joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3a4dc7010
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x3a500ab60]
jmp 0x3a4db4170

Function at 0x180e14058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x180e141df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180e14089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180e1406f
add dl, dl
jne 0x180e14096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180e140f6
xor eax, eax
add dl, dl
jne 0x180e140a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180e141ad
add dl, dl
jne 0x180e140b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180e140c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180e140d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180e140dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180e140ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180e1407e
mov eax, 1
add dl, dl
jne 0x180e14106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180e14113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180e140fb
sub eax, ebx
mov ebx, 1
jne 0x180e1414c
mov ecx, 1
add dl, dl
jne 0x180e1412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180e1413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180e14123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180e1407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180e14168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180e14175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180e1415d
cmp eax, 0x7d00
jae 0x180e1419b
cmp eax, 0x500
jb 0x180e14196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180e1407e
cmp eax, 0x7f
ja 0x180e1419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180e1407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180e141d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180e1407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400050a0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x1400050ce
xor eax, eax
jmp 0x1400051b4
cmp qword [rcx + 0x68], 0
je 0x1400050df
call fcn.1400051d0
jmp 0x1400051b4
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400050f6
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400050f8
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000512a
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140008050
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x1400051ae
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x140005161
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14000518a
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14000d5b8
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x1400051ae
cmp rsi, rbx
ja 0x140005168
test rsi, rsi
je 0x1400051ae
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14000d5b8
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140005294
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1400052c3
call fcn.140005354
jmp 0x14000533a
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x1400052da
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400052dc
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140005334
test ecx, ecx
jle 0x140005315
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call fcn.140008050
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140005334
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140005334
mov r8, rbx
mov edx, 1
mov rcx, r15
call fcn.14000db18
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140006e28
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006e72
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006e72
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006e72
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006e72
cmp dword [rcx + 0x84], 0xe
jbe 0x140006e72
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006e74
xor al, al
add rsp, 0x28
ret
Function at 0x140011af0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001191c

Function at 0x14046dd32
Capabilities:
Encode data using xor

Disassembly:
mov dword [rbp + riz], r9d
lea rsp, [rsp + 8]
jmp fcn.14044ae36
xor r9d, r9d
test rbx, rbx
lea rsp, [rsp + 0x10]
je 0x140466a82
mov r10d, 0x4c12379f
push r11
lea r11, [0x140467f10]
movzx r10d, byte [rdx]
xor r10d, r9d
push 0x7b33ec37
and r10d, 0xff
mov r10d, dword [r11 + r10*4]
shl dword [rsp + 4], 0xab
shr r9d, 8
xor r9d, r10d
push 0x63310d1f
inc rdx
xor r9d, 0x6fbc53be
dec rbx
push 0xe2bd813
lea rsp, [rsp + 0x18]
jne 0x140466a23
mov r11d, 0x1f9c10b0
lea r11, [r11 + r11*8 + 0x2589dd98]
push r11
mov r11, qword [rsp + 8]
lea rsp, [rsp + 0x10]
push 0x55a15739
not r9d
jmp 0x140465dde
jmp 0x140466a03
Function at 0x1400040dc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004126
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004126
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004126
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004126
cmp dword [rcx + 0x84], 0xe
jbe 0x140004126
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004128
xor al, al
add rsp, 0x28
ret

Function at 0x140001000
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 8], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
xor edi, edi
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001163
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, 0x28
mov dword [rbp - 0x30], edi
and eax, 1
mov qword [rbp - 0x24], rdi
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x1c], 1
mov qword [rbp - 0x10], rdi
lea ecx, [r8 - 0x27]
lea eax, [rax + rax*4]
lea ebx, [rax*2 - 5]
mov dword [rbp - 0x28], ebx
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x28
mov dword [rbp - 0x30], edi
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x28], ebx
mov qword [rbp - 0x24], rdi
mov qword [rbp - 0x1c], 1
lea ecx, [r8 - 0x27]
mov qword [rbp - 0x10], rdi
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x28
mov dword [rbp - 0x30], edi
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x28], ebx
mov qword [rbp - 0x24], rdi
mov qword [rbp - 0x1c], 1
lea ecx, [r8 - 0x27]
mov qword [rbp - 0x10], rdi
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x28
mov dword [rbp - 0x30], edi
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x28], ebx
mov qword [rbp - 0x24], rdi
mov qword [rbp - 0x1c], 1
lea ecx, [r8 - 0x27]
mov qword [rbp - 0x10], rdi
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x28
mov dword [rbp - 0x30], edi
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x28], ebx
mov qword [rbp - 0x24], rdi
mov qword [rbp - 0x1c], 1
lea ecx, [r8 - 0x27]
mov qword [rbp - 0x10], rdi
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001033

Function at 0x140001a58
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001aa2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001aa2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001aa2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001aa2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001aa2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001aa4
xor al, al
add rsp, 0x28
ret
Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor edx, edx
mov ecx, 0x1fffff
mov r8d, 0xe60
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x1400010b2
lea rcx, str.Error_while_open_process
call fcn.140001010
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001150
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x1b2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
jne 0x1400010e5
lea rcx, str.Error_while_allocating_memory
call fcn.140001010
xor esi, esi
lea r8, [0x140005080]
mov r9d, 0x1b2
mov qword [rsp + 0x20], rsi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], rsi
mov r9, rdi
mov dword [rsp + 0x28], esi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x140001135
lea rcx, str.Error_creating_Thread
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140001c40
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c8a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c8a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c8a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c8a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c8a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c8c
xor al, al
add rsp, 0x28
ret
Function at 0x14000cef0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x14015f340]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [0x14021e1c9]
test eax, eax
jne 0x14000cf2b
mov rcx, qword [rsp + 0xa0]
call fcn.14000d120
jmp 0x14000d104
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14021e4f0], eax
jle 0x14000cf77
lea rcx, [0x14021e4f0]
call fcn.140118768
cmp dword [0x14021e4f0], 0xffffffff
jne 0x14000cf77
lea rcx, [0x14021e1e8]
call fcn.140008440
nop
lea rcx, [0x14021e4f0]
call fcn.1401186fc
mov rax, qword [rsp + 0xa0]
mov ecx, dword [0x1401a8f00]
cmp dword [rax + 0xc0], ecx
jbe 0x14000d0dd
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xa0]
add rax, 0xc4
mov qword [rsp + 0x38], rax
movss xmm2, dword [0x14014d470]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
call fcn.14000c6d0
mov r8, qword [rax]
lea rdx, [rsp + 0x50]
lea rcx, [0x14021e1e8]
call fcn.14000c680
mov r8, qword [rax]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
call fcn.14000c630
mov r8, qword [rax]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x70]
call fcn.14000c680
mov rax, qword [rsp + 0xa0]
movss xmm0, dword [rax + 0x110]
mulss xmm0, dword [0x14014d178]
movss xmm1, dword [rsp + 0x7c]
divss xmm1, xmm0
movaps xmm0, xmm1
mulss xmm0, dword [0x14021e8f0]
cvttss2si eax, xmm0
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0xa0]
movss xmm0, dword [rax + 0x110]
mulss xmm0, dword [0x14014d178]
movss xmm1, dword [rsp + 0x78]
divss xmm1, xmm0
movaps xmm0, xmm1
mulss xmm0, dword [0x14021e8f4]
cvttss2si eax, xmm0
mov dword [rsp + 0x30], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14000d0a7
mov eax, dword [rsp + 0x30]
neg eax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
mov edx, dword [rsp + 0x34]
mov ecx, 1
call qword [sym.imp.USER32.dll_mouse_event]
mov rax, qword [rsp + 0xa0]
add rax, 0xc4
mov qword [rsp + 0x40], rax
movss xmm2, dword [0x14014d470]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call fcn.14000c6d0
mov rax, qword [rax]
mov qword [0x14021e1e8], rax
jmp 0x14000d0f7
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rsp + 0x68]
call fcn.14000c350
mov rax, qword [rax]
mov qword [0x14021e1e8], rax
mov rcx, qword [rsp + 0xa0]
call fcn.14000d120
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401186a0
add rsp, 0x98
ret
Function at 0x140029190
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.140029d50
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x14002f270
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x14002f292
mov rcx, qword [rsp + 0x40]
call fcn.14002f340
jmp 0x14002f2a9
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x14002f2a9
mov rcx, qword [rsp + 0x40]
call fcn.14002f3f0
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x14002f340
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x14002f361
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x14002f3e5
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x14002f3b0
mov dword [rsp + 4], 0x9908b0df
jmp 0x14002f3b8
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14002f354
add rsp, 0x18
ret
Function at 0x14002f3f0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x14002f420
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x14002f4a2
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x14002f46e
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x14002f476
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14002f415
mov qword [rsp + 8], 0xe3
jmp 0x14002f4ba
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x14002f541
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x14002f50b
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x14002f513
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14002f4ad
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x14002f595
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x14002f59d
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x140031a70
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
movss dword [rsp + 0x20], xmm3
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140031aa6
mov rax, qword [rsp + 0x38]
mov byte [rax], 1
jmp 0x140031b0b
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
test eax, eax
je 0x140031b0b
xor edx, edx
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov r8d, 8
movzx edx, al
movzx ecx, byte [rsp + 0x40]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov r8d, 2
movzx edx, al
movzx ecx, byte [rsp + 0x40]
call qword [sym.imp.USER32.dll_keybd_event]
mov rax, qword [rsp + 0x38]
mov byte [rax], 0
add rsp, 0x28
ret
Function at 0x140031b40
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
movzx eax, byte [0x14021e508]
test eax, eax
jne 0x140031b54
jmp 0x140031da2
mov dword [rsp + 0x24], 0x20
movss xmm0, dword [0x14014d230]
call fcn.14005b5a0
xorps xmm2, xmm2
movss xmm1, dword [0x14014d65c]
lea rcx, [rsp + 0x28]
call fcn.14000c350
xor edx, edx
mov rcx, rax
call fcn.14005b490
mov r8d, dword [rsp + 0x24]
xor edx, edx
lea rcx, str.Cheats_List
call fcn.140056380
movzx eax, byte [0x14021e1ca]
test eax, eax
je 0x140031bce
movzx eax, byte [0x14021e1d7]
test eax, eax
jne 0x140031bc2
mov ecx, dword [0x1401a8f24]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140031bce
lea rcx, str.Aimbot__Toggle_
call fcn.14009b0c0
movzx edx, byte [0x14021e1d6]
lea rcx, [0x140129160]
call fcn.1400319f0
movzx edx, byte [0x14021e4fd]
lea rcx, [0x14012916c]
call fcn.1400319f0
movzx edx, byte [0x14021e50b]
lea rcx, [0x140129178]
call fcn.1400319f0
movzx edx, byte [0x14021e1ab]
lea rcx, str.Crosshair
call fcn.1400319f0
movzx edx, byte [0x14021e532]
lea rcx, str.Enemy_Sensor
call fcn.1400319f0
movzx edx, byte [0x14015f3c1]
lea rcx, [0x1401291a8]
call fcn.1400319f0
movzx edx, byte [0x14021e50f]
lea rcx, str.External_Radar
call fcn.1400319f0
movzx edx, byte [0x14021e4fc]
lea rcx, [0x1401291c0]
call fcn.1400319f0
movzx edx, byte [0x14021e50d]
lea rcx, [0x1401291d0]
call fcn.1400319f0
movss xmm0, dword [0x14021e4f4]
ucomiss xmm0, dword [0x14014d138]
je 0x140031c96
lea rcx, str.Flash_Immunity
call fcn.14009b0c0
movzx edx, byte [0x14021e509]
lea rcx, [0x1401291f0]
call fcn.1400319f0
cmp dword [0x1401a8f04], 0x5a
je 0x140031cbe
lea rcx, str.Fov_Changer
call fcn.14009b0c0
movzx edx, byte [0x14021e1c1]
lea rcx, [0x140129210]
call fcn.1400319f0
cmp dword [0x14021e504], 0
je 0x140031ce1
mov byte [rsp + 0x20], 1
jmp 0x140031ce6
mov byte [rsp + 0x20], 0
movzx edx, byte [rsp + 0x20]
lea rcx, str.HitSound
call fcn.1400319f0
movzx edx, byte [0x14021e4fe]
lea rcx, str.Money_Service
call fcn.1400319f0
movzx edx, byte [0x14021e530]
lea rcx, [0x140129240]
call fcn.1400319f0
movzx edx, byte [0x14021e531]
lea rcx, [0x140129250]
call fcn.1400319f0
movzx edx, byte [0x14021e1c9]
lea rcx, [0x14012925c]
call fcn.1400319f0
movzx edx, byte [0x14021e533]
lea rcx, [0x140129260]
call fcn.1400319f0
movzx edx, byte [0x14021e50a]
lea rcx, [0x140129270]
call fcn.1400319f0
movzx eax, byte [0x14021e1b8]
test eax, eax
je 0x140031d9c
movzx eax, byte [0x14021e1c2]
test eax, eax
jne 0x140031d90
mov ecx, dword [0x14021e1d8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140031d9c
lea rcx, str.TriggerBot__Toggle_
call fcn.14009b0c0
call fcn.140059dd0
nop
add rsp, 0x38
ret