdx, str.failed_to_find_valid_trampoline.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1800047a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x1800941d4], 0
lea rdi, [0x1800941d0]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x180004878
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x1800047d0
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x1800048b2
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
mov ecx, eax
shr ecx, 8
mov eax, dword [rdi + rdx*4]
xor eax, ecx
sub r9d, 1
jne 0x180004890
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x1800048f3
nop
cmp r9b, 0x23
jne 0x1800048d3
cmp byte [r8], r9b
jne 0x1800048d3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
mov ecx, eax
inc r8
shr ecx, 8
mov eax, dword [rdi + rdx*4]
xor eax, ecx
test r9b, r9b
jne 0x1800048c0
not eax
pop rdi
ret

Function at 0x1800052f0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x20
movsxd rbp, r9d
mov rsi, r8
test r8, r8
je 0x18000530a
mov dword [r8], 0
call fcn.180005130
mov rbx, rax
test rax, rax
jne 0x18000531f
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x40], rdi
mov rcx, rbx
mov qword [rsp + 0x48], r14
lea r8d, [rdx + 2]
call fcn.18004b074
test eax, eax
jne 0x180005409
mov rcx, rbx
call fcn.18004a5a4
movsxd r14, eax
cmp r14d, 0xffffffff
je 0x180005409
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.18004b074
test eax, eax
jne 0x180005409
mov rcx, qword [0x18008ded8]
lea eax, [r14 + rbp]
inc dword [rcx + 0x354]
mov rdx, qword [rcx + 0xf0]
movsxd rcx, eax
call rdx
mov rdi, rax
test rax, rax
je 0x180005409
mov r9, rbx
mov qword [rsp + 0x50], r15
mov r8, r14
mov edx, 1
mov rcx, rax
call fcn.18004dac8
cmp rax, r14
je 0x1800053e2
mov rcx, rbx
call fcn.18004ae08
mov rax, qword [0x18008ded8]
mov rcx, rdi
dec dword [rax + 0x354]
call qword [rax + 0xf8]
xor eax, eax
mov r15, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret
test ebp, ebp
jle 0x1800053f4
mov r8, rbp
lea rcx, [r14 + rdi]
xor edx, edx
call fcn.180045f00
mov rcx, rbx
call fcn.18004ae08
test rsi, rsi
je 0x180005404
mov dword [rsi], r14d
mov rax, rdi
jmp 0x1800053cb
mov rcx, rbx
call fcn.18004ae08
xor eax, eax
jmp 0x1800053d0
Function at 0x180020ca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x180020e57
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x180020d36
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.1800206d0
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.18001fca0
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x180020d27
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.1800163f0
mov dword [rbx + 0x80], 0
jmp 0x180020e43
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.18001ebd0
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1800373a0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov r10, qword [0x1800945e8]
mov rdi, rcx
test r10, r10
jne 0x180037460
xorps xmm0, xmm0
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x30]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov r11d, dword [rsp + 0x38]
xor r9d, r9d
add r11d, 0xfffffffe
je 0x1800374ab
mov rbx, qword [rsp + 0x30]
lea rsi, [0x18007f16c]
nop word [rax + rax]
mov r10d, r9d
lea rdx, [0x18007f170]
add r10, rbx
mov cl, 0x78
mov r8, r10
mov rax, rsi
sub r8, rsi
cmp cl, 0x78
jne 0x180037446
movzx ecx, byte [r8 + rax]
cmp byte [rdx], cl
jne 0x18003749f
movzx ecx, byte [rax + 1]
inc rax
inc rdx
test cl, cl
jne 0x180037438
mov qword [0x1800945e8], r10
test r10, r10
je 0x1800374b6
xor eax, eax
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rdi
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call fcn.18003a0a0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
inc r9d
cmp r9d, r11d
jb 0x180037420
mov qword [0x1800945e8], 0
xor r9d, r9d
lea r8, str.error
lea rdx, str.failed_to_find_valid_trampoline.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x180039230
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov r10, qword [0x1800945f8]
mov rdi, r8
mov r14, qword [0x1800907e0]
mov rsi, rdx
mov rbp, rcx
test r10, r10
jne 0x180039300
xorps xmm0, xmm0
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x30]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov r11d, dword [rsp + 0x38]
xor r9d, r9d
add r11d, 0xfffffffe
je 0x180039357
mov rbx, qword [rsp + 0x30]
lea r15, [0x18007f16c]
nop dword [rax]
mov r10d, r9d
lea rdx, [0x18007f170]
add r10, rbx
mov cl, 0x78
mov r8, r10
mov rax, r15
sub r8, r15
cmp cl, 0x78
jne 0x1800392e6
movzx ecx, byte [r8 + rax]
cmp byte [rdx], cl
jne 0x18003934b
movzx ecx, byte [rax + 1]
inc rax
inc rdx
test cl, cl
jne 0x1800392d8
mov qword [0x1800945f8], r10
test r10, r10
je 0x180039362
xor eax, eax
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov r8, rdi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], r14
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, rbp
call fcn.18003a0a0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
inc r9d
cmp r9d, r11d
jb 0x1800392c0
mov qword [0x1800945f8], 0
xor r9d, r9d
lea r8, str.error
lea rdx, str.failed_to_find_valid_trampoline.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x18003a240
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.18003a460
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x18003a347
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18003a2a4
mov rax, qword [0x18008d008]
cmp qword [rsp + 0x20], rax
ja 0x18003a2a4
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18003a266
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180045f00
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18003a2d3
jmp 0x18003a347
cmp dword [rsp + 0x50], 0x10000
jne 0x18003a32a
cmp qword [rsp + 0x48], 0x10000
jb 0x18003a32a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18003a318
mov rax, qword [rsp + 0x28]
jmp 0x18003a349
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18003a342
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.18003a460
mov qword [rsp + 0x20], rax
jmp 0x18003a266
xor eax, eax
add rsp, 0x68
ret
Function at 0x18003a350
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.18003a4a0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x18003a453
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18003a3ab
mov rax, qword [0x18008d008]
cmp qword [rsp + 0x20], rax
ja 0x18003a3ab
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18003a36d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180045f00
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18003a3da
jmp 0x18003a453
cmp dword [rsp + 0x50], 0x10000
jne 0x18003a431
cmp qword [rsp + 0x48], 0x10000
jb 0x18003a431
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18003a41f
mov rax, qword [rsp + 0x28]
jmp 0x18003a455
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18003a44e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.18003a4a0
mov qword [rsp + 0x20], rax
jmp 0x18003a36d
xor eax, eax
add rsp, 0x68
ret
Function at 0x18003fcf0
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xc], 0
mov rcx, qword [rsp + 0x40]
call fcn.18003fae0
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x18003fdc7
mov dword [rsp + 0x20], 0
jmp 0x18003fd64
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x18003fdc7
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18003fdc5
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.18003f8c0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18003fd5a
add rsp, 0x30
pop rdi
ret

Function at 0x18003fde0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x18003fe84
mov dword [rsp + 0x20], 0
jmp 0x18003fe1d
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x18003fe6d
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18003fe6b
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18003fe13
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x18008f228]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x30
pop rdi
ret
Function at 0x18003fe90
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x70
mov rdi, rsp
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x80]
mov eax, dword [rsp + 0x80]
imul rax, rax, 0x38
mov rcx, qword [0x180094630]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], 5
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18003ff14
mov rax, qword [rsp + 0x50]
sub rax, 5
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
add rax, 2
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x34]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18003ff3d
mov eax, 0xa
jmp 0x180040077
cmp dword [rsp + 0x88], 0
je 0x18003ffab
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov byte [rax], 0xe9
mov rax, qword [rsp + 0x50]
add rax, 5
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x58]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18003ffa9
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov byte [rax], 0xeb
mov rax, qword [rsp + 0x60]
mov byte [rax + 1], 0xf9
jmp 0x18003fff7
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18003ffdb
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.180045af0
jmp 0x18003fff7
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.180045af0
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x88]
and al, 1
shl al, 1
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x20], al
movzx eax, byte [rsp + 0x88]
and al, 1
shl al, 2
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x20], al
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1800730b0]
call fcn.180043524
mov rax, rdi
add rsp, 0x70
pop rdi
ret
Function at 0x180041560
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov rdi, rsp
mov ecx, 4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x20]
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x1800415ce
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0x90
je 0x1800415ce
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
je 0x1800415ce
xor eax, eax
jmp 0x180041615
mov dword [rsp], 1
jmp 0x1800415df
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp], eax
jae 0x180041610
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x20]
movzx ecx, byte [rdx + rcx]
cmp eax, ecx
je 0x18004160e
xor eax, eax
jmp 0x180041615
jmp 0x1800415d7
mov eax, 1
add rsp, 0x10
pop rdi
ret
Function at 0x18005321c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1800530f3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800530f3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1800530f3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1800530f3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1800530f3
cmp dword [rcx + 0x84], 0xe
jbe 0x1800530f3
cmp dword [rcx + 0xf8], 0
je 0x1800530f3
mov ecx, ebx
call fcn.180053194
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.180052f84
cmp dword [rbp + 0x20], 0
je 0x180053140
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180053148
int3
xor r8d, r8d
xor edx, edx
jmp 0x18005308c
Function at 0x140002c10
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
movaps xmmword [rax - 0x28], xmm6
mov rbp, r8
movsxd r8, dword [0x1400b9d24]
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm7
lea rdx, [rax - 0x78]
movaps xmmword [rax - 0x48], xmm8
mov rdi, rcx
shl r8, 5
lea rcx, [0x1400b9d40]
add r8, qword [0x1400b9d28]
mov rbx, r9
movaps xmmword [rax - 0x58], xmm9
movaps xmmword [rax - 0x68], xmm10
call fcn.140004310
mov rcx, qword [0x1400b9b70]
lea r8, [rsp + 0x30]
xorps xmm9, xmm9
mov rax, qword [rax]
mov eax, dword [rax + 0x40]
shl eax, 5
movsxd rdx, eax
add rdx, rbx
mov qword [rsp + 0x30], 0
xor ebx, ebx
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 0xc]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm8, dword [rsp + 0x34]
movss xmm7, dword [rsp + 0x30]
subss xmm8, dword [rdi + 0x34]
subss xmm7, dword [rdi + 0x30]
movss xmm6, dword [rsp + 0x38]
subss xmm6, dword [rdi + 0x38]
movaps xmm1, xmm8
movaps xmm0, xmm7
xorps xmm6, xmmword [0x1400a5740]
call fcn.140089080
movaps xmm1, xmm0
movaps xmm0, xmm6
call fcn.1400893d0
movaps xmm10, xmm0
movaps xmm1, xmm7
mulss xmm10, dword [0x1400a5498]
movaps xmm0, xmm8
subss xmm10, dword [rdi + 0x48]
call fcn.1400893d0
movaps xmm7, xmm0
xorps xmm8, xmm8
mulss xmm7, dword [0x1400a5498]
movaps xmm0, xmm10
xorps xmm6, xmm6
subss xmm7, dword [rdi + 0x4c]
movaps xmm1, xmm7
call fcn.140089080
movss xmm1, dword [0x1400b9d18]
comiss xmm1, xmm0
jbe 0x140002d3e
movaps xmm8, xmm10
movaps xmm6, xmm7
movss xmm7, dword [0x1400a54a4]
comiss xmm8, xmm7
movss xmm1, dword [0x1400a54c8]
movss xmm0, dword [0x1400a54b8]
jbe 0x140002d62
comiss xmm0, xmm8
jae 0x140002d80
comiss xmm8, xmm0
movaps xmm7, xmm8
jbe 0x140002d70
subss xmm7, xmm1
movss xmm2, dword [0x1400a5538]
comiss xmm2, xmm7
jbe 0x140002d80
movaps xmm7, xmm2
comiss xmm6, xmm0
jbe 0x140002d89
subss xmm6, xmm1
movss xmm0, dword [0x1400a5540]
comiss xmm0, xmm6
jbe 0x140002d9a
addss xmm6, xmm1
divss xmm7, dword [0x1400b9d14]
divss xmm6, dword [0x1400b9d14]
ucomiss xmm7, xmm9
jp 0x140002dba
jne 0x140002dba
ucomiss xmm6, xmm9
jp 0x140002dba
je 0x140002e38
cmp byte [0x1400b9d50], bl
je 0x140002df6
movsxd r8, dword [0x1400b9d54]
lea rdx, [rsp + 0x40]
shl r8, 5
lea rcx, [0x1400b9d78]
add r8, qword [0x1400b9d60]
call fcn.140004310
mov rcx, qword [rax]
mov ecx, dword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140002e38
addss xmm7, dword [rsi]
addss xmm6, dword [rsi + 4]
movss xmm1, dword [rsi + 8]
lea r8, [rsp + 0x30]
mov rcx, qword [0x1400b9b70]
addss xmm1, xmm9
mov r9d, 0xc
mov qword [rsp + 0x20], rbx
mov rdx, rbp
unpcklps xmm7, xmm6
movsd qword [rsp + 0x30], xmm7
movss dword [rsp + 0x38], xmm1
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop rdi
pop rsi
pop rbp
ret