joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400578c0
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x140057a68
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x140057925
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x140057925
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x140057925
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x14005795c
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x1400579b2
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400579b2
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400579b2
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400579b2
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400579b2
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.140057370
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x140057a14
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.140033af0
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.140057740
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140057a60
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.140033af0
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400591d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x140098080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], pe_nt_image_headers64
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x140059265
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x1400592c6
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.140033af0
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14006c360
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x140059381
sub ecx, 1
je 0x1400593f4
sub ecx, 1
je 0x140059330
cmp ecx, 1
je 0x140059313
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x140078b20]
call fcn.140033af0
jmp 0x1400593f4
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.140058f00
test eax, eax
je 0x1400593f4
jmp 0x14005929a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400593f4
sub rax, rsi
cmp rax, rbp
jae 0x1400593f4
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.140033c70
jmp 0x1400593f4
cmp r8d, 4
jle 0x1400593f4
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x1400593f4
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.140033a10
mov esi, eax
test eax, eax
je 0x1400593d3
mov edx, 5
mov rcx, rbx
call fcn.140059ec0
mov eax, esi
jmp 0x14005929a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.1400422f0
mov rcx, r14
call fcn.1400425d0
test eax, eax
je 0x140059298
mov edx, 5
mov rcx, rbx
call fcn.140059ec0
mov eax, Ordinal_45
jmp 0x14005929a
Function at 0x14006c190
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [fcn.14006d602]
mov rdi, rax
test rax, rax
jne 0x14006c1d2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x14006c219
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x14006c272
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x14006c230
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x14006c2b3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14007e2aa]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14007e2ab]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x14006c280
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::_Lockit::destructor_void____ptr64]

Function at 0x14006d25c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006d2a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006d2a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006d2a6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006d2a6
cmp dword [rcx + 0x84], 0xe
jbe 0x14006d2a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006d2a8
xor al, al
add rsp, 0x28
ret
Function at 0x1400a75a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400a75cd
xor al, al
jmp 0x1400a772f
mov rax, qword [0x1400c76b0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400c76b8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400c76c0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400c76c8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400c76d0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400c76d8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1400c76e0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1400c76e8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1400c76f0]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1400a7721
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1400a7679
mov r11d, 2
jmp 0x1400a769d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1400a7693
mov r11d, 1
jmp 0x1400a769d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1400a7745
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400a76e2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1400a76fa
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1400a770a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1400a7718
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1400a7660
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1400a772a
Function at 0x21e4213f0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xf0
mov r9d, 0x10
lea r8, str.Unknown_error
xor ecx, ecx
movabs rax, 0x56594a732e657865
movabs rdx, 0x6963255c35417148
mov qword [rsp + 0x30], rax
lea rbx, [rsp + 0x30]
movabs rax, 0x352626257075626c
mov qword [rsp + 0x40], rax
movabs rax, 0x732e657865262674
mov qword [rsp + 0x38], rdx
movabs rdx, 0x696d656f75742031
mov qword [rsp + 0x50], rax
movabs rax, 0x257075626c696325
mov qword [rsp + 0x48], rdx
movabs rdx, 0x5c3541714856594a
mov qword [rsp + 0x60], rax
movabs rax, 0x5227202d64657374
mov qword [rsp + 0x58], rdx
movabs rdx, 0x696e6174696f6e20
mov qword [rsp + 0x70], rax
movabs rax, 0x646f6334333f6861
mov qword [rsp + 0x68], rdx
movabs rdx, 0x73683d4167414463
mov qword [rsp + 0x80], rax
movabs rax, 0x756170702e636f6d
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2f3331353239392f
mov qword [rsp + 0x90], rax
movabs rax, 0x3439313366333736
mov qword [rsp + 0x88], rdx
movabs rdx, 0x30392e6865726f6b
mov qword [rsp + 0xa0], rax
movabs rax, 0x3a2f2f626f746675
mov qword [rsp + 0x98], rdx
movabs rdx, 0x73696f6e312d3866
mov qword [rsp + 0xb0], rax
movabs rax, 0x72202d736f757263
mov qword [rsp + 0xa8], rdx
movabs rdx, 0x6520276874747073
mov qword [rsp + 0xc0], rax
movabs rax, 0x746172742d626974
mov qword [rsp + 0xb8], rdx
movabs rdx, 0x737472616e736665
mov qword [rsp + 0xd0], rax
movabs rax, 0x20706f775e65725e
mov qword [rsp + 0xc8], rdx
movabs rdx, 0x7368655e6c6c2073
mov qword [rsp + 0xe0], rax
mov eax, 0x2f63
mov qword [rsp + 0xd8], rdx
lea rdx, str.The_data_is_invalid_
mov word [rsp + 0xe8], ax
mov byte [rsp + 0xea], 0
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov r11, rax
lea eax, [rax - 1]
test eax, eax
jle 0x21e4215f9
movsxd rdx, eax
mov rcx, rbx
add rdx, rbx
nop dword [rax]
movzx r8d, byte [rcx]
movzx r10d, byte [rdx]
add rcx, 1
sub rdx, 1
mov byte [rcx - 1], r10b
mov r10d, eax
sub eax, 1
mov byte [rdx + 1], r8b
mov r8d, r11d
sub r8d, r10d
cmp eax, r8d
jg 0x21e4215d0
mov dword [rsp + 0x28], 0
mov r9, rbx
lea r8, str.cmd.exe
xor ecx, ecx
mov qword [rsp + 0x20], 0
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
add rsp, 0xf0
pop rbx
ret

Function at 0x21e4217d0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.21e4224d0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.21e4224d0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x21e421840
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x21e428064]
mov r12, rcx
test ebx, ebx
jle 0x21e421970
mov rax, qword [0x21e428068]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x21e42188c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x21e421913
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x21e421870
mov rcx, r12
call fcn.21e421fc0
mov rsi, rax
test rax, rax
je 0x21e421992
mov rax, qword [0x21e428068]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.21e4220f0
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x21e428068]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x21e421977
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x21e42190c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x21e421920
add dword [0x21e428064], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x21e428068]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x21e42190c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.21e4217d0
nop dword [rax]
xor ebx, ebx
jmp 0x21e421897
mov rax, qword [0x21e428068]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.21e4217d0
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.21e4217d0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x21e421c30
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x21e4280a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x21e428080]
test rbx, rbx
je 0x21e421c84
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x21e421c7b
test r12, r12
je 0x21e421c7b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x21e421c60
lea rcx, [0x21e4280a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x21e421fc0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x21e424f80]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x21e421fe0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x21e421fe8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x21e421fe0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x21e422035
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x21e42202c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x21e421fe0
add rax, 0x28
cmp rax, r9
jne 0x21e422018
xor eax, eax
ret

Function at 0x21e422040
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x21e424f80]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x21e422060
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x21e422068
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x21e422060
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x21e4220f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x21e424f80]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x21e422110
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x21e422118
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x10e4898
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10e48a2
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x10e48cb
pop rbp
sub rbp, 0x33
sub rbp, 0xce4898
sub rsp, 0x20
jmp 0x10e48ea
mov rax, 0xce4898
add rax, rbp
add rax, 0x84
mov rcx, 0x647
mov rdx, 0xffffffffa8439a42
xor byte [rax], dl
inc rax
dec rcx
jne 0x10e4909
jmp 0x10e4920
or cl, bl
stosd dword [rdi], eax
leave
retf
Function at 0x1400072c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
movzx eax, byte [0x1400f08b1]
test eax, eax
jne 0x1400072d9
jmp 0x140007374
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x14000730d
mov rcx, qword [rsp + 0x30]
call fcn.140007280
movzx eax, al
test eax, eax
je 0x14000730d
mov edx, 0x10001
lea rcx, [0x1400f1530]
call fcn.1400152f0
jmp 0x140007374
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140007363
mov rcx, qword [rsp + 0x30]
call fcn.140007280
movzx eax, al
test eax, eax
jne 0x140007363
mov edx, 0x100
lea rcx, [0x1400f1530]
call fcn.1400152f0
mov edx, 0x10001
lea rcx, [0x1400f1530]
call fcn.1400152f0
mov edx, 0x100
lea rcx, [0x1400f1530]
call fcn.1400152f0
jmp 0x140007374
mov edx, 0x100
lea rcx, [0x1400f1530]
call fcn.1400152f0
add rsp, 0x28
ret

Function at 0x140007540
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
movzx eax, byte [0x1400f08be]
test eax, eax
jne 0x140007554
jmp 0x14000768d
mov dword [rsp + 0x20], 0x20
vmovss xmm0, dword [0x1400de9f4]
call fcn.140032630
vxorps xmm2, xmm2, xmm2
vmovss xmm1, dword [0x1400deca8]
lea rcx, [rsp + 0x24]
call fcn.140006790
xor edx, edx
mov rcx, rax
call fcn.140032520
mov r8d, dword [rsp + 0x20]
xor edx, edx
lea rcx, str.Cheats_List
call fcn.14002d410
movzx edx, byte [0x1400f08c8]
lea rcx, [0x1400de31c]
call fcn.140007510
movzx eax, byte [0x1400f08b3]
test eax, eax
je 0x1400075e2
movzx eax, byte [0x1400f08d8]
test eax, eax
jne 0x1400075d6
mov ecx, dword [0x1400e7098]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x1400075e2
lea rcx, str.Aimbot
call fcn.140072a50
movzx edx, byte [0x1400f08b2]
lea rcx, [0x1400de328]
call fcn.140007510
movzx edx, byte [0x1400f08b4]
lea rcx, str.Radar
call fcn.140007510
movzx eax, byte [0x1400f08a0]
test eax, eax
je 0x14000763b
movzx eax, byte [0x1400f08a5]
test eax, eax
jne 0x14000762f
mov ecx, dword [0x1400f08dc]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x14000763b
lea rcx, str.TriggerBot
call fcn.140072a50
movzx edx, byte [0x1400f0903]
lea rcx, str.Crosshair
call fcn.140007510
movzx edx, byte [0x1400f08a4]
lea rcx, str.Headshot_Line
call fcn.140007510
movzx edx, byte [0x1400f08a6]
lea rcx, str.No_Flash
call fcn.140007510
movzx edx, byte [0x1400f08b1]
lea rcx, str.Bhop
call fcn.140007510
call fcn.140030e80
nop
add rsp, 0x38
ret
Function at 0x140014e80
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x4d0
lea rbp, [rsp + 0x20]
mov rax, qword [0x1400e7010]
xor rax, rbp
mov qword [rbp + 0x4a0], rax
mov dword [rbp + 0x60], 0x438
mov rax, qword [rbp + 0x4c0]
mov edx, dword [rax + 0x10]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
call fcn.140014de0
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x90]
mov qword [rbp + 0x20], rax
cmp qword [rbp + 0x20], 0
jne 0x140014efd
mov qword [rbp + 0x30], 0
jmp 0x140014f9b
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 8]
cmp word [rax + rcx*2], 0
jne 0x140014f0d
mov rax, qword [rbp + 8]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x140014f3c
mov qword [rbp + 0x28], 0
jmp 0x140014f93
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x40], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x140014f64
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.1400babb0
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x40]
mov r8d, ecx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call fcn.140014df0
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x30], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.1400104a0
mov rcx, qword [rbp + 0x30]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x140014fc1
inc rcx
test dl, dl
jne 0x140014fae
xor eax, eax
jmp 0x140014fc6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140014ff1
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.140003750
mov rax, qword [rbp + 0x48]
jmp 0x140015029
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140014ede
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x50], 0
mov rcx, qword [rbp + 0x4c8]
call fcn.140003750
mov rax, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x4a0]
xor rcx, rbp
call fcn.1400b99c0
lea rsp, [rbp + 0x4b0]
pop rbp
ret
Function at 0x1400155f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x2c0
lea rbp, [rsp + 0x20]
mov rax, qword [0x1400e7010]
xor rax, rbp
mov qword [rbp + 0x290], rax
mov dword [rbp + 0x50], 0x238
xor edx, edx
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
call fcn.140014de0
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x7c]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140015662
mov qword [rbp + 0x38], 0
jmp 0x140015700
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x40], rax
mov qword [rbp + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 8]
cmp word [rax + rcx*2], 0
jne 0x140015672
mov rax, qword [rbp + 8]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x1400156a1
mov qword [rbp + 0x30], 0
jmp 0x1400156f8
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x48], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x1400156c9
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.1400babb0
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x48]
mov r8d, ecx
mov rdx, qword [rbp + 0x28]
mov rcx, rax
call fcn.140014df0
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x38], rax
mov rcx, qword [rbp + 0x2b8]
call fcn.1400104a0
mov rcx, qword [rbp + 0x38]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x140015726
inc rcx
test dl, dl
jne 0x140015713
xor eax, eax
jmp 0x14001572b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140015750
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x58]
mov dword [rbp + 0x1c], eax
mov rcx, qword [rbp + 0x2b8]
call fcn.140003750
mov eax, dword [rbp + 0x1c]
jmp 0x140015786
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140015646
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x20], 0
mov rcx, qword [rbp + 0x2b8]
call fcn.140003750
mov eax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x290]
xor rcx, rbp
call fcn.1400b99c0
lea rsp, [rbp + 0x2a0]
pop rbp
ret