joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140082b60
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov r14, rcx
nop word [rax + rax]
mov r9d, edi
mov r8d, esi
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x140082bb4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140082b90
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400883d0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x14017d300]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x48], rcx
lea edi, [rcx + 1]
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], r8d
nop dword [rax + rax]
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14008843f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140088410
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14011ce50
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x140088470
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x14017d300]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x48], rcx
lea edi, [rcx + 1]
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], r8d
nop dword [rax + rax]
lea rax, [rsp + 0x30]
xor r9d, r9d
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, edi
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x1400884de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x1400884b0
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14011ce50
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x1400966d0
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x58
mov rax, qword [0x14017d300]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov qword [rsp + 0x28], rcx
cmp qword [rcx + 0x20], 0xf
lea rsi, [rcx + 8]
mov rbp, rdx
mov byte [rsp + 0x20], 0
mov edi, 2
mov r15d, ebx
mov rdx, rsi
jbe 0x140096714
mov rdx, qword [rsi]
lea r8, [rsp + 0x38]
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x140096730
mov r15d, reloc.WS2_32.dll_recv
jmp 0x140096754
cmp qword [rsi + 0x18], 0xf
jbe 0x14009673a
mov rsi, qword [rsi]
lea r8, [rsp + 0x30]
mov rdx, rsi
mov ecx, edi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x140096759
mov r15d, 4
mov edi, 7
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
lea edx, [r9 + 0x55]
call sub.libcrypto_3_x64.dll_X509_get_ext_d2i
mov r12, rax
test rax, rax
je 0x140096842
mov qword [rsp + 0xa0], r13
mov rcx, rax
mov qword [rsp + 0x50], r14
xor r13b, r13b
xor r14b, r14b
call sub.libcrypto_3_x64.dll_OPENSSL_sk_num
mov dword [rsp + 0x24], eax
test eax, eax
jle 0x140096835
nop
test r14b, r14b
jne 0x140096830
mov edx, ebx
mov rcx, r12
call sub.libcrypto_3_x64.dll_OPENSSL_sk_value
mov rsi, rax
cmp dword [rax], edi
jne 0x14009681a
mov rcx, qword [rax + 8]
call sub.libcrypto_3_x64.dll_ASN1_STRING_get0_data
mov rcx, qword [rsi + 8]
mov rbp, rax
call sub.libcrypto_3_x64.dll_ASN1_STRING_length
movsxd r8, eax
cmp edi, 2
je 0x140096809
cmp edi, 7
jne 0x14009681a
mov r8, r15
lea rcx, [rsp + 0x38]
mov rdx, rbp
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140096804
mov r8, r15
lea rcx, [rsp + 0x30]
mov rdx, rbp
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14009681a
mov r13b, 1
jmp 0x14009681a
mov rcx, qword [rsp + 0x28]
mov rdx, rbp
call fcn.140049800
movzx r14d, al
inc ebx
cmp ebx, dword [rsp + 0x24]
jl 0x1400967a0
test r14b, r14b
jne 0x140096830
test r13b, r13b
je 0x140096835
mov byte [rsp + 0x20], 1
mov r13, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x50]
mov rcx, r12
call sub.libcrypto_3_x64.dll_GENERAL_NAMES_free
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011ce50
add rsp, 0x58
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400969f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
jne 0x140096a29
mov rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rdi, qword [rdi + 8]
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x140096a56
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140096a32
mov rbp, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140097bd0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, r8
mov rbp, rdx
mov r14, rcx
test r8, r8
jg 0x140097bf2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140097c08
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x28], rbx
mov rbx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x140097c52
cmp rax, rsi
mov rdi, rsi
mov rcx, r14
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, rbp
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, r14
add rbp, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [r14 + 0x80], 0
mov rdi, rbx
je 0x140097cc1
mov rcx, r14
call fcn.140035980
cmp rbx, 0xfff
jbe 0x140097ca1
mov r9, qword [r14 + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add rbp, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140097cda
cmp rbx, rax
ja 0x140097c70
test rdi, rdi
je 0x140097cc1
mov r9, qword [r14 + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x28]
mov rax, rsi
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rsi, rbx
jmp 0x140097cc4
Function at 0x140097ce0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140097d08
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x140097d7c
test rax, rax
jle 0x140097d5c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x140097d7c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140097d7c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret

Function at 0x140099e00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14017d300]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov rdi, rdx
mov ecx, 8
call fcn.14011ccf8
mov r9, rax
test rax, rax
je 0x140099e39
mov rax, qword [rbx]
mov qword [r9], rax
jmp 0x140099e3c
xor r9d, r9d
mov qword [rsp + 0x30], r9
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
lea r8, [0x140099cf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x140099e83
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14011ce50
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14009a1f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rsi, rdx
sub rdi, rdx
mov rbp, rcx
sar rdi, 2
test rdi, rdi
je 0x14009a3cf
mov qword [rsp + 0x60], rbx
mov rbx, qword [rcx + 8]
sub rbx, qword [rcx]
mov qword [rsp + 0x30], r13
sar rbx, 2
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
cmp rdi, 0x26f
jb 0x14009a240
mov eax, ntohl
jmp 0x14009a26e
cmp rdi, 0x44
jb 0x14009a24d
mov eax, 7
jmp 0x14009a26e
cmp rdi, 0x27
jb 0x14009a25a
mov eax, 5
jmp 0x14009a26e
cmp rdi, 7
jb 0x14009a267
mov eax, 3
jmp 0x14009a26e
lea rax, [rdi - 1]
shr rax, 1
mov r14, rdi
lea r15, [rbx + 1]
sub r14, rax
shr r14, 1
lea r13, [r14 + rax]
cmp rdi, rbx
jbe 0x14009a287
mov r15, rdi
mov r8, rdi
mov edx, 0x8b8b8b8b
shl r8, 2
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
test r15, r15
je 0x14009a33f
mov qword [rsp + 0x38], r12
nop dword [rax + rax]
xor edx, edx
lea rax, [rcx + r14]
div rdi
mov r11d, dword [rsi + rdx*4]
lea r10, [rsi + rdx*4]
xor edx, edx
mov rax, rcx
div rdi
lea r12, [rsi + rdx*4]
mov r9, rdx
lea rax, [rcx - 1]
xor edx, edx
div rdi
mov r8d, dword [rsi + rdx*4]
xor r8d, dword [r12]
xor r8d, r11d
mov eax, r8d
shr eax, 0x1b
xor eax, r8d
imul edx, eax, 0x19660d
test rcx, rcx
jne 0x14009a2fd
mov rax, rbx
jmp 0x14009a312
cmp rcx, rbx
ja 0x14009a30f
mov rax, qword [rbp]
mov eax, dword [rax + rcx*4 - 4]
add rax, r9
jmp 0x14009a312
mov rax, r9
lea r8d, [rax + rdx]
lea eax, [r11 + rdx]
xor edx, edx
mov dword [r10], eax
lea rax, [rcx + r13]
div rdi
inc rcx
add dword [rsi + rdx*4], r8d
mov dword [r12], r8d
cmp rcx, r15
jb 0x14009a2b0
mov r12, qword [rsp + 0x38]
add r15, rdi
cmp rcx, r15
jae 0x14009a3bb
inc r14
lea rbp, [rcx - 1]
inc r13
xor edx, edx
lea rax, [r14 + rbp]
div rdi
mov r10d, dword [rsi + rdx*4]
lea r11, [rsi + rdx*4]
xor edx, edx
lea rbx, [rbp + 1]
mov rax, rbx
div rdi
mov rax, rbp
mov r9, rdx
xor edx, edx
div rdi
mov ecx, dword [rsi + rdx*4]
xor edx, edx
add ecx, r10d
add ecx, dword [rsi + r9*4]
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul ecx, eax, 0x5d588b65
mov rax, rbp
add rax, r13
mov rbp, rbx
div rdi
xor r10d, ecx
lea rax, [rbx + 1]
mov dword [r11], r10d
mov r8d, ecx
sub r8d, r9d
xor dword [rsi + rdx*4], r8d
mov dword [rsi + r9*4], r8d
cmp rax, r15
jb 0x14009a351
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x20]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14009c7d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14017d300]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rdx
mov r14, rcx
mov qword [rsp + 0x38], rcx
xor ebp, ebp
lea rax, vtable.httplib::ThreadPool.0
mov qword [rcx], rax
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], rbp
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
lea ecx, [rbp + 0x50]
call fcn.14011ccf8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [r14 + 0x20], rax
mov byte [r14 + 0x30], bpl
lea rcx, [r14 + 0x38]
call sub.MSVCP140.dll__Cnd_init_in_situ
nop
lea rcx, [r14 + 0x80]
mov dword [rcx], ebp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x38], xmm0
mov qword [rcx + 0x48], rbp
lea edx, [rbp + 2]
call sub.MSVCP140.dll__Mtx_init_in_situ
nop
test rsi, rsi
je 0x14009c8ed
mov qword [rsp + 0x30], r14
nop word [rax + rax]
mov rdi, qword [r14 + 0x10]
cmp rdi, qword [r14 + 0x18]
je 0x14009c8d6
mov ecx, 8
call fcn.14011ccf8
test rax, rax
je 0x14009c89e
mov qword [rax], r14
jmp 0x14009c8a1
mov rax, rbp
mov qword [rsp + 0x40], rax
lea r15, [rdi + 8]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x140099cf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x14009c917
add qword [r14 + 0x10], 0x10
jmp 0x14009c8e7
lea r8, [rsp + 0x30]
mov rdx, rdi
lea rcx, [r14 + 8]
call fcn.1400999f0
sub rsi, 1
jne 0x14009c880
mov rax, r14
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011ce50
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov dword [r15], ebp
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1400a3150
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x168
mov rax, qword [0x14017d300]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov ebp, r9d
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test al, al
je 0x1400a32b0
lea rax, [rsp + 0x40]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x78], 0
mov rcx, qword [rbx + 0x3b8]
test rcx, rcx
je 0x1400a31b9
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xc0], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x88]
call fcn.1400359c0
movzx eax, byte [rbx + 0x37c]
mov byte [rsp + 0x38], 0
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x28], al
mov dword [rsp + 0x20], ebp
mov r9d, dword [rbx + 0x378]
mov r8d, edi
lea rdx, [0x140135e94]
mov rcx, rsi
call fcn.140099ea0
mov rsi, rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400a3246
mov r8, qword [rcx]
lea rax, [rsp + 0x40]
cmp rcx, rax
setne dl
call qword [r8 + reloc.WLDAP32.dll_Ordinal_32]
mov qword [rsp + 0x78], 0
xchg qword [rbx + 0x48], rsi
mov rax, qword [rbx + 0x48]
nop
cmp rax, 0xffffffffffffffff
je 0x1400a32b0
test edi, edi
jne 0x1400a32ab
mov dword [rsp + 0xc8], 0x80
mov rcx, qword [rbx + 0x48]
nop
lea r8, [rsp + 0xc8]
lea rdx, [rsp + 0xd0]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1400a32b0
movzx eax, word [rsp + 0xd0]
cmp ax, 2
je 0x1400a3298
cmp ax, 0x17
jne 0x1400a32b0
movzx ecx, word [rsp + 0xd2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx edi, ax
test edi, edi
setns al
jmp 0x1400a32b2
xor al, al
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14011ce50
add rsp, 0x168
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400a57a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rax, qword [0x1401bc798]
cmp byte [rax + 0x5fb0], 0
je 0x1400a597f
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rsi, qword [0x1401bb660]
mov qword [r11 - 0x10], r12
mov r12, qword [0x1401bb650]
mov qword [r11 - 0x18], r13
lea r13, [0x1401bb650]
mov qword [r11 - 0x20], r14
mov r14, qword [0x1401bc5e8]
mov qword [r11 - 0x28], r15
mov rbp, r14
mov r15, qword [0x1401bb668]
mov rbx, qword [r14 + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400a5856
mov qword [r11 - 8], rdi
nop
mov rdi, qword [rbx + 0x30]
lea rcx, [rbx + 0x20]
cmp r15, 0xf
mov rdx, r13
cmova rdx, r12
cmp qword [rcx + 0x18], 0xf
jbe 0x1400a582d
mov rcx, qword [rcx]
cmp rsi, rdi
mov r8, rdi
cmovb r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a5890
js 0x1400a5895
mov rbp, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1400a5810
mov rdi, qword [rsp + 0x80]
cmp byte [rbp + 0x19], 0
jne 0x1400a58a0
cmp qword [rbp + 0x38], 0xf
lea rdx, [rbp + 0x20]
mov rbx, qword [rdx + 0x10]
jbe 0x1400a586e
mov rdx, qword [rdx]
cmp r15, 0xf
mov rcx, r13
mov r8, rsi
cmova rcx, r12
cmp rbx, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a589b
js 0x1400a58a0
jmp 0x1400a58a3
cmp rdi, rsi
jae 0x1400a5842
mov rbx, qword [rbx + 0x10]
jmp 0x1400a5848
cmp rsi, rbx
jae 0x1400a58a3
mov rbp, r14
mov r15, qword [rsp + 0x60]
cmp rbp, r14
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x98]
je 0x1400a597a
mov rdx, r13
lea rcx, [0x1401bc5e8]
call fcn.14009da30
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400a597a
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], reloc.WLDAP32.dll_Ordinal_200
call fcn.140021460
mov rcx, qword [0x1401bb490]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x14
jb 0x1400a5987
cmp qword [0x1401bb498], 0xf
lea rax, [0x1401bb480]
movzx edx, byte [rsp + 0x90]
lea r9, str.actioninput_ntext_
cmova rax, qword [0x1401bb480]
lea r8, [0x1401bb480]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_sendto
call fcn.140005390
lea rcx, [rsp + 0x40]
call fcn.140054940
mov r13, qword [rsp + 0x70]
add rsp, 0x88
ret
call fcn.140005690
int3
Function at 0x1400a5990
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rax, qword [0x1401bc798]
cmp byte [rax + 0x5fb0], 0
je 0x1400a5b6f
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rsi, qword [0x1401bb4b0]
mov qword [r11 - 0x10], r12
mov r12, qword [0x1401bb4a0]
mov qword [r11 - 0x18], r13
lea r13, [0x1401bb4a0]
mov qword [r11 - 0x20], r14
mov r14, qword [0x1401bc5e8]
mov qword [r11 - 0x28], r15
mov rbp, r14
mov r15, qword [0x1401bb4b8]
mov rbx, qword [r14 + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400a5a46
mov qword [r11 - 8], rdi
nop
mov rdi, qword [rbx + 0x30]
lea rcx, [rbx + 0x20]
cmp r15, 0xf
mov rdx, r13
cmova rdx, r12
cmp qword [rcx + 0x18], 0xf
jbe 0x1400a5a1d
mov rcx, qword [rcx]
cmp rsi, rdi
mov r8, rdi
cmovb r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a5a80
js 0x1400a5a85
mov rbp, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1400a5a00
mov rdi, qword [rsp + 0x80]
cmp byte [rbp + 0x19], 0
jne 0x1400a5a90
cmp qword [rbp + 0x38], 0xf
lea rdx, [rbp + 0x20]
mov rbx, qword [rdx + 0x10]
jbe 0x1400a5a5e
mov rdx, qword [rdx]
cmp r15, 0xf
mov rcx, r13
mov r8, rsi
cmova rcx, r12
cmp rbx, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a5a8b
js 0x1400a5a90
jmp 0x1400a5a93
cmp rdi, rsi
jae 0x1400a5a32
mov rbx, qword [rbx + 0x10]
jmp 0x1400a5a38
cmp rsi, rbx
jae 0x1400a5a93
mov rbp, r14
mov r15, qword [rsp + 0x60]
cmp rbp, r14
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x98]
je 0x1400a5b6a
mov rdx, r13
lea rcx, [0x1401bc5e8]
call fcn.14009da30
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400a5b6a
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], reloc.WLDAP32.dll_Ordinal_200
call fcn.140021460
mov rcx, qword [0x1401bb450]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x14
jb 0x1400a5b77
cmp qword [0x1401bb458], 0xf
lea rax, [0x1401bb440]
movzx edx, byte [rsp + 0x90]
lea r9, str.actioninput_ntext_
cmova rax, qword [0x1401bb440]
lea r8, [0x1401bb440]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_sendto
call fcn.140005390
lea rcx, [rsp + 0x40]
call fcn.140054940
mov r13, qword [rsp + 0x70]
add rsp, 0x88
ret
call fcn.140005690
int3
Function at 0x1400a5b80
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rax, qword [0x1401bc798]
cmp byte [rax + 0x5fb0], 0
je 0x1400a5d5f
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rsi, qword [0x1401bb548]
mov qword [r11 - 0x10], r12
mov r12, qword [0x1401bb538]
mov qword [r11 - 0x18], r13
lea r13, [0x1401bb538]
mov qword [r11 - 0x20], r14
mov r14, qword [0x1401bc5e8]
mov qword [r11 - 0x28], r15
mov rbp, r14
mov r15, qword [0x1401bb550]
mov rbx, qword [r14 + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400a5c36
mov qword [r11 - 8], rdi
nop
mov rdi, qword [rbx + 0x30]
lea rcx, [rbx + 0x20]
cmp r15, 0xf
mov rdx, r13
cmova rdx, r12
cmp qword [rcx + 0x18], 0xf
jbe 0x1400a5c0d
mov rcx, qword [rcx]
cmp rsi, rdi
mov r8, rdi
cmovb r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a5c70
js 0x1400a5c75
mov rbp, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1400a5bf0
mov rdi, qword [rsp + 0x80]
cmp byte [rbp + 0x19], 0
jne 0x1400a5c80
cmp qword [rbp + 0x38], 0xf
lea rdx, [rbp + 0x20]
mov rbx, qword [rdx + 0x10]
jbe 0x1400a5c4e
mov rdx, qword [rdx]
cmp r15, 0xf
mov rcx, r13
mov r8, rsi
cmova rcx, r12
cmp rbx, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a5c7b
js 0x1400a5c80
jmp 0x1400a5c83
cmp rdi, rsi
jae 0x1400a5c22
mov rbx, qword [rbx + 0x10]
jmp 0x1400a5c28
cmp rsi, rbx
jae 0x1400a5c83
mov rbp, r14
mov r15, qword [rsp + 0x60]
cmp rbp, r14
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x98]
je 0x1400a5d5a
mov rdx, r13
lea rcx, [0x1401bc5e8]
call fcn.14009da30
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400a5d5a
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], reloc.WLDAP32.dll_Ordinal_200
call fcn.140021460
mov rcx, qword [0x1401bb168]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x14
jb 0x1400a5d67
cmp qword [0x1401bb170], 0xf
lea rax, [0x1401bb158]
movzx edx, byte [rsp + 0x90]
lea r9, str.actioninput_ntext_
cmova rax, qword [0x1401bb158]
lea r8, [0x1401bb158]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_sendto
call fcn.140005390
lea rcx, [rsp + 0x40]
call fcn.140054940
mov r13, qword [rsp + 0x70]
add rsp, 0x88
ret
call fcn.140005690
int3