joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b5b0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
cmp byte [0x1401c3cc5], 0
je 0x14000b79d
mov ecx, dword [reloc.WLDAP32.dll_Ordinal_32]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14000b79d
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14000b79d
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14000b603
mov byte [0x1401ba59a], 1
jmp 0x14000b656
cmp byte [0x1401ba59a], 0
je 0x14000b656
xor edx, edx
lea ecx, [rdx + 0x44]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, 0x44
mov edx, eax
lea r8d, [r9 + 8]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea ecx, [rdx + 0x44]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, 0x44
mov edx, eax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov byte [0x1401ba59a], 0
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14000b66f
mov byte [0x1401ba59c], 1
jmp 0x14000b6c2
cmp byte [0x1401ba59c], 0
je 0x14000b6c2
xor edx, edx
lea ecx, [rdx + 0x41]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, 0x41
mov edx, eax
lea r8d, [r9 + 8]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea ecx, [rdx + 0x41]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, 0x41
mov edx, eax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov byte [0x1401ba59c], 0
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14000b6db
mov byte [0x1401ba59b], 1
jmp 0x14000b72e
cmp byte [0x1401ba59b], 0
je 0x14000b72e
xor edx, edx
lea ecx, [rdx + 0x53]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, 0x53
mov edx, eax
lea r8d, [r9 + 8]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea ecx, [rdx + 0x53]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, 0x53
mov edx, eax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov byte [0x1401ba59b], 0
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14000b74a
mov byte [0x1401ba599], 1
add rsp, 0x28
ret
cmp byte [0x1401ba599], 0
je 0x14000b79d
xor edx, edx
lea ecx, [rdx + 0x57]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, 0x57
mov edx, eax
lea r8d, [r9 + 8]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea ecx, [rdx + 0x57]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, 0x57
mov edx, eax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov byte [0x1401ba599], 0
add rsp, 0x28
ret
Function at 0x14000b7b0
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
movzx eax, byte [0x1401312c2]
vmovups xmm0, xmmword [0x1401312a8]
movzx ecx, word [0x1401312c0]
xor al, 0x53
vmovups xmmword [rbp - 0x20], xmm0
vmovsd xmm0, qword [0x1401312b8]
xor byte [rbp - 0x1f], 0x3a
xor byte [rbp - 0x1e], 0x3b
xor byte [rbp - 0x1d], 0x3c
xor byte [rbp - 0x1c], 0x3d
xor byte [rbp - 0x1b], 0x3e
xor byte [rbp - 0x1a], 0x3f
xor byte [rbp - 0x19], 0x40
xor byte [rbp - 0x18], 0x41
xor byte [rbp - 0x17], 0x42
xor byte [rbp - 0x16], 0x43
xor byte [rbp - 0x15], 0x44
xor byte [rbp - 0x14], 0x45
xor byte [rbp - 0x13], 0x46
xor byte [rbp - 0x12], 0x47
xor byte [rbp - 0x11], 0x48
vmovsd qword [rbp - 0x10], xmm0
xor byte [rbp - 0x10], 0x49
xor byte [rbp - 0xf], 0x4a
xor byte [rbp - 0xe], 0x4b
xor byte [rbp - 0xd], 0x4c
xor byte [rbp - 0xc], 0x4d
xor byte [rbp - 0xb], 0x4e
xor byte [rbp - 0xa], 0x4f
xor byte [rbp - 9], 0x50
mov byte [rbp - 6], al
mov rax, qword [0x140131920]
mov word [rbp - 8], cx
xor cl, 0x51
xor byte [rbp - 7], 0x52
cmp byte [0x140131927], 0
mov qword [rbp + 0x18], rax
mov eax, dword [str.VJR]
mov dword [rbp + 0x10], eax
movzx eax, byte [0x140131b38]
mov byte [rbp - 0x20], Ordinal_50
mov byte [rbp - 8], cl
je 0x14000b8a0
xor byte [rbp + 0x19], 0x3a
xor byte [rbp + 0x1a], 0x3b
xor byte [rbp + 0x1b], 0x3c
xor byte [rbp + 0x1c], 0x3d
xor byte [rbp + 0x1d], 0x3e
xor byte [rbp + 0x1e], 0x3f
xor byte [rbp + 0x1f], 0x40
mov byte [rbp + 0x18], 0x63
nop dword [rax + rax]
xor byte [rbp + 0x11], 0x3a
lea r9, [rbp - 0x20]
xor byte [rbp + 0x12], 0x3b
lea r8, [rbp + 0x18]
xor byte [rbp + 0x13], 0x3c
lea rdx, [rbp + 0x10]
xor al, 0x3d
mov byte [rbp + 0x10], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp + 0x14], al
xor ecx, ecx
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
add rsp, 0x50
pop rbp
ret
Function at 0x14001f9f0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x490
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x470], rbx
mov qword [rbp + 0x480], rsi
mov qword [rbp + 0x488], rdi
mov rax, qword [0x1401561c0]
xor rax, rbp
mov qword [rbp + 0x440], rax
mov rdi, rdx
mov dword [rbp], 0x438
mov edx, dword [0x1401c44f0]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
xor r14d, r14d
movabs r15, 0xffffffffffffff0
lea rcx, [rbp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x14001fa70
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x14001faea
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14001fa9b
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140113180
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x14001faea
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r14
xor edx, edx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x30]
mov r9d, 0xffffffff
mov byte [rbx], r14b
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r14
jmp 0x14001faed
mov rbx, r14
cmp qword [rdi + 0x18], 0xf
mov rdx, rdi
jbe 0x14001fafa
mov rdx, qword [rdi]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x14001fb12
inc rbx
test eax, eax
jne 0x14001fb00
test ecx, ecx
mov rcx, rsi
je 0x14001fb72
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x14001fa60
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14001fb6e
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14001fb69
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001fbf5
mov rcx, r8
call fcn.1401128c4
xor eax, eax
jmp 0x14001fbb5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
mov rbx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14001fbb2
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14001fbad
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001fbf5
mov rcx, r8
call fcn.1401128c4
mov rax, rbx
mov byte [rdi], r14b
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rdi + 0x10], r14
mov rcx, qword [rbp + 0x440]
xor rcx, rbp
call fcn.140112620
mov rbx, qword [rbp + 0x470]
mov rsi, qword [rbp + 0x480]
mov rdi, qword [rbp + 0x488]
lea rsp, [rbp + 0x450]
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140020a70
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x290
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x270], rbx
mov qword [rbp + 0x280], rsi
mov qword [rbp + 0x288], rdi
mov rax, qword [0x1401561c0]
xor rax, rbp
mov qword [rbp + 0x240], rax
mov rdi, rdx
mov dword [rbp], 0x238
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor r14d, r14d
movabs r15, 0xffffffffffffff0
nop word [rax + rax]
lea rcx, [rbp + 0x2c]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140020af0
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x140020b6a
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140020b1b
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140113180
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x140020b6a
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r14
xor edx, edx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x2c]
mov r9d, 0xffffffff
mov byte [rbx], r14b
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r14
jmp 0x140020b6d
mov rbx, r14
cmp qword [rdi + 0x18], 0xf
mov rdx, rdi
jbe 0x140020b7a
mov rdx, qword [rdi]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x140020b92
inc rbx
test eax, eax
jne 0x140020b80
test ecx, ecx
mov rcx, rsi
je 0x140020bf2
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140020ae0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140020bee
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140020be9
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140020c73
mov rcx, r8
call fcn.1401128c4
xor eax, eax
jmp 0x140020c33
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
mov ebx, dword [rbp + 8]
cmp rdx, 0xf
jbe 0x140020c31
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140020c2c
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140020c73
mov rcx, r8
call fcn.1401128c4
mov eax, ebx
mov byte [rdi], r14b
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rdi + 0x10], r14
mov rcx, qword [rbp + 0x240]
xor rcx, rbp
call fcn.140112620
mov rbx, qword [rbp + 0x270]
mov rsi, qword [rbp + 0x280]
mov rdi, qword [rbp + 0x288]
lea rsp, [rbp + 0x250]
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140026130
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x320
mov rax, qword [0x1401561c0]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov rsi, rcx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
mov dword [rsp + 0xd0], 0x238
lea rdx, [rsp + 0xd0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140026299
nop
vpxor xmm0, xmm0, xmm0
xor eax, eax
vmovups ymmword [rsp + 0x50], ymm0
vmovups ymmword [rsp + 0x70], ymm0
vmovups ymmword [rsp + 0x90], ymm0
vmovups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x50]
vzeroupper
call fcn.14002e0a0
nop
lea r9, [rsp + 0xfc]
cmp word [rsp + 0xfc], 0
je 0x1400261eb
nop dword [rax]
add r9, 2
cmp word [r9], 0
jne 0x1400261e0
lea r8, [rsp + 0xfc]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.140031880
nop
lea rcx, [rsp + 0x50]
call fcn.14002dfb0
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x14002621a
mov rdx, qword [rsi]
lea rcx, [rsp + 0x28]
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x40]
cmp rdi, 0xf
cmova rcx, rbx
mov r8, qword [rsp + 0x38]
cmp r8, qword [rsi + 0x10]
jne 0x140026249
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400262cd
cmp rdi, 0xf
jbe 0x140026280
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140026278
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002630d
mov rcx, rbx
call fcn.1401128c4
lea rdx, [rsp + 0xd0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140026190
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.140112620
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, 0xf
jbe 0x140026309
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140026301
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002630d
mov rcx, rbx
call fcn.1401128c4
mov al, 1
jmp 0x1400262a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140027440
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov eax, dword [0x1401377b0]
lea r8, [rsp + 0x21]
vmovups ymm0, ymmword [0x140137780]
vmovups xmm1, xmmword [0x1401377a0]
mov dword [rsp + 0x50], eax
mov r10d, 2
movzx eax, word [0x1401377b4]
mov word [rsp + 0x54], ax
movzx eax, byte [reloc.WS2_32.dll_WSAGetLastError]
mov byte [rsp + 0x56], al
vmovups ymmword [rsp + 0x20], ymm0
vmovups xmmword [rsp + 0x40], xmm1
nop dword [rax]
lea r9d, [r10 - 2]
mov eax, 0x94f2095
imul r9d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r9b
sub al, cl
lea ecx, [r10 - 1]
add al, 0x39
xor byte [r8 - 1], al
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r9b
sub al, cl
add al, 0x3a
xor byte [r8], al
mov eax, 0x94f2095
imul r10d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r9b
sub al, cl
lea ecx, [r10 + 1]
add al, 0x3b
xor byte [r8 + 1], al
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r9b
sub al, cl
lea ecx, [r10 + 2]
add al, 0x3c
xor byte [r8 + 2], al
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r9b
sub al, cl
lea ecx, [r10 + 3]
add al, 0x3d
xor byte [r8 + 3], al
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r9b
sub al, cl
lea ecx, [r10 + 4]
add al, 0x3e
xor byte [r8 + 4], al
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
lea r8, [r8 + 0xb]
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r9b
sub al, cl
lea ecx, [r10 + 5]
add al, 0x3f
xor byte [r8 - 6], al
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r9b
sub al, cl
lea ecx, [r10 + 6]
add al, 0x40
xor byte [r8 - 5], al
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r9b
sub al, cl
lea ecx, [r10 + 7]
add al, 0x41
xor byte [r8 - 4], al
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r9b
sub al, cl
lea ecx, [r10 + 8]
add al, 0x42
add r10d, 0xb
xor byte [r8 - 3], al
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x37
lea eax, [r10 - 2]
sub r9b, dl
add r9b, 0x43
xor byte [r8 - 2], r9b
cmp eax, 0x37
jl 0x140027490
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x20]
vzeroupper
call fcn.14001d520
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [rsp + 0x70]
call fcn.140035c50
movzx eax, byte [rsp + 0x70]
sub al, 0x59
test al, 0xdf
sete al
add rsp, 0x68
ret
Function at 0x14002e7e0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14002e808
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14002e82e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14002e830
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14002e889
test ecx, ecx
jle 0x14002e869
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14002e889
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14002e889
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14002e8b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14002e8d2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14002e8e8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14002e904
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14002e906
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14002e942
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14002e9de
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14002e97d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14002e9be
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14002e9de
cmp rbx, rax
ja 0x14002e990
test rbx, rbx
je 0x14002e9de
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x14002ee50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1401561c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14002ee7d
xor eax, eax
jmp 0x14002efe9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14002eeb7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14002eeb7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14002efe9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14002efdc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14002eefa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14002ef25
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14002efe1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14002ef94
sub eax, 1
je 0x14002ef94
cmp eax, 2
jne 0x14002efdc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14002efe1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14002efc2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14002efdc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14002efe1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140112620
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400311b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
movzx eax, word [rcx]
lea r8, [rcx + 6]
mov rdx, rcx
mov qword [rsp + 0x88], 3
lea r9, str._n_n____Wait_for_Sapphire_CS2_Skinchanger_to_start_and_beep_sound......
sub r9, rcx
lea r10, [0x140137e72]
sub r10, rcx
lea r11, [0x140137e74]
sub r11, rcx
lea rbx, [0x140137e76]
sub rbx, rcx
lea rdi, [0x140137e78]
sub rdi, rcx
lea rsi, [0x140137e7a]
sub rsi, rcx
lea rbp, [0x140137e7c]
sub rbp, rcx
lea r14, [0x140137e7e]
sub r14, rcx
lea r15, [0x140137e80]
sub r15, rcx
lea r12, [0x140137e82]
sub r12, rcx
lea r13, [0x140137e84]
sub r13, rcx
lea rcx, [0x140137e86]
sub rcx, rdx
mov qword [rsp + 0x80], rcx
lea rcx, [0x140137e88]
sub rcx, rdx
mov qword [rsp + 0x90], rcx
lea rcx, [0x140137e8a]
sub rcx, rdx
mov qword [rsp + 0x98], rcx
lea rcx, [0x140137e8c]
sub rcx, rdx
mov qword [rsp], rcx
lea rcx, [0x140137e8e]
sub rcx, rdx
mov qword [rsp + 8], rcx
lea rcx, [0x140137e90]
sub rcx, rdx
mov qword [rsp + 0x10], rcx
lea rcx, [0x140137e92]
sub rcx, rdx
mov qword [rsp + 0x18], rcx
lea rcx, [0x140137e94]
sub rcx, rdx
mov qword [rsp + 0x20], rcx
lea rcx, [0x140137e96]
sub rcx, rdx
mov qword [rsp + 0x28], rcx
nop dword [rax + rax]
movzx ecx, word [r9 + r8 - 6]
lea r8, [r8 + 0x2e]
xor cx, word [rdx + 2]
xor ax, cx
mov rcx, qword [rsp + 0x80]
mov word [r8 - 0x30], ax
xor ax, word [r10 + r8 - 0x34]
mov word [r8 - 0x2e], ax
xor ax, word [r11 + r8 - 0x34]
mov word [r8 - 0x2c], ax
xor ax, word [r9 + r8 - 0x2e]
mov word [r8 - 0x2a], ax
xor ax, word [r10 + r8 - 0x2e]
mov word [r8 - 0x28], ax
xor ax, word [r11 + r8 - 0x2e]
mov word [r8 - 0x26], ax
xor ax, word [r8 + rbx - 0x2e]
mov word [r8 - 0x24], ax
xor ax, word [r8 + rdi - 0x2e]
mov word [r8 - 0x22], ax
xor ax, word [r8 + rsi - 0x2e]
mov word [r8 - 0x20], ax
xor ax, word [r8 + rbp - 0x2e]
mov word [r8 - 0x1e], ax
xor ax, word [r8 + r14 - 0x2e]
mov word [r8 - 0x1c], ax
xor ax, word [r8 + r15 - 0x2e]
mov word [r8 - 0x1a], ax
xor ax, word [r8 + r12 - 0x2e]
mov word [r8 - 0x18], ax
xor ax, word [r8 + r13 - 0x2e]
mov word [r8 - 0x16], ax
xor ax, word [r8 + rcx - 0x2e]
mov rcx, qword [rsp + 0x90]
mov word [r8 - 0x14], ax
xor ax, word [r8 + rcx - 0x2e]
mov rcx, qword [rsp + 0x98]
mov word [r8 - 0x12], ax
xor ax, word [r8 + rcx - 0x2e]
mov rcx, qword [rsp]
mov word [r8 - 0x10], ax
xor ax, word [r8 + rcx - 0x2e]
mov rcx, qword [rsp + 8]
mov word [r8 - 0xe], ax
xor ax, word [r8 + rcx - 0x2e]
mov rcx, qword [rsp + 0x10]
mov word [r8 - 0xc], ax
xor ax, word [r8 + rcx - 0x2e]
mov rcx, qword [rsp + 0x18]
mov word [r8 - 0xa], ax
xor ax, word [r8 + rcx - 0x2e]
mov rcx, qword [rsp + 0x20]
mov word [r8 - 8], ax
xor ax, word [r8 + rcx - 0x2e]
mov rcx, qword [rsp + 0x28]
mov word [r8 - 6], ax
xor ax, word [r8 + rcx - 0x2e]
mov word [r8 - 4], ax
xor ax, word [rdx + 2]
sub qword [rsp + 0x88], 1
jne 0x1400312e0
xor eax, eax
mov word [rdx + 0x8e], ax
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret