joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000f480
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
movzx ecx, byte [rcx + 0x3c]
sub ecx, 1
je 0x18000f520
sub ecx, 1
je 0x18000f4cf
cmp ecx, 1
jne 0x18000f53c
cmp byte [rbx + 0x121], 0
mov byte [rbx + 0x3c], 2
je 0x18000f513
mov rcx, qword [rbx + 0x18]
movabs rax, 0x6666666666666667
sub rcx, qword [rbx + 0x10]
imul rcx
lea rcx, str.Playback_continued._Active_path:__d____d
jmp 0x18000f4f8
cmp byte [rbx + 0x121], 0
mov byte [rbx + 0x3c], 3
je 0x18000f513
mov rcx, qword [rbx + 0x18]
movabs rax, 0x6666666666666667
sub rcx, qword [rbx + 0x10]
imul rcx
lea rcx, str.Playback_paused._Active_path:__d____d
mov r8, rdx
mov edx, dword [rbx + 8]
sar r8, 5
inc edx
mov rax, r8
shr rax, 0x3f
add r8, rax
call fcn.1800359d0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18000e740
cmp dword [rbx + 0x28], 0
jg 0x18000f52d
mov dword [rbx + 0x28], 0x1388
mov rax, qword [rbx]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x20
pop rbx
ret

Function at 0x18000fc20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
movsxd r9, edx
mov rbx, rcx
test edx, edx
js 0x18000fd18
mov r8, qword [rcx + 0x18]
movabs rdi, 0x6666666666666667
sub r8, qword [rcx + 0x10]
mov rax, rdi
imul r8
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r9, rdx
jae 0x18000fd18
movzx eax, byte [rcx + 0x3c]
sub al, 2
mov dword [rcx + 8], r9d
cmp al, 1
jbe 0x18000fcd6
call fcn.180010180
mov r8, rax
cmp byte [rax + 0x3c], 0
jne 0x18000fcd6
mov rcx, qword [rax + 8]
sub rcx, qword [rax]
movabs rax, 0x7878787878787879
imul rcx
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x18000fcaf
mov dword [r8 + 0x38], 0
xorps xmm1, xmm1
lea r8, [rsp + 0x20]
xorps xmm0, xmm0
movss dword [rsp + 0x28], xmm1
unpcklps xmm0, xmm1
lea rdx, [rsp + 0x30]
mov rcx, rbx
movsd qword [rsp + 0x20], xmm0
call fcn.18000e310
mov rcx, qword [rbx + 0x18]
mov rax, rdi
sub rcx, qword [rbx + 0x10]
imul rcx
lea rcx, str.Path_with_index__d_is_now_the_active_path__out_of__d_paths
mov r8, rdx
mov edx, dword [rbx + 8]
sar r8, 5
inc edx
mov rax, r8
shr rax, 0x3f
add r8, rax
call fcn.180035790
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp fcn.18000e740
mov rbx, qword [rsp + 0x50]
mov dword [rcx + 8], 0xffffffff
add rsp, 0x40
pop rdi
ret
Function at 0x180014b90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x180014bf1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x180014bb0
mov ecx, dword [r10]
jmp 0x180014cda
cmp ecx, 0x4e0
jb 0x180014cda
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x180014c10
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x180014c60
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x18001a840
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [rcx + 0x1b8], 0
je 0x18001a856
cmp byte [rcx + 0x1b89], 0
je fcn.180019f30
ret

Function at 0x18001c400
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x30], xmm9
mov rbx, rcx
movaps xmmword [rsp + 0x20], xmm10
movaps xmm9, xmm2
movaps xmm10, xmm1
call fcn.1800298d0
test dword [rax + 0xcc], 0xfffffffd
jne 0x18001c629
cmp byte [rbx + 0x1b78], 0
jne 0x18001c629
movzx eax, byte [0x1801391b1]
mov qword [rsp + 0x70], rbp
and al, 0xf0
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
movzx edi, byte [0x1801391b0]
mov qword [rsp + 0x88], r14
and dil, 0xf0
movaps xmmword [rsp + 0x50], xmm6
movzx r14d, al
movaps xmmword [rsp + 0x40], xmm7
cmp dil, 0x80
je 0x18001c48a
cmp al, 0x80
je 0x18001c48a
mov sil, 1
jmp 0x18001c48d
xor sil, sil
call fcn.1800298d0
movd xmm6, dword [rbx + 0x1d8]
cvtdq2ps xmm6, xmm6
mulss xmm6, dword [rax + 0xdc]
call fcn.1800298d0
movd xmm7, dword [rbx + 0x1dc]
cvtdq2ps xmm7, xmm7
mulss xmm7, dword [rax + 0xdc]
call fcn.1800298d0
cmp byte [rax], 0
je 0x18001c4f1
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x18001c4eb
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x18001c4f1
xorps xmm6, xmm6
xorps xmm7, xmm7
mov rcx, qword [rbx + 0x1b70]
test sil, sil
xorps xmm7, xmmword [0x180116290]
mov rsi, qword [rsp + 0x78]
mov rax, qword [rcx]
je 0x18001c52e
mulss xmm7, xmm9
movaps xmm1, xmm7
call qword [rax + 0x30]
mov rcx, qword [rbx + 0x1b70]
mulss xmm6, xmm9
mov rax, qword [rcx]
movaps xmm1, xmm6
call qword [rax + 0x28]
jmp 0x18001c582
mulss xmm7, xmm10
movaps xmm1, xmm7
cmp dil, 0x80
jne 0x18001c541
call qword [rax + 0x20]
jmp 0x18001c544
call qword [rax + 0x10]
cmp dil, 0x80
jne 0x18001c56d
cmp r14b, dil
jne 0x18001c56d
xorps xmm6, xmmword [0x180116290]
mov rcx, qword [rbx + 0x1b70]
mulss xmm6, xmm9
mov rax, qword [rcx]
movaps xmm1, xmm6
call qword [rax + 0x38]
jmp 0x18001c582
mov rcx, qword [rbx + 0x1b70]
mulss xmm6, xmm10
mov rax, qword [rcx]
movaps xmm1, xmm6
call qword [rax + 0x18]
movsx ecx, word [rbx + 0x1d4]
movaps xmm7, xmmword [rsp + 0x40]
mov eax, ecx
movaps xmm6, xmmword [rsp + 0x50]
cdq
mov r14, qword [rsp + 0x88]
xor eax, edx
mov rdi, qword [rsp + 0x80]
sub eax, edx
mov rbp, qword [rsp + 0x70]
test eax, eax
jle 0x18001c619
mov rax, qword [rbx + 0x1b70]
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
mulss xmm1, dword [rbx + 0x1b84]
xorps xmm1, xmmword [0x180116290]
subss xmm1, dword [rax + 0x64]
mulss xmm1, dword [rax + 0x48]
addss xmm1, dword [rax + 0x64]
movaps xmm0, xmm1
movss dword [rax + 0x64], xmm1
andps xmm0, xmmword [0x180116270]
comiss xmm0, dword [0x180116144]
jbe 0x18001c5fb
mov byte [rax + 0x70], 1
addss xmm1, dword [rax + 0x30]
movss xmm0, dword [0x18011614c]
comiss xmm0, xmm1
movss dword [rax + 0x30], xmm1
jbe 0x18001c619
mov dword [rax + 0x30], 0x3a83126f
xor eax, eax
mov word [rbx + 0x1d4], ax
mov qword [rbx + 0x1d8], rax
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x20]
add rsp, 0x60
pop rbx
ret
Function at 0x18001d7a0
Capabilities:
Enumerate process modules

Disassembly:
push rbx
push r12
mov eax, 0x2278
call fcn.180078db0
sub rsp, rax
mov rax, qword [0x180133090]
xor rax, rsp
mov qword [rsp + 0x2250], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
test rax, rax
je 0x18001d990
xor edx, edx
lea rcx, [rsp + 0x2050]
mov r8d, 0x200
call fcn.18007c360
lea r9, [rsp + 0x20]
mov r8d, 0x2000
lea rdx, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x18001d990
mov eax, dword [rsp + 0x20]
mov qword [rsp + 0x2298], rbp
xor ebp, ebp
test rax, 0xfffffffffffffff8
jbe 0x18001d988
mov qword [rsp + 0x2268], r14
lea r14, [rsp + 0x50]
mov qword [rsp + 0x2260], r15
mov qword [rsp + 0x22a0], rsi
mov qword [rsp + 0x2270], rdi
nop dword [rax]
mov r15, qword [r14]
lea r8, [rsp + 0x30]
mov rdx, r15
mov r9d, 0x18
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x18001d94e
mov rcx, qword [rsp + 0x30]
lea rdx, str.connectFromCameraTools
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x18001d94e
mov rcx, qword [rsp + 0x30]
lea rdx, str.getDataFromCameraToolsBuffer
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x18001d94e
mov r9d, 0x200
lea r8, [rsp + 0x2050]
mov rdx, r15
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
call rsi
lea rdx, [rsp + 0x2050]
test al, al
jne 0x18001d8f4
lea rcx, str.Function_connectFromCameraTools_in_ReShade_5_addon__s_returned_false._Ignored.
call fcn.1800359d0
jmp 0x18001d94e
lea rcx, str.Connected_to_ReShade_5_addon:__s
call fcn.1800359d0
call rdi
mov qword [rsp + 0x28], rax
test rax, rax
je 0x18001d93f
mov rdx, qword [rbx + 0x1bb0]
lea rcx, [rbx + 0x1ba8]
cmp rdx, qword [rbx + 0x1bb8]
je 0x18001d930
mov qword [rdx], rax
add qword [rbx + 0x1bb0], 8
jmp 0x18001d93f
lea r8, [rsp + 0x28]
call fcn.18001eb10
mov rax, qword [rsp + 0x28]
mov rdx, rax
lea rcx, str.Buffer_for_data_from_tools_to_addon:__p
call fcn.180035790
mov ecx, dword [rsp + 0x20]
inc ebp
shr rcx, 3
add r14, 8
movsxd rax, ebp
cmp rax, rcx
jb 0x18001d860
mov r15, qword [rsp + 0x2260]
mov r14, qword [rsp + 0x2268]
mov rdi, qword [rsp + 0x2270]
mov rsi, qword [rsp + 0x22a0]
mov rbp, qword [rsp + 0x2298]
mov rcx, qword [rsp + 0x2250]
xor rcx, rsp
call fcn.180077bb0
add rsp, 0x2278
pop r12
pop rbx
ret
Function at 0x18002a700
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x18002a731
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x18002a7ab
mov rdi, r14
mov rcx, rbx
call fcn.18002c590
test rax, rax
jle 0x18002a783
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.18007bcb0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18002a79b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x18002a7a3
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x18002a745
sub r14, rdi
jmp 0x18002a88f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x18002a7c2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18002a7c4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18002a7f6
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.18007bcb0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18002a88c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18002a831
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x18002a86d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.18009f87c
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x18002a88c
cmp rbp, rax
ja 0x18002a840
test rbp, rbp
je 0x18002a88c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.18009f87c
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1800333e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx edi, dl
movzx ebx, cl
call fcn.1800298d0
movzx edx, bl
mov rcx, rax
call fcn.18002a150
mov rbx, rax
test rax, rax
je 0x1800334ed
cmp byte [rax + 0x27], 0
je 0x18003345b
mov ecx, dword [rax + 0x20]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x18003345b
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x18003344a
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x18003344a
xor al, al
jmp 0x18003344c
mov al, 1
cmp byte [rbx + 0x26], al
jne 0x18003345b
cmp dword [rbx + 0x28], 0
jg 0x18003345b
mov al, 1
jmp 0x18003345d
xor al, al
cmp byte [rbx + 0x24], 0
jne 0x180033474
cmp byte [rbx + 0x25], 0
jne 0x180033474
test dil, dil
je 0x180033474
test al, al
je 0x1800334ef
jmp 0x1800334d8
test al, al
je 0x1800334ed
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x1800334a0
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x1800334a0
xor al, al
jmp 0x1800334a2
mov al, 1
cmp al, byte [rbx + 0x24]
jne 0x1800334ed
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x1800334cf
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x1800334cf
xor al, al
jmp 0x1800334d1
mov al, 1
cmp al, byte [rbx + 0x25]
jne 0x1800334ed
mov al, 1
mov ecx, dword [rbx + 0x2c]
test ecx, ecx
jle 0x1800334ef
mov dword [rbx + 0x28], ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180035690
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1050
call fcn.180078db0
sub rsp, rax
mov rax, qword [0x180133090]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rax, qword gs:[0x58]
movzx ebx, cl
mov edx, dword [0x180137b54]
xor edi, edi
mov ecx, 4
mov rdx, qword [rax + rdx*8]
mov eax, dword [rcx + rdx]
cmp dword [0x180139580], eax
jle 0x180035731
lea rcx, [0x180139580]
call fcn.180077e94
cmp dword [0x180139580], 0xffffffff
jne 0x180035731
xorps xmm0, xmm0
mov qword [0x1801395a0], rdi
lea rcx, [0x1800ff010]
movdqa xmmword [0x180139590], xmm0
mov word [0x1801395a8], di
mov qword [0x1801395e8], rdi
mov qword [0x180139628], rdi
call fcn.1800783f0
lea rcx, [0x180139580]
call fcn.180077e34
cmp byte [0x1801395a8], dil
je 0x180035767
mov rcx, qword [0x180139590]
lea r9, [rsp + 0x30]
mov r8d, 3
mov word [rsp + 0x40], 0x1207
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x42], bl
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180077bb0
mov rbx, qword [rsp + 0x1060]
add rsp, 0x1050
pop rdi
ret
Function at 0x180036380
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xfb0]
mov eax, 0x10b0
call fcn.180078db0
sub rsp, rax
mov rax, qword [0x180133090]
xor rax, rsp
mov qword [rbp + 0xfa0], rax
movzx edi, r8b
mov rbx, rdx
mov rsi, rcx
call fcn.1800298d0
mov r14, rax
cmp qword [rax + 0x210], 0
je 0x180036554
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov edx, edi
sub edx, 3
je 0x18003643c
sub edx, 1
je 0x18003642b
sub edx, 1
je 0x18003641a
cmp edx, 1
jne 0x180036463
movsd xmm0, qword [str.__DEBUG__]
movzx eax, byte [0x180113898]
jmp 0x18003644b
movsd xmm0, qword [str.__ERROR__]
movzx eax, byte [0x180113888]
jmp 0x18003644b
movsd xmm0, qword [str.__IGCS___]
movzx eax, byte [0x1801138b8]
jmp 0x18003644b
movsd xmm0, qword [str._USERMSG_]
movzx eax, byte [0x1801138a8]
mov byte [rsp + 0x61], 0
mov byte [rsp + 0x60], al
movsd qword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], 9
xor ecx, ecx
call fcn.18009d768
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x38]
call fcn.18009e008
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov eax, dword [rax + 0x20]
mov dword [rbp - 0x68], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, str.__d__m__Y__H:_M:_S_
mov qword [rsp + 0x48], rax
inc rax
cmp byte [rax], 0
jne 0x1800364a5
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x40]
lea rcx, [r14 + 0x188]
call fcn.18002cfb0
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x68]
mov rcx, rax
call fcn.180020830
mov rcx, rax
call fcn.18002d290
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1800364f6
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.180020830
mov rcx, rax
call fcn.180020160
lea rcx, [r14 + 0x188]
call fcn.180020200
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x180036554
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003654f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800365d4
call fcn.180077bd0
cmp byte [rsi + 0x18], 0
je 0x1800365ad
cmp qword [rsi], 0xffffffffffffffff
je 0x1800365ad
cmp dil, 6
je 0x1800365ad
mov byte [rbp - 0x60], dil
lea rdi, [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x180036578
mov rbx, qword [rbx]
mov r9, qword [rdi]
mov r8, rbx
mov edx, 0xffe
lea rcx, [rbp - 0x5f]
call fcn.1800a0874
mov r8d, dword [rdi]
inc r8d
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
lea rdx, [rbp - 0x60]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0xfa0]
xor rcx, rsp
call fcn.180077bb0
lea r11, [rsp + 0x10b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.18008a744
int3
Function at 0x180039a90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rdi, qword [rcx]
mov qword [rsp + 0x48], rsi
mov rsi, rcx
call fcn.1800298d0
mov rbx, qword [rax + 0xb0]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rbx
sete al
mov byte [rdi + 0x28], al
mov rbp, qword [rsi]
cmp byte [rbp + 0x28], 0
je 0x180039b80
mov qword [rsp + 0x50], r14
call fcn.1800298d0
xorps xmm0, xmm0
mov r14, rax
lea rdx, [rax + 0x88]
movups xmmword [rdx], xmm0
mov ecx, dword [rax + 0x98]
call qword [sym.imp.XINPUT9_1_0.dll_XInputGetState]
movzx esi, word [r14 + 0x9c]
test eax, eax
movzx edi, word [r14 + 0x8c]
sete cl
mov byte [r14 + 0x9e], cl
cmp si, di
je 0x180039b6b
mov qword [rsp + 0x58], r15
xor di, si
mov r15d, 0x8000
mov ebx, 1
test dil, 1
je 0x180039b55
test sil, 1
je 0x180039b3a
mov rcx, qword [r14 + 0x80]
jmp 0x180039b3e
mov rcx, qword [r14 + 0x40]
test rcx, rcx
je 0x180039b55
movzx eax, bx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp bx, r15w
je 0x180039b66
shr di, 1
shr si, 1
add bx, bx
jmp 0x180039b25
mov r15, qword [rsp + 0x58]
movzx eax, word [r14 + 0x8c]
mov word [r14 + 0x9c], ax
mov r14, qword [rsp + 0x50]
mov rdi, qword [rbp + 0x10]
mov rbx, qword [rbp + 8]
mov rsi, qword [rsp + 0x48]
cmp rbx, rdi
je 0x180039bc0
mov rcx, qword [rbx]
movzx eax, byte [rbp + 0x28]
mov byte [rcx + 0x1d0], al
cmp byte [rbp + 0x28], 0
je 0x180039bae
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x38]
add rbx, 8
cmp rbx, rdi
jne 0x180039b92
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x18003ad80
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
movzx ebx, r8b
movzx esi, dl
mov rdi, rcx
mov edx, 4
call qword [sym.imp.USER32.dll_GetWindow]
test rax, rax
jne 0x18003afc8
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x18003afc8
mov ebp, 1
test bl, bl
jne 0x18003afcc
mov rbp, qword [0x180133f38]
test sil, sil
je 0x18003aef3
lea rcx, [rbp + 1]
mov eax, 2
mul rcx
mov rsi, 0xffffffffffffffff
cmovo rax, rsi
mov rcx, rax
call fcn.1800785a0
mov r14, rax
lea r8d, [rbp + 1]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, [0x180133f28]
cmp qword [0x180133f40], 8
cmovae rdx, qword [0x180133f28]
mov r8, rbp
mov rcx, r14
call fcn.1800a096c
xor edi, edi
mov ebp, edi
test eax, eax
sete bpl
test eax, eax
jne 0x18003afcc
lea ecx, [rsi + 0x19]
call fcn.180077be0
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18003ae7b
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x18003afec
jmp 0x18003ae7e
mov rbx, rdi
mov qword [rsp + 0x58], rbx
test rbx, rbx
je 0x18003afe1
cmp qword [rbx + 8], 0
jne 0x18003ae9f
mov rcx, qword [rbx]
call fcn.1800798d0
mov qword [rbx + 8], rax
mov rdx, qword [rbx + 8]
lea rcx, str.Window_found_with_class:__s
call fcn.180035790
nop
lock xadd dword [rbx + 0x10], esi
cmp esi, 1
jne 0x18003afcc
mov rcx, qword [rbx]
test rcx, rcx
je 0x18003aecf
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rdi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18003aee1
call fcn.180078598
mov qword [rbx + 8], rdi
mov edx, 0x18
mov rcx, rbx
call fcn.180077bd0
jmp 0x18003afcc
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [rax + 1]
movsxd rcx, ebx
mov eax, 2
mul rcx
mov rsi, 0xffffffffffffffff
cmovo rax, rsi
mov rcx, rax
call fcn.1800785a0
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [0x180133f28]
cmp qword [0x180133f40], 8
cmovae rdx, qword [0x180133f28]
mov r8, rbp
mov rcx, r14
call fcn.1800a096c
xor edi, edi
mov ebp, edi
test eax, eax
sete bpl
test eax, eax
jne 0x18003afcc
lea ecx, [rsi + 0x19]
call fcn.180077be0
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18003af92
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x18003aff7
jmp 0x18003af95
mov rbx, rdi
mov qword [rsp + 0x58], rbx
test rbx, rbx
je 0x18003afe1
cmp qword [rbx + 8], 0
jne 0x18003afb2
mov rcx, qword [rbx]
call fcn.1800798d0
mov qword [rbx + 8], rax
mov rdx, qword [rbx + 8]
lea rcx, str.Window_found_with_title:__s
call fcn.180035790
nop
jmp 0x18003aeb0
xor edi, edi
mov ebp, edi
mov eax, ebp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x8007000e
call fcn.180079770
nop
mov ecx, 0x8007000e
call fcn.180079770
nop
mov ecx, 0x8007000e
call fcn.180079770
int3
Function at 0x18003b090
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor esi, esi
mov rdi, rax
mov qword [rsp + 0x48], rsi
test rax, rax
je 0x18003b0ef
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 8]
mov rcx, rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModulesEx]
test eax, eax
jne 0x18003b113
mov qword [rsp + 0x48], rsi
mov qword [rbx], rsi
test rdi, rdi
je 0x18003b100
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x18003b0ef
mov r9d, 0x18
mov r8, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
jne 0x18003b0f7
mov qword [rbx], rsi
jmp 0x18003b0f7