joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801d4560
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor ebp, ebp
lea rsi, [rcx + 0x98]
cmp dword [rcx + 0x24], 0xcc
mov rbx, rcx
je 0x1801d459c
mov rax, qword [rcx + 0x200]
call qword [rax]
mov dword [rsi], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x200]
mov qword [rsp + 0x30], rdi
cmp byte [rax + 0x10], bpl
je 0x1801d4620
nop
mov eax, dword [rsi]
cmp eax, dword [rbx + 0x78]
jae 0x1801d45f8
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1801d45d6
mov dword [rcx + 8], eax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rcx, rbx
mov rax, qword [rbx + 0x10]
call qword [rax]
mov rax, qword [rbx + 0x208]
xor r9d, r9d
mov edi, dword [rsi]
mov r8, rsi
xor edx, edx
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov eax, dword [rsi]
cmp eax, edi
je 0x1801d464e
cmp eax, dword [rbx + 0x78]
jb 0x1801d45b7
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax]
mov dword [rsi], ebp
mov rax, qword [rbx + 0x200]
cmp byte [rax + 0x10], bpl
jne 0x1801d45b0
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
xor al, al
jmp 0x1801d4633
Function at 0x1801e09e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
mov rcx, qword [rcx]
test rcx, rcx
jne 0x1801e09fa
xor eax, eax
xor edx, edx
jmp 0x1801e0a00
mov eax, dword [rcx + 0x18]
mov edx, dword [rcx + 0x14]
mov dword [rsp + 0x4c], edx
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], 0
mov rax, qword [rcx]
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x30]
call qword [rax + 0x20]
nop
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x1801e0b5a
sub ecx, 1
je 0x1801e0b5a
sub ecx, 1
je 0x1801e0aba
cmp ecx, 1
jne 0x1801e0b5a
xor r9d, r9d
mov r10d, dword [rsp + 0x50]
test r10d, r10d
jle 0x1801e0b5a
mov r8d, dword [rsp + 0x4c]
movsxd rcx, dword [rsp + 0x44]
movsxd rax, r9d
imul rcx, rax
add rcx, qword [rsp + 0x30]
xor edx, edx
test r8d, r8d
jle 0x1801e0aad
nop dword [rax]
movzx eax, byte [rcx]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm6
cvttss2si eax, xmm0
mov byte [rcx], al
movsxd rax, dword [rsp + 0x48]
add rcx, rax
inc edx
mov r8d, dword [rsp + 0x4c]
cmp edx, r8d
jl 0x1801e0a80
mov r10d, dword [rsp + 0x50]
inc r9d
cmp r9d, r10d
jl 0x1801e0a64
jmp 0x1801e0b5a
xor r10d, r10d
mov r8d, dword [rsp + 0x50]
test r8d, r8d
jle 0x1801e0b5a
movss xmm1, dword [0x1805ca500]
mov ecx, dword [rsp + 0x4c]
nop word [rax + rax]
movsxd rdx, dword [rsp + 0x44]
movsxd rax, r10d
imul rdx, rax
add rdx, qword [rsp + 0x30]
xor r9d, r9d
test ecx, ecx
jle 0x1801e0b52
movaps xmm0, xmm6
mulss xmm0, xmm1
cvttss2si eax, xmm0
mov r8d, 1
sub r8d, eax
nop dword [rax]
mov ecx, dword [rdx]
mov eax, ecx
shr eax, 8
and eax, 0xff00ff
imul eax, r8d
and ecx, 0xff00ff
imul ecx, r8d
shr ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rdx], ecx
movsxd rax, dword [rsp + 0x48]
add rdx, rax
inc r9d
mov ecx, dword [rsp + 0x4c]
cmp r9d, ecx
jl 0x1801e0b10
mov r8d, dword [rsp + 0x50]
inc r10d
cmp r10d, r8d
jl 0x1801e0ae0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1801e0b6e
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x1801f4c70
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x18065f280]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rcx
movzx eax, byte [rcx + 0x1ed]
nop
test al, al
jne 0x1801f4e5a
lea r15, [0x180660030]
lea r12, [0x180660020]
nop dword [rax]
mov eax, dword [rdi + 0x270]
nop
test eax, eax
js 0x1801f4e42
mov r9d, 0xc8
lea rdx, [rdi + 0x298]
lea rcx, [rdi + 0x270]
call fcn.180183ca0
cmp eax, 1
jne 0x1801f4e42
mov eax, dword [rdi + 0x270]
nop
test eax, eax
js 0x1801f4e42
cmp byte [rdi + 0x274], 0
je 0x1801f4e42
mov byte [rsp + 0x20], 1
movsxd rax, dword [rdi + 0x270]
nop
mov rbp, rax
mov dword [rsp + 0x28], 1
lea r8, [rsp + 0x28]
mov edx, 0x8004667e
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor ebx, ebx
lea rcx, [rdi + 0x298]
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x1801f4d7d
xor r9d, r9d
mov r8d, 0x3ff
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
mov ebp, eax
lea rcx, [rdi + 0x298]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebp, ebp
jle 0x1801f4d7d
movzx ecx, byte [rsp + 0x20]
nop
mov ebx, ebp
cmp ebx, 0xa
jle 0x1801f4e42
movsxd rsi, ebx
cmp byte [rsp + 0x40], 0
je 0x1801f4dc8
lea rbx, [rsi + 4]
and rbx, 0xfffffffffffffffc
lea rcx, [rbx + 0x17]
call fcn.18011de94
xor ecx, ecx
xchg dword [rax], ecx
mov qword [rax + 8], rbx
lea rbx, [rax + 0x10]
mov r8, rsi
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.18037edb0
mov byte [rbx + rsi], 0
mov qword [rsp + 0x28], rbx
jmp 0x1801f4dd0
mov qword [rsp + 0x28], r15
mov rbx, r15
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.180170310
nop
lea rcx, [rbx - 0x10]
cmp rcx, r12
je 0x1801f4dfe
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1801f4dfe
call fcn.18011d9c0
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1801f4e28
mov rdx, qword [rdi + 0x2c8]
mov rcx, qword [rbx + 0x18]
call fcn.18001c500
test eax, eax
jne 0x1801f4e28
mov rdx, rbx
mov rcx, rdi
call fcn.1801f49d0
nop
test rbx, rbx
je 0x1801f4e42
mov rcx, rbx
call fcn.18016b630
mov edx, 0x20
mov rcx, rbx
call fcn.18011d9c0
mov rcx, rdi
call fcn.1801f4560
movzx eax, byte [rdi + 0x1ed]
nop
test al, al
je 0x1801f4cc0
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18011d9a0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1801f5ca0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov ebp, r8d
mov r12, rdx
mov rdi, rcx
xor ebx, ebx
lea rdx, [rcx + 8]
lea rcx, [rsp + 0x28]
call fcn.18000fed0
nop
mov r14, qword [rdi + 0x180]
test r14, r14
je 0x1801f5d78
movzx eax, byte [r14 + 0x20]
nop
test al, al
je 0x1801f5dc4
movzx eax, byte [r14 + 0x21]
nop
test al, al
jne 0x1801f5dc4
movsxd rax, dword [r14 + 0x1c]
nop
mov r13, rax
mov dword [rsp + 0x20], ebx
lea r8, [rsp + 0x20]
mov edx, 0x8004667e
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test ebp, ebp
jle 0x1801f5d76
nop dword [rax]
movsxd rdi, ebx
add rdi, r12
mov esi, ebp
sub esi, ebx
lea rcx, [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x1801f5d6c
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
lea rcx, [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jle 0x1801f5d6c
movzx ecx, byte [r14 + 0x20]
nop
test cl, cl
je 0x1801f5d6c
add ebx, edi
cmp ebx, ebp
jl 0x1801f5d20
jmp 0x1801f5d76
mov eax, 0xffffffff
test ebx, ebx
cmove ebx, eax
jmp 0x1801f5dc9
mov rbx, qword [rdi + 0x188]
test rbx, rbx
je 0x1801f5dc4
mov edi, dword [rdi + 0x198]
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x20]
call fcn.18000fed0
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x1801f5db3
mov r9d, edi
mov r8d, ebp
mov rdx, r12
call fcn.180014b70
mov ebx, eax
jmp 0x1801f5db8
mov ebx, 0xffffffff
mov rcx, qword [rsp + 0x20]
call fcn.180175220
jmp 0x1801f5dc9
mov ebx, 0xffffffff
mov rcx, qword [rsp + 0x28]
call fcn.180175220
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801f6270
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov r14, rdx
mov rbp, rcx
mov eax, dword [rcx + 0x194]
mov dword [rsp + 0x70], eax
mov eax, dword [rdx + 8]
mov dword [rsp + 0x74], eax
mov rbx, qword [rdx + 8]
add rbx, 8
mov esi, 0
mov edi, esi
mov qword [rsp + 0x20], rsi
je 0x1801f62d6
mov qword [rsp + 0x28], rbx
xor ecx, ecx
call fcn.180124068
mov rcx, rbx
call fcn.180124500
mov rdi, rax
test rax, rax
je 0x1801f63ce
mov qword [rsp + 0x20], rax
jmp 0x1801f62de
mov rbx, rsi
mov qword [rsp + 0x28], rbx
mov r8d, 8
cmp rbx, r8
jae 0x1801f62f1
mov r8, rbx
test rbx, rbx
je 0x1801f62fe
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.18037edb0
mov r8, qword [r14 + 8]
lea rax, [r8 + 8]
cmp rax, rbx
jbe 0x1801f630f
lea r8, [rbx - 8]
test r8, r8
je 0x1801f6320
lea rcx, [rdi + 8]
mov rdx, qword [r14]
call fcn.18037edb0
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x70]
call fcn.18000fed0
nop
mov rcx, qword [rbp + 0x180]
test rcx, rcx
je 0x1801f637e
movzx eax, byte [rcx + 0x21]
nop
test al, al
jne 0x1801f636d
movzx eax, byte [rcx + 0x20]
nop
test al, al
je 0x1801f636d
movsxd rcx, dword [rcx + 0x1c]
nop
xor r9d, r9d
mov rbx, qword [rsp + 0x28]
mov r8d, ebx
mov rdi, qword [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_send]
jmp 0x1801f639c
mov esi, 0xffffffff
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
jmp 0x1801f639e
mov rcx, qword [rbp + 0x188]
test rcx, rcx
je 0x1801f639e
mov r9d, dword [rbp + 0x198]
mov r8d, ebx
mov rdx, rdi
call fcn.18015f000
mov esi, eax
mov rcx, qword [rsp + 0x70]
call fcn.180175220
cmp esi, ebx
sete bl
mov rcx, rdi
call fcn.180124068
movzx eax, bl
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x30]
call fcn.1800034b0
lea rdx, [0x18065b1f0]
lea rcx, [rsp + 0x30]
call fcn.1801204b8
int3

Function at 0x1801f89d0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea r9, str._w_w
lea r8, [0x1803b0478]
lea rcx, [rsp + 0x50]
call fcn.180057bb0
mov esi, 0xdc00
mov ebp, 0xdfff
mov r14d, 0xd800
mov rbx, qword [rax]
nop
movzx ecx, word [rbx]
lea eax, [rcx - 0xd800]
cmp eax, 0x7ff
ja 0x1801f8a42
movzx edx, word [rbx + 2]
cmp dx, si
jb 0x1801f8a42
mov ecx, edx
shl eax, 0xa
sub ecx, esi
or ecx, eax
call fcn.180125430
test eax, eax
je 0x1801f8a68
movzx eax, word [rbx]
add rbx, 2
cmp ax, r14w
jb 0x1801f8a20
cmp ax, bp
ja 0x1801f8a20
cmp word [rbx], si
jb 0x1801f8a20
add rbx, 2
jmp 0x1801f8a20
mov rdx, rbx
mov rcx, rdi
call fcn.18001d210
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x180212dd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov esi, edx
mov rbx, rcx
add rcx, 0xa0
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov r8d, dword [rbx + 0x54]
mov rdx, qword [rbx + 0x48]
lea rcx, [rsp + 0x20]
call fcn.180069880
lea rcx, [rbx + 0xa0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r8d, esi
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.180066ea0
lea rcx, [0x180660030]
mov qword [rsp + 0xa0], rcx
mov rcx, qword [rax + 0x30]
add rcx, 0xfffffffffffffff0
lea rdi, [0x180660020]
cmp rcx, rdi
je 0x180212e57
lock inc dword [rcx]
mov rcx, qword [rax + 0x30]
xchg qword [rsp + 0xa0], rcx
add rcx, 0xfffffffffffffff0
mov ebx, 0xffffffff
cmp rcx, rdi
je 0x180212e82
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, ebx
jne 0x180212e82
call fcn.18011d9c0
mov rax, qword [rsp + 0xa0]
cmp byte [rax], 0
je 0x180212eb8
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0xb0]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x180212eb8
mov sil, 1
jmp 0x180212ebb
xor sil, sil
mov rcx, qword [rsp + 0xa0]
add rcx, 0xfffffffffffffff0
cmp rcx, rdi
je 0x180212edc
lock xadd dword [rcx], ebx
dec ebx
cmp ebx, 0xffffffff
jne 0x180212edc
call fcn.18011d9c0
lea rcx, [rsp + 0x30]
call fcn.180060f00
mov edx, dword [rsp + 0x2c]
test edx, edx
jle 0x180212f07
mov rbx, qword [rsp + 0x20]
mov edi, edx
mov rcx, rbx
call fcn.180060f00
add rbx, 0x60
sub rdi, 1
jne 0x180212ef5
mov rcx, qword [rsp + 0x20]
call fcn.180124068
movzx eax, sil
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18023e400
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test dl, dl
je 0x18023e49b
mov ecx, reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx edx, ax
mov eax, dword [0x18067b530]
shr edx, 0xf
test dl, 1
je 0x18023e437
mov edx, eax
and dl, 7
cmp dl, 4
je 0x18023e49b
cmp byte [rbx + 0x245], 0
jne 0x18023e48f
mov ebx, 0x1b
mov ecx, ebx
call qword [sym.imp.USER32.dll_VkKeyScanW]
cmp al, 0xff
je 0x18023e454
movzx ebx, al
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x18023e46c
test byte [0x18067b530], 7
je 0x18023e49b
xor eax, eax
mov qword [rsp + 0x20], SafeArrayGetDim
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], eax
call fcn.180287d50
test al, al
jne 0x18023e49b
mov eax, dword [0x18067b530]
shr eax, 1
not al
and al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x18024bc40
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
test dl, dl
je 0x18024bcf0
mov ecx, 0x26
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x18024bce9
mov ecx, 0x21
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x18024bce9
mov ecx, 0x28
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x18024bce9
mov ecx, 0x22
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x18024bce9
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x18024bce9
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x18024bce9
mov qword [rsp + 0x20], rbx
mov ebx, SafeArrayGetDim
mov ecx, ebx
call qword [sym.imp.USER32.dll_VkKeyScanW]
cmp al, 0xff
je 0x18024bcd5
movzx ebx, al
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rbx, qword [rsp + 0x20]
shr eax, 0xf
test al, 1
je 0x18024bcf0
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x18024f960
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
test dl, dl
je 0x18024f9b7
mov ecx, 0x26
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x18024f9b0
mov ecx, 0x25
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x18024f9b0
mov ecx, 0x28
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x18024f9b0
mov ecx, 0x27
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x18024f9b7
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x18027f020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rsi, rdx
mov rdi, rcx
mov rax, rcx
test rcx, rcx
je 0x18027f051
mov r8, qword [rax + 0x68]
test r8, r8
je 0x18027f048
mov rbx, qword [r8 + 0x10]
test rbx, rbx
jne 0x18027f059
mov rax, qword [rax + 0x30]
test rax, rax
jne 0x18027f036
call fcn.1802778d0
mov rbx, rax
mov r8d, 0x100f001
lea rdx, [rsp + 0xa0]
mov rcx, rbx
call fcn.1802b76d0
mov r8d, 0x100f003
lea rdx, [rsp + 0x90]
mov rcx, rbx
call fcn.1802b76d0
cmp byte [rdi + 0x6a8], 0
je 0x18027f0b6
mov eax, dword [rdi + 0x6a0]
add eax, dword [rdi + 0x698]
movd xmm3, eax
movd xmm4, dword [rdi + 0x69c]
mov rcx, qword [rdi + 0x698]
mov rdx, rcx
shr rdx, 0x20
jmp 0x18027f0d6
mov r8, qword [rdi + 0x698]
mov rdx, r8
shr rdx, 0x20
movd xmm3, r8d
movd xmm4, edx
mov ecx, dword [rdi + 0x6a0]
add ecx, r8d
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x90], eax
mov byte [rsp + 0x93], 0
cvtdq2ps xmm4, xmm4
cvtdq2ps xmm3, xmm3
movd xmm2, edx
cvtdq2ps xmm2, xmm2
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
mov dword [rsp + 0x98], eax
movsd xmm0, qword [0x1805ca310]
movsd qword [rsp + 0xa8], xmm0
movzx eax, byte [rsp + 0xa8]
mov byte [rsp + 0x9b], al
mov byte [rsp + 0x28], 0
unpcklps xmm3, xmm4
movsd qword [rsp + 0x20], xmm3
mov r9d, dword [rsp + 0x90]
unpcklps xmm1, xmm2
movq r8, xmm1
mov edx, dword [rsp + 0x98]
lea rcx, [rsp + 0x40]
call fcn.1801f2370
nop
mov rdx, rax
mov rcx, rsi
call fcn.1801e7630
nop
xor ebx, ebx
mov dword [rsp + 0x64], ebx
mov rcx, qword [rsp + 0x58]
call fcn.180124068
movups xmm0, xmmword [rdi + 0x698]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
xor r8d, r8d
lea rdx, [rsp + 0x30]
call qword [rax + 0xb0]
mov ecx, dword [rdi + 0x6a0]
mov edx, dword [rdi + 0x40]
sub edx, ecx
mov eax, ebx
cmp byte [rdi + 0x6a8], al
cmove eax, ecx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], ebx
test edx, edx
cmovg ebx, edx
mov dword [rsp + 0x38], ebx
mov eax, dword [rdi + 0x44]
mov dword [rsp + 0x3c], eax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
cmp byte [rsi + 0x10], 0
je 0x18027f1e1
mov byte [rsi + 0x10], 0
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
call qword [rax + 0x68]
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x28]
mov edx, dword [rsp + 0xa0]
mov rcx, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
jmp fcn.1801f3cd0

Function at 0x180287d50
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, dword [rcx]
mov rdi, rcx
bt ebx, 0x10
jae 0x180287d6a
movzx ebx, bx
jmp 0x180287d7a
movzx ecx, bx
call qword [sym.imp.USER32.dll_VkKeyScanW]
cmp al, 0xff
je 0x180287d7a
movzx ebx, al
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x180287da3
mov eax, dword [rdi + 4]
xor eax, dword [0x18067b530]
test al, 7
jne 0x180287da3
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x1802892f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
mov byte [rcx + 0x20e], 0
mov r8d, dword [rcx - 0xb4]
mov eax, dword [rcx - 0xb8]
xor ecx, ecx
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], r8d
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov r8b, 1
lea rdx, [rsp + 0x20]
lea rcx, [rsi - 0xf8]
call fcn.1802a1ae0
xor edx, edx
mov rcx, rbx
call fcn.180193250
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18018e080
nop
lea rbp, [0x180660020]
mov rbx, qword [rsp + 0x40]
cmp byte [rbx], 0
je 0x1802893fb
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x1802893f6
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x1802893be
cmp eax, 0xffffffff
je 0x1802893be
mov al, 1
jmp 0x1802893c0
xor al, al
cmp al, byte [rsi + 0x20c]
jne 0x1802893f6
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rbx
lea rax, [rbx - 0x10]
cmp rax, rbp
je 0x1802893e3
lock inc dword [rax]
mov rbx, qword [rsp + 0x40]
lea rdx, [rsp + 0x20]
lea rcx, [rsi - 0xf8]
call fcn.180288e60
jmp 0x1802893fb
mov rbx, qword [rsp + 0x40]
lea rcx, [rbx - 0x10]
cmp rcx, rbp
je 0x180289419
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x180289419
call fcn.18011d9c0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18028a830
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r15d, r9d
mov r14, rdx
mov rsi, rcx
mov ebp, dword [rdx + 0xc]
sub ebp, 1
js 0x18028a9ae
lea r12, [0x180660020]
xor r13d, r13d
nop dword [rax + rax]
mov edx, ebp
mov rcx, r14
call fcn.180193250
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.18018e080
nop
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x30]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x18028a97f
cmp eax, 0xffffffff
je 0x18028a97f
cmp dword [rsi + 0x80], 0
jbe 0x18028a8e9
mov rax, qword [rsi + 0x140]
mov ecx, dword [rax + 0x1fc]
sub ecx, dword [rax + 0x3c]
sub ecx, dword [rsi + 0x7c]
lea eax, [r15 + rcx]
cdq
idiv dword [rsi + 0x16c]
mov edx, eax
cmp eax, dword [rsi + 0x168]
jb 0x18028a8ee
mov edx, 0xffffffff
lea rcx, [rsi + 0x20]
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea rbx, [rax - 0x10]
lea r8, [rsp + 0x20]
cmp rbx, r12
je 0x18028a92f
lock inc dword [rbx]
call fcn.180019a30
mov eax, 0xffffffff
lock xadd dword [rbx], eax
dec eax
cmp eax, 0xffffffff
jne 0x18028a934
mov rcx, rbx
call fcn.18011d9c0
jmp 0x18028a934
call fcn.180019a30
lea rcx, [rsi + 0x40]
call fcn.1802baed0
mov edx, dword [rsi + 0x84]
mov eax, dword [rsi + 0x80]
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], edx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm0
mov r8b, 1
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x40]
call fcn.1802a1ae0
lea rcx, [rsi - 0xf8]
call fcn.18028b480
nop
mov rcx, qword [rsp + 0x88]
add rcx, 0xfffffffffffffff0
cmp rcx, r12
je 0x18028a9a5
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x18028a9a5
call fcn.18011d9c0
sub ebp, 1
jns 0x18028a870
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18028cd90
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 8]
lea rbx, [rcx + 0xf0]
mov rcx, qword [rcx + 0xe8]
call fcn.1802906b0
movzx edx, al
mov rcx, rbx
call fcn.18029c740
mov rcx, qword [rdi + 8]
lea rbx, [rcx + 0x530]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x58]
mov rdx, qword [rcx + 0xe8]
mov eax, dword [rdx + 0x138]
shr eax, 1
test al, 1
je 0x18028ce1d
add rdx, 0x140
lea rcx, [rsp + 0x30]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x18028ce1d
cmp eax, 0xffffffff
je 0x18028ce1d
mov dl, 1
mov rcx, rbx
mov rax, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp rax
xor edx, edx
mov rcx, rbx
mov rax, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp rax
Function at 0x18028eec0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
lea rcx, [rsp + 0x38]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x18028ef63
cmp eax, 0xffffffff
je 0x18028ef63
lea rcx, [rbx - 0xe8]
mov rdx, rdi
call fcn.1802900e0
mov eax, dword [rbx + 0x50]
test al, 8
je 0x18028efb1
bt eax, 8
jb 0x18028efb1
lea rcx, [rbx + 0x280]
lea rbx, [0x180660020]
lea rax, [rbx + 0x10]
mov qword [rsp + 0x38], rax
mov r8b, 1
lea rdx, [rsp + 0x38]
call fcn.180243320
nop
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff0
cmp rcx, rbx
je 0x18028efb1
mov edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, 0xffffffff
jne 0x18028efb1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18011d9c0
lea rdx, [rbx - 0xe8]
lea rcx, [rsp + 0x40]
call fcn.180067e60
nop
lea rcx, [rbx + 0x70]
mov qword [rsp + 0x38], rdi
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
call fcn.1800d0700
nop
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x18028efb1
mov edx, 0xffffffff
lock xadd dword [rax + 8], edx
cmp edx, 1
jne 0x18028efb1
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret