joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6bac1ab0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
test r8, r8
mov rbx, rcx
mov rdi, rdx
mov rsi, r8
jne 0x6bac1ae0
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov ecx, dword [0x6bb0f040]
test ecx, ecx
jle 0x6bac1cb7
mov rax, qword [0x6bb0f038]
xor ebp, ebp
nop word [rax + rax]
mov rdx, qword [rax + 8]
cmp rbx, rdx
jb 0x6bac1b1d
mov r8, qword [rax + 0x10]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6bac1c30
add ebp, 1
add rax, 0x18
cmp ebp, ecx
jne 0x6bac1b00
mov rcx, rbx
call fcn.6bac2ab0
test rax, rax
mov r12, rax
je 0x6bac1cbe
movsxd rbp, ebp
lea r13, [rbp + rbp*2]
shl r13, 3
mov rbp, r13
add rbp, qword [0x6bb0f038]
mov qword [rbp + 0x10], rax
mov dword [rbp], 0
call fcn.6bac2ba0
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x50]
mov qword [rbp + 8], rax
mov rax, qword [0x6bb0f038]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rax + r13 + 8]
call rbp
test rax, rax
je 0x6bac1ccd
mov eax, dword [rsp + 0x74]
cmp eax, 4
jne 0x6bac1bf0
add dword [0x6bb0f040], 1
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call rbp
test rax, rax
je 0x6bac1cea
mov eax, dword [rsp + 0x44]
cmp eax, 4
jne 0x6bac1c40
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
cmp eax, 0x40
je 0x6bac1ba0
mov r9, qword [0x6bb0f038]
mov r8d, 0x40
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
add r9, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6bac1ba0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.6bac1a40
nop dword [rax]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x6bac1ba7
cmp eax, 0x40
je 0x6bac1bc9
lea r9, [rsp + 0x8c]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rbp
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x44]
cmp eax, 0x40
je 0x6bac1acd
cmp eax, 4
je 0x6bac1acd
mov r8d, dword [rsp + 0x8c]
mov rdx, qword [rsp + 0x38]
lea r9, [rsp + 0x8c]
mov rcx, qword [rsp + 0x20]
call rbp
nop
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor ebp, ebp
jmp 0x6bac1b28
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.6bac1a40
mov rax, qword [0x6bb0f038]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + r13 + 8]
call fcn.6bac1a40
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, rbx
mov edx, 0x30
call fcn.6bac1a40
nop
nop
Function at 0x6bac2760
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6bb0f8a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6bb0f8c8]
test rbx, rbx
je 0x6bac27b4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rdi
mov rbp, rax
call rsi
test eax, eax
jne 0x6bac27ab
test rbp, rbp
je 0x6bac27ab
mov rax, qword [rbx + 8]
mov rcx, rbp
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6bac2790
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x6bb0f8a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax

Function at 0x6bac2990
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
je 0x6bac29a0
repz ret
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x6bac2999
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x140004cb8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140004ce9
xor eax, eax
jmp 0x140004eed
mov rax, qword [rsp + 0x30]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 0x88]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
test rax, rax
jne 0x140004d33
xor eax, eax
jmp 0x140004eed
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
add rax, qword [rsp + 0x80]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x1c]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x20]
mov dword [rsp + 0x1c], eax
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x24]
mov dword [rsp + 0x20], eax
mov qword [rsp + 8], 0
jmp 0x140004d98
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x48]
cmp qword [rsp + 8], rax
jae 0x140004eeb
mov eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 8]
lea rax, [rax + rcx*4]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 8]
lea rax, [rax + rcx*2]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
movzx ecx, word [rcx]
lea rax, [rax + rcx*4]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov qword [rsp], 0
mov qword [rsp], 0
jmp 0x140004e42
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
movsx eax, byte [rax]
test eax, eax
je 0x140004ea0
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movsx eax, byte [rax]
test eax, eax
je 0x140004ea0
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
movsx eax, byte [rax]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 0x28]
add rdx, rcx
mov rcx, rdx
movsx ecx, byte [rcx]
cmp eax, ecx
je 0x140004e9e
jmp 0x140004ea0
jmp 0x140004e37
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
movsx eax, byte [rax]
test eax, eax
jne 0x140004ee6
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movsx eax, byte [rax]
test eax, eax
jne 0x140004ee6
mov rax, qword [rsp + 0x60]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x140004eed
jmp 0x140004d8b
xor eax, eax
add rsp, 0x78
ret
Function at 0x140004ef2
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
mov qword [rsp + 0x30], 0
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov rdi, rax
lea rsi, [rcx + 0x10]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x18], rax
cmp qword [rsp + 0x18], 0
je 0x14000511c
mov rax, qword [rsp + 0x18]
cmp qword [rax + 0x30], 0
je 0x14000511c
mov rax, qword [rsp + 0x18]
cmp qword [rax + 0x60], 0
jne 0x140004f78
jmp 0x140004f4e
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x10], rax
mov qword [rsp], 0
mov qword [rsp], 0
jmp 0x140004fa3
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
test eax, eax
je 0x1400050da
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
test eax, eax
je 0x1400050da
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
cmp eax, 0x5a
jg 0x140005034
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
cmp eax, 0x41
jl 0x140005034
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
sub eax, 0x41
add eax, 0x61
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp]
movzx edx, word [rsp + 0x20]
mov word [rax + rcx*2], dx
movzx eax, word [rsp + 0x20]
mov dword [rsp + 0x24], eax
jmp 0x140005048
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
mov dword [rsp + 0x24], eax
movzx eax, word [rsp + 0x24]
mov word [rsp + 8], ax
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
cmp eax, 0x5a
jg 0x1400050aa
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
cmp eax, 0x41
jl 0x1400050aa
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
sub eax, 0x41
add eax, 0x61
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp]
movzx edx, word [rsp + 0x28]
mov word [rax + rcx*2], dx
movzx eax, word [rsp + 0x28]
mov dword [rsp + 0x2c], eax
jmp 0x1400050bb
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
mov dword [rsp + 0x2c], eax
movzx eax, word [rsp + 0x2c]
mov word [rsp + 0xc], ax
movzx eax, word [rsp + 8]
movzx ecx, word [rsp + 0xc]
cmp eax, ecx
je 0x1400050d5
jmp 0x1400050da
jmp 0x140004f98
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
test eax, eax
jne 0x14000510a
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp]
movzx eax, word [rax + rcx*2]
test eax, eax
jne 0x14000510a
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x30]
jmp 0x14000511e
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
mov qword [rsp + 0x18], rax
jmp 0x140004f4e
xor eax, eax
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x180011fa0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x18003d040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movzx ebx, dl
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor edx, edx
mov ecx, ebx
mov esi, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r9d, eax
cmp bl, 1
jne 0x180011fec
mov byte [0x18003dd86], 0
jmp 0x180012000
cmp bl, 2
je 0x180011ff9
sub bl, 4
cmp bl, 2
ja 0x180012000
mov byte [0x18003dd86], 1
lea eax, [rsi - 0x21]
cmp eax, 0x84
ja case.0x180012025.41
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x120b0]
mov ecx, dword [rdx + rax*4 + 0x120a8]
add rcx, rdx
jmp rcx
bts r9d, 8
shl r9d, 0x10
lea rdx, [rsp + 0x30]
mov ecx, r9d
mov r8d, 0x80
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov r8, 0xffffffffffffffff
mov qword [rdi + 0x18], 0
inc r8
cmp byte [rax + r8], 0
jne 0x180012066
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.180004500
mov rax, rdi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18002c840
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18001eb50
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
sub rsp, 0x70
mov rax, qword [0x18003d040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, qword [0x18003dd70]
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov qword [rsp + 0x90], rdi
call fcn.180008420
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180006cd0
mov rdi, rax
mov rax, qword [rax + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x18001eb9f
mov rdi, qword [rdi]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r15
cmp rax, 0x14
jb 0x18001ec26
lea rsi, [rax + rdi]
mov edx, 0x41
lea r8, [rsi - 0x13]
mov rcx, rdi
sub r8, rdi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x18001ec26
movabs r14, 0x52746c7561737341
movabs r15, 0x7275425f656c6669
cmp qword [rbx], r14
jne 0x18001ec07
cmp qword [rbx + 8], r15
jne 0x18001ec07
cmp dword [rbx + 0x10], 0x435f7473
je 0x18001ec82
inc rbx
lea r8, [rsi - 0x13]
sub r8, rbx
mov rcx, rbx
mov edx, 0x41
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x18001ebf3
mov rbx, 0xffffffffffffffff
mov rdx, qword [rsp + 0x48]
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
cmp rdx, 0xf
jbe 0x18001ec8c
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ec87
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001ec87
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rbx, rdi
jmp 0x18001ec2d
call fcn.18002c8a4
cmp rbx, 0xffffffffffffffff
je 0x18001ed77
cmp byte [0x18003d0f0], 0
je 0x18001ecd6
mov ecx, dword [0x18003d134]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18001ecd6
inc dword [0x18003d120]
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x18003d120]
cmp ecx, 5
jne 0x18001ecdc
xor ecx, ecx
mov dword [0x18003d120], ecx
jmp 0x18001ecdc
mov ecx, dword [0x18003d120]
test ecx, ecx
je 0x18001ed48
sub ecx, 1
je 0x18001ecf4
sub ecx, 1
je 0x18001ed33
sub ecx, 1
je 0x18001ed1e
cmp ecx, 1
je 0x18001ed09
lea rcx, str.Default__Burst_Atlas_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__Burst_Atlas_v2_PrimaryAsset_C
jmp 0x18001ed5b
lea rcx, str.Default__Burst_Oni2_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__Burst_Oni2_Lv4_PrimaryAsset_C
jmp 0x18001ed5b
lea rcx, str.Default__Burst_Protocol_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__Burst_Protocol_PrimaryAsset_C
jmp 0x18001ed5b
lea rcx, str.Default__Burst_Arcade_v2_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__Burst_Arcade_Lv4_PrimaryAsset_C
jmp 0x18001ed5b
lea rcx, str.Default__AssaultRifle_Burst_Cyberpunk_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__AssaultRifle_Burst_Cyberpunk_Lv4_PrimaryAsset_C
mov rbx, rax
call fcn.180007a80
mov r9d, 4
mov r8, rax
mov rdx, rbx
mov rcx, rbp
call fcn.18001a890
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18002c840
add rsp, 0x70
pop rbp
ret
Function at 0x18001f050
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
sub rsp, 0x60
mov rax, qword [0x18003d040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, qword [0x18003dd70]
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov qword [rsp + 0x80], rdi
call fcn.180008420
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180006cd0
mov rdi, rax
mov rax, qword [rax + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x18001f09f
mov rdi, qword [rdi]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
cmp rax, 5
jb 0x18001f0fd
lea rsi, [rax + rdi]
mov edx, 0x44
lea r8, [rsi - 4]
mov rcx, rdi
sub r8, rdi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x18001f0fd
nop
cmp dword [rbx], 0x5f524d44
jne 0x18001f0de
cmp byte [rbx + 4], 0x43
je 0x18001f14c
inc rbx
lea r8, [rsi - 4]
sub r8, rbx
mov rcx, rbx
mov edx, 0x44
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x18001f0d0
mov rbx, 0xffffffffffffffff
mov rdx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x18001f156
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001f151
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001f151
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rbx, rdi
jmp 0x18001f104
call fcn.18002c8a4
cmp rbx, 0xffffffffffffffff
je 0x18001f258
cmp byte [0x18003d0f0], 0
je 0x18001f1a0
mov ecx, dword [0x18003d134]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18001f1a0
inc dword [0x18003d128]
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x18003d128]
cmp eax, 6
jne 0x18001f1a6
xor eax, eax
mov dword [0x18003d128], eax
jmp 0x18001f1a6
mov eax, dword [0x18003d128]
cmp eax, 5
ja case.0x18001f1be.2
lea rcx, [0x180000000]
cdqe
mov edx, dword [rcx + rax*4 + 0x1f270]
add rdx, rcx
jmp rdx
lea rcx, str.Default__DMR_HypeBeast_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__DMR_HypeBeast_Lv4_PrimaryAsset_C
jmp 0x18001f23c
lea rcx, str.Default__DMR_SoulStealer_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__DMR_SoulStealer_Lv4_PrimaryAsset_C
jmp 0x18001f23c
lea rcx, str.Default__DMR_Sovereign_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__DMR_Sovereign_Lv4_PrimaryAsset_C
jmp 0x18001f23c
lea rcx, str.Default__DMR_Afterglow_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__DMR_Afterglow_Lv4_PrimaryAsset_C
jmp 0x18001f23c
lea rcx, str.Default__DMR_Oni_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__DMR_Oni_Lv4_PrimaryAsset_C
jmp 0x18001f23c
lea rcx, str.Default__DMR_King_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__DMR_King_Lv4_PrimaryAsset_C
mov rbx, rax
call fcn.180007a80
mov r9d, 4
mov r8, rax
mov rdx, rbx
mov rcx, rbp
call fcn.18001a890
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18002c840
add rsp, 0x60
pop rbp
ret
Function at 0x18001f600
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
sub rsp, 0x60
mov rax, qword [0x18003d040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, qword [0x18003dd70]
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov qword [rsp + 0x80], rdi
call fcn.180008420
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180006cd0
mov rdi, rax
mov rax, qword [rax + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x18001f64f
mov rdi, qword [rdi]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x88], r14
cmp rax, 0xd
jb 0x18001f6c4
lea rsi, [rax + rdi]
mov edx, 0x4c
lea r8, [rsi - 0xc]
mov rcx, rdi
sub r8, rdi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x18001f6c4
movabs r14, 0x736950726567754c
cmp qword [rbx], r14
jne 0x18001f6a5
cmp dword [rbx + 8], 0x5f6c6f74
jne 0x18001f6a5
cmp byte [rbx + 0xc], 0x43
je 0x18001f71b
inc rbx
lea r8, [rsi - 0xc]
sub r8, rbx
mov rcx, rbx
mov edx, 0x4c
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x18001f691
mov rbx, 0xffffffffffffffff
mov rdx, qword [rsp + 0x48]
mov r14, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x18001f725
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001f720
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001f720
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rbx, rdi
jmp 0x18001f6cb
call fcn.18002c8a4
cmp rbx, 0xffffffffffffffff
je 0x18001f7f6
cmp byte [0x18003d0f0], 0
je 0x18001f76f
mov ecx, dword [0x18003d134]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18001f76f
inc dword [0x18003d12c]
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x18003d12c]
cmp ecx, 4
jne 0x18001f775
xor ecx, ecx
mov dword [0x18003d12c], ecx
jmp 0x18001f775
mov ecx, dword [0x18003d12c]
test ecx, ecx
je 0x18001f7c7
sub ecx, 1
je 0x18001f7b2
sub ecx, 1
je 0x18001f79d
cmp ecx, 1
jne 0x18001f7c7
lea rcx, str.Default__LugerPistol_Ashen_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__LugerPistol_Ashen_Lv4_PrimaryAsset_C
jmp 0x18001f7da
lea rcx, str.Default__Luger_Magepunk_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__Luger_Magepunk_Lv4_PrimaryAsset_C
jmp 0x18001f7da
lea rcx, str.Default__Luger_King_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__Luger_King_Lv4_PrimaryAsset_C
jmp 0x18001f7da
lea rcx, str.Default__LugerPistol_Sovereign_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__LugerPistol_Sovereign_Purple_PrimaryAsset_C
mov rbx, rax
call fcn.180007a80
mov r9d, 4
mov r8, rax
mov rdx, rbx
mov rcx, rbp
call fcn.18001a890
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18002c840
add rsp, 0x60
pop rbp
ret
Function at 0x18001f810
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
sub rsp, 0x60
mov rax, qword [0x18003d040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, qword [0x18003dd70]
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov qword [rsp + 0x80], rdi
call fcn.180008420
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180006cd0
mov rdi, rax
mov rax, qword [rax + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x18001f85f
mov rdi, qword [rdi]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
cmp rax, 0x13
jb 0x18001f8c8
lea rsi, [rax + rdi]
mov edx, 0x53
lea r8, [rsi - 0x12]
mov rcx, rdi
sub r8, rdi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x18001f8c8
nop
mov r8d, 0x13
lea rdx, str.SubMachineGun_MP5_C
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18001f917
inc rbx
lea r8, [rsi - 0x12]
sub r8, rbx
mov rcx, rbx
mov edx, 0x53
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x18001f890
mov rbx, 0xffffffffffffffff
mov rdx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x18001f921
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001f91c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001f91c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rbx, rdi
jmp 0x18001f8cf
call fcn.18002c8a4
cmp rbx, 0xffffffffffffffff
je 0x18001fa23
cmp byte [0x18003d0f0], 0
je 0x18001f96b
mov ecx, dword [0x18003d134]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18001f96b
inc dword [0x18003d118]
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x18003d118]
cmp eax, 6
jne 0x18001f971
xor eax, eax
mov dword [0x18003d118], eax
jmp 0x18001f971
mov eax, dword [0x18003d118]
cmp eax, 5
ja case.0x18001f989.2
lea rcx, [0x180000000]
cdqe
mov edx, dword [rcx + rax*4 + 0x1fa3c]
add rdx, rcx
jmp rdx
lea rcx, str.Default__MP5_King_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__MP5_King_Lv4_PrimaryAsset_C
jmp 0x18001fa07
lea rcx, str.Default__MP5_Protocol_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__MP5_Protocol_Lv4_PrimaryAsset_C
jmp 0x18001fa07
lea rcx, str.Default__MP5_Oblivion2_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__MP5_Oblivion2_Lv4_PrimaryAsset_C
jmp 0x18001fa07
lea rcx, str.Default__MP5_Comicbook_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__MP5_Comicbook_Lv3_PrimaryAsset_C
jmp 0x18001fa07
lea rcx, str.Default__SubMachineGun_MP5_HypeBeast_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__SubMachineGun_MP5_HypeBeast_PrimaryAsset_C
jmp 0x18001fa07
lea rcx, str.Default__MP5_Soulstealer2_PrimaryAsset_C
call fcn.180007a80
lea rcx, str.Default__MP5_Soulstealer2_Lv4_PrimaryAsset_C
mov rbx, rax
call fcn.180007a80
mov r9d, 4
mov r8, rax
mov rdx, rbx
mov rcx, rbp
call fcn.18001a890
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18002c840
add rsp, 0x60
pop rbp
ret