joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009c120
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401b66f8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14009c1f3
cmp byte [rcx + 0x71], 0
je 0x14009c1f3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14009c1ef
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14009c1b4
sub eax, 1
je 0x14009c1b8
cmp eax, 2
jne 0x14009c1ef
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14012e5c0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14009c1e6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14009c1ef
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14009c19c
xor al, al
jmp 0x14009c19c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14012e5c0
add rsp, 0x60
pop rbx
ret
Function at 0x14009cb80
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
sub rsp, 0xa8
movaps xmm0, xmmword [0x140198050]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [0x140198060]
movaps xmmword [rsp + 0x40], xmm1
movaps xmm0, xmmword [0x140198070]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [0x140198080]
movaps xmmword [rsp + 0x60], xmm1
movaps xmm0, xmmword [0x140198090]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm1, xmmword [0x1401980a0]
movaps xmmword [r11 - 0x28], xmm1
movsd xmm0, qword [0x1401980b0]
movsd qword [r11 - 0x18], xmm0
mov eax, dword [0x1401980b8]
mov dword [r11 - 0x10], eax
movzx eax, word [0x1401980bc]
mov word [r11 - 0xc], ax
movzx eax, byte [str.4GPYZ]
mov byte [r11 - 0xa], al
xor ecx, ecx
mov dword [rsp + 0x20], ecx
cmp ecx, 0x6f
jge 0x14009cc3f
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
sub al, dl
add al, 0x32
xor al, byte [r8]
mov byte [r8], al
inc ecx
jmp 0x14009cc03
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x14009cc4c
add rsp, 0xa8
ret

Function at 0x14009cc90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1401b66f8]
xor rax, rsp
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14009cd4f
mov byte [rax], 0xc3
mov edx, dword [rsp + 0x2c]
lea r9, [rsp + 0x58]
mov r8d, 0x140
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14009cd4f
call rbx
nop
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14012e5c0
add rsp, 0x70
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14012e5c0
add rsp, 0x70
pop rbx
ret
Function at 0x14009cd70
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
movsd xmm0, qword [str.cS_PZ_]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [0x1401980e0]
mov dword [rsp + 0x28], eax
cmp byte [reloc.WLDAP32.dll_Ordinal_60], 0
je 0x14009cefe
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14009cec0
movdqa xmm4, xmmword [0x140198de0]
mov eax, 5
movd xmm6, eax
mov eax, Ordinal_33
movd xmm5, eax
movdqa xmm2, xmmword [0x140198b10]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140198bc0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140198ce0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140198d00]
movd xmm0, dword [str.cS_PZ_]
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
movdqa xmm3, xmmword [0x140198b20]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140198bc0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140198ce0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140198d00]
movd xmm0, dword [rsp + 0x24]
xorps xmm2, xmm0
movd dword [rsp + 0x24], xmm2
mov ecx, 8
mov eax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop word [rax + rax]
mov eax, 0x8fb823ef
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
sub al, dl
add al, 0x31
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0xc
jl 0x14009ced0
lea r8, [rsp + 0x20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
test rax, rax
je 0x14009cf39
mov edx, 2
mov r8d, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14009cf39
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
ret
Function at 0x14009d4c0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
sub rsp, 0xe8
mov r11, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x30]
movaps xmmword [rsp + 0xd0], xmm6
movaps xmm6, xmm0
call fcn.14009d710
mov r10, rax
cmp byte [rax + 0x62], 0
je 0x14009d6c1
xor r8d, r8d
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14009d681
movdqa xmm0, xmmword [0x140198d20]
mov eax, 4
movdqa xmm5, xmmword [0x140198b10]
mov rcx, r10
movdqa xmm4, xmmword [0x140198d60]
movaps xmmword [rsp + 0xc0], xmm7
movaps xmmword [rsp + 0xb0], xmm8
movdqa xmm8, xmmword [0x140198b80]
movd xmm7, eax
mov eax, Ordinal_33
movdqa xmmword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x20]
movaps xmmword [rsp + 0xa0], xmm9
movd xmm9, eax
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm7
movdqa xmm0, xmm1
psrld xmm0, xmm9
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140198ce0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 8], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm7
movdqa xmm0, xmm1
psrld xmm0, xmm9
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140198ce0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
cmp r8d, 0x60
jl 0x14009d560
movaps xmm9, xmmword [rsp + 0xa0]
movaps xmm8, xmmword [rsp + 0xb0]
movaps xmm7, xmmword [rsp + 0xc0]
cmp r8d, 0x63
jge 0x14009d6c1
movsxd r9, r8d
add r9, r10
nop word [rax + rax]
mov eax, 0x4d4873ed
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x35
movzx eax, r8b
inc r8d
sub al, dl
add al, 0x33
xor byte [r9 - 1], al
cmp r8d, 0x63
jl 0x14009d690
mov rdx, r10
mov rcx, r11
call fcn.14008b520
movaps xmm1, xmm6
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___float____ptr64]
lea rdx, [rsp + 0xf8]
mov dword [rsp + 0xf8], 0x5dc
lea rcx, [rsp + 0x100]
call fcn.14001e610
mov rcx, rax
call fcn.14001e620
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400b0c40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov rax, qword [0x140198698]
mov r10, 0xffffffffffffffff
mov qword [rsp + 0x48], rdi
mov rbx, rcx
xor edi, edi
mov dword [rcx + 0x20], r10d
cmp byte [0x14019869f], dil
mov dword [rcx], edi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x28], rdi
mov qword [rsp + 0x40], rax
je 0x1400b0de1
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1400b0da5
movdqa xmm2, xmmword [0x140198b10]
mov eax, 4
movdqa xmm4, xmmword [0x140198d70]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x140198b20]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movaps xmmword [rsp + 0x20], xmm6
movd xmm6, eax
mov eax, Ordinal_33
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movd xmm5, eax
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140198b70]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x40]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140198ce0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140198d00]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x40], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movaps xmm6, xmmword [rsp + 0x20]
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140198b70]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x44]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140198ce0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140198d00]
xorps xmm2, xmm0
movd dword [rsp + 0x44], xmm2
jmp 0x1400b0de1
lea r9, [rsp + 0x40]
mov r8d, edi
nop dword [rax]
mov eax, 0x4ec4ec4f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9 - 1], al
cmp r8d, 8
jl 0x1400b0db0
xorps xmm0, xmm0
lea rax, [rsp + 0x40]
movups xmmword [rbx + 0x30], xmm0
mov qword [rbx + 0x40], rdi
mov qword [rbx + 0x48], rdi
mov rdi, qword [rsp + 0x48]
nop word [rax + rax]
inc r10
cmp byte [rax + r10], 0
jne 0x1400b0e00
mov r8, r10
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x30]
call fcn.14001fd20
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400b34f0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401b6830]
movaps xmmword [rsp + 0x20], xmm6
xorps xmm6, xmm6
movss xmm0, dword [rax + 0x94]
ucomiss xmm0, xmm6
jp 0x1400b3516
je 0x1400b3681
call fcn.1400adfd0
test al, al
je 0x1400b3681
mov rax, qword [0x1401bb9b8]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movabs rsi, 0x7fffffffffffffff
mov qword [rsp + 0x30], rdi
cmp dword [rax + 4], 0
je 0x1400b35ed
movabs rdi, 0x7ffffffffff0bdbe
nop word [rax + rax]
mov rax, qword [0x1401b6830]
movss xmm0, dword [rax + 0x94]
ucomiss xmm0, xmm6
jp 0x1400b3576
je 0x1400b35f4
call fcn.1400adfd0
test al, al
je 0x1400b35ed
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1400b359d
imul rax, rax, 0x64
jmp 0x1400b35bb
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jg 0x1400b35cd
add rax, 0xf4240
mov qword [rsp + 0x40], rax
jmp 0x1400b35d2
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x40]
call fcn.140024100
mov rax, qword [0x1401bb9b8]
cmp dword [rax + 4], 0
jne 0x1400b3560
mov rax, qword [0x1401b6830]
cvttss2si eax, dword [rax + 0x98]
movsxd rbx, eax
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x1400b361d
imul rax, rax, 0x64
jmp 0x1400b363b
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
cmp rbx, 1
jl 0x1400b366d
imul rdx, rbx, 0xf4240
mov rcx, rsi
sub rcx, rdx
cmp rax, rcx
jge 0x1400b3668
lea rcx, [rdx + rax]
mov qword [rsp + 0x40], rcx
jmp 0x1400b366d
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x40]
call fcn.140024100
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rax, qword [0x1401bb9b8]
cmp dword [rax + 4], 0
je 0x1400b3766
call fcn.1400b2ff0
test al, al
je 0x1400b3766
mov rax, qword [0x1401b6830]
movss xmm0, dword [rax + 0x64]
comiss xmm0, xmm6
jbe 0x1400b3766
movss xmm0, dword [rax + 0x88]
ucomiss xmm0, xmm6
jp 0x1400b36d3
jne 0x1400b36d3
call fcn.14009ed80
test al, al
jne 0x1400b36f5
mov rax, qword [0x1401b6830]
movss xmm0, dword [rax + 0x88]
ucomiss xmm0, xmm6
jp 0x1400b36e6
je 0x1400b3766
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x1401bb0d8]
jne 0x1400b3766
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rcx, qword [0x1401b6830]
test ax, ax
js 0x1400b371b
movss xmm0, dword [rcx + 0x8c]
ucomiss xmm0, xmm6
jp 0x1400b3766
jne 0x1400b3766
movss xmm0, dword [rcx + 0x94]
ucomiss xmm0, xmm6
jp 0x1400b372a
je 0x1400b373a
call fcn.1400adfd0
test al, al
jne 0x1400b3766
mov rcx, qword [0x1401b6830]
movss xmm0, dword [rcx + 0x9c]
ucomiss xmm0, xmm6
jp 0x1400b3749
je 0x1400b375a
mov ecx, dword [reloc.WS2_32.dll_recv]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1400b3766
mov al, 1
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
ret
movaps xmm6, xmmword [rsp + 0x20]
xor al, al
add rsp, 0x38
ret
Function at 0x1400c5df0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
xor r10d, r10d
mov edi, r8d
mov rbx, rdx
mov r11d, 0x7fffffff
test ecx, ecx
jle 0x1400c5e56
mov qword [rsp + 0x10], rsi
imul edi, r9d
mov r9, rdx
mov esi, ecx
nop word [rax + rax]
mov eax, dword [rbx + 4]
mov ecx, r11d
imul eax, dword [rbx]
lea rbx, [rbx + 0x10]
mov r8, r10
mov r10, r9
sub eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, r11d
cmovl r11d, eax
cmp eax, ecx
cmovge r10, r8
add r9, 0x10
sub rsi, 1
jne 0x1400c5e20
mov rsi, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rax, r10
pop rdi
ret

Function at 0x1400c6760
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov qword [0x1401b9ff8], rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1400c67b9
mov rcx, qword [rbx + 0x368]
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [rsp + 0x40]
movd xmm1, dword [rsp + 0x44]
cvtdq2pd xmm0, xmm0
cvtdq2pd xmm1, xmm1
movsd qword [0x1401b9fe8], xmm0
movsd qword [0x1401b9ff0], xmm1
mov eax, dword [rbx + 0x90]
cmp eax, 0x34001
je 0x1400c67d6
cmp eax, 0x34004
je 0x1400c67d6
mov rcx, qword [0x1401ba018]
jmp 0x1400c67f5
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x1400c67e5
mov rcx, qword [rcx + 8]
jmp 0x1400c67f5
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov rcx, rbx
call fcn.1400c1ea0
mov rcx, rbx
call fcn.1400c5d70
cmp dword [rbx + 0x210], 0
je 0x1400c6852
mov rax, qword [rbx + 0x368]
lea rcx, [rsp + 0x20]
mov edx, 1
mov qword [rsp + 0x20], 0x20001
mov qword [rsp + 0x28], rax
lea r8d, [rdx + 0xf]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400c6852
lea rdx, str.Win32:_Failed_to_register_raw_input_device
mov ecx, 0x10008
call fcn.1400c8ed0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400c6860
Capabilities:
Register raw input devices

Disassembly:
sub rsp, 0x38
mov edx, 1
mov dword [rsp + 0x20], 0x20001
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x24], edx
mov qword [rsp + 0x28], 0
lea r8d, [rdx + 0xf]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400c68a2
lea rdx, str.Win32:_Failed_to_remove_raw_input_device
mov ecx, 0x10008
call fcn.1400c8ed0
add rsp, 0x38
ret
Function at 0x1400c68b0
Capabilities:
Register raw input devices

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x210], 0
mov rbx, rcx
je 0x1400c6900
mov edx, 1
mov dword [rsp + 0x20], 0x20001
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x24], edx
mov qword [rsp + 0x28], 0
lea r8d, [rdx + 0xf]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400c6900
lea rdx, str.Win32:_Failed_to_remove_raw_input_device
mov ecx, 0x10008
call fcn.1400c8ed0
xor ecx, ecx
mov qword [0x1401b9ff8], 0
call qword [sym.imp.USER32.dll_ClipCursor]
cvttsd2si ecx, qword [0x1401b9fe8]
mov qword [0x1401ba000], 0
lea rdx, [rsp + 0x40]
cvttsd2si eax, qword [0x1401b9ff0]
mov dword [rsp + 0x40], ecx
mov dword [rbx + 0x3a8], ecx
mov rcx, qword [rbx + 0x368]
mov dword [rsp + 0x44], eax
mov dword [rbx + 0x3ac], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, dword [rbx + 0x90]
cmp eax, 0x34001
je 0x1400c6989
cmp eax, 0x34004
je 0x1400c6989
mov rcx, qword [0x1401ba018]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.USER32.dll_SetCursor]
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x1400c69a2
mov rcx, qword [rcx + 8]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.USER32.dll_SetCursor]
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
add rsp, 0x30
pop rbx
jmp qword [sym.imp.USER32.dll_SetCursor]

Function at 0x1400c69c0
Capabilities:
Register raw input devices

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 0x368]
mov edx, 1
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], 0x20001
mov qword [rsp + 0x28], rax
lea r8d, [rdx + 0xf]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400c6a02
lea rdx, str.Win32:_Failed_to_register_raw_input_device
mov ecx, 0x10008
call fcn.1400c8ed0
add rsp, 0x38
ret

Function at 0x1400c6ab0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
mov ecx, reloc.WS2_32.dll_recvfrom
shr ebx, 0xf
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, ebx
mov esi, 0x8000
or edi, 2
mov ecx, reloc.WS2_32.dll_select
test si, ax
cmove edi, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
and ax, si
mov ecx, 0x5c
mov esi, edi
or esi, 4
test ax, ax
cmove esi, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x5b
movzx ebx, ax
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, esi
mov ecx, reloc.WS2_32.dll_sendto
or edi, 8
or bx, ax
cmovns edi, esi
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, edi
mov ecx, 0x90
or ebx, 0x10
test al, 1
cmove ebx, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov rsi, qword [rsp + 0x38]
mov ecx, ebx
or ecx, 0x20
test al, 1
cmove ecx, ebx
mov rbx, qword [rsp + 0x30]
mov eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x1400c80e0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx + 4], eax
cmp eax, 0xffffffff
jne 0x1400c8110
lea rdx, str.Win32:_Failed_to_allocate_TLS_index
mov ecx, 0x10008
call fcn.1400c0a60
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov dword [rbx], 1
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1400c9280
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [0x1401b66f8]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
xor edx, edx
lea rcx, [rsp + 0xa0]
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [0x1401b9912]
mov r8d, 0x6d1
call sub.VCRUNTIME140.dll_memset
lea r14, [rsp + 0x40]
mov qword [rsp + 0x1d0], rdi
sub r14, 0x480
lea rbp, [0x1401b9698]
xor r12d, r12d
lea r15, [0x1401b99b2]
mov ebx, reloc.WLDAP32.dll_Ordinal_32
movsx esi, word [rbp]
cmp esi, 0xffffffff
je 0x1400c9438
cmp ebx, 0x140
jb 0x1400c939f
cmp ebx, 0x14e
ja 0x1400c939f
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x44], 0x61
mov dword [rsp + 0x48], 0x62
mov dword [rsp + 0x4c], 0x63
mov dword [rsp + 0x50], 0x64
mov dword [rsp + 0x54], 0x65
mov dword [rsp + 0x58], 0x66
mov dword [rsp + 0x5c], 0x67
mov dword [rsp + 0x60], WSAGetLastError
mov dword [rsp + 0x64], WSAGetLastError
mov dword [rsp + 0x68], WSAGetLastError
mov dword [rsp + 0x6c], reloc.WS2_32.dll_WSAGetLastError
mov dword [rsp + 0x70], WSAGetLastError
mov dword [rsp + 0x74], WSAGetLastError
mov dword [rsp + 0x78], WSAGetLastError
mov edi, dword [r14]
jmp 0x1400c93ae
mov edx, 1
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
mov dword [rsp + 0x28], r12d
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xa0]
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov edx, esi
mov ecx, edi
call qword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 0xffffffff
jne 0x1400c9401
mov dword [rsp + 0x28], r12d
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xa0]
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov edx, esi
mov ecx, edi
call qword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
jl 0x1400c9438
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x80]
mov qword [rsp + 0x30], r12
mov r9d, 1
mov dword [rsp + 0x28], 5
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
inc ebx
add r15, 5
add r14, 4
add rbp, 2
cmp ebx, 0x15c
jle 0x1400c9301
mov rdi, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14012e5c0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret