joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c6d0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov dword [rsp + 0x70], 0
mov dword [rsp + 0x74], 0x800
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.d3dx11_43.dll_D3DX11CompileFromMemory]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
jge 0x14001c7bd
cmp qword [rsp + 0x78], 0
je 0x14001c79f
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x78]
call qword [rax + Ordinal_26]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp qword [rsp + 0x78], 0
je 0x14001c7b7
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x78]
call qword [rax + reloc.WS2_32.dll_recv]
mov eax, dword [rsp + 0x70]
jmp 0x14001c7d7
cmp qword [rsp + 0x78], 0
je 0x14001c7d5
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x78]
call qword [rax + reloc.WS2_32.dll_recv]
xor eax, eax
add rsp, 0x88
ret
Function at 0x14002a1e0
Capabilities:
Create process on windows

Disassembly:
mov byte [rsp + 0x20], r9b
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xc8
mov rax, qword [0x140441080]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movzx eax, byte [rsp + 0xf0]
cmp eax, 1
jne 0x14002a22e
call fcn.140065ba0
movss xmm1, dword [rax + 0x50]
xorps xmm0, xmm0
call fcn.140075ee0
call fcn.140065ba0
mov ecx, reloc.WS2_32.dll_recv
imul rcx, rcx, 0x17
lea rax, [rax + rcx + 0xc4]
mov rdx, rax
xor ecx, ecx
call fcn.140065e10
movss xmm0, dword [0x14042fccc]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x14042fc68]
movss xmm2, dword [0x14042fb6c]
movss xmm1, dword [0x14042fa2c]
lea rcx, [rsp + 0x60]
call fcn.140012570
mov rdx, qword [rsp + 0xe0]
mov rcx, rax
call fcn.1400a29c0
mov ecx, 1
call fcn.140065eb0
xor ecx, ecx
call fcn.140068550
movzx eax, al
test eax, eax
je 0x14002a379
xor edx, edx
xor ecx, ecx
call fcn.14006d260
movzx eax, al
test eax, eax
je 0x14002a31a
mov r8, qword [rsp + 0xe8]
lea rdx, str._C_start
lea rcx, [rsp + 0x90]
call fcn.1400544d0
lea rcx, [rsp + 0x90]
call fcn.1400133c0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, str.cmd.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rsp + 0x90]
call fcn.140013490
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
call fcn.140065ba0
mov ecx, reloc.WS2_32.dll_recv
imul rcx, rcx, 0x17
lea rax, [rax + rcx + 0xc4]
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call fcn.140021980
lea rcx, [rsp + 0x40]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
call fcn.14002a110
mov rdx, qword [rsp + 0xe0]
lea rcx, str._Open_in_browser_n_s
call fcn.140077920
jmp 0x14002a3c5
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
call fcn.140065ba0
mov ecx, reloc.WS2_32.dll_recv
imul rcx, rcx, 0x16
lea rax, [rax + rcx + 0xc4]
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call fcn.140021980
lea rcx, [rsp + 0x50]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x50]
call fcn.14002a110
movzx eax, byte [rsp + 0xf8]
cmp eax, 1
jne 0x14002a3e5
call fcn.140065ba0
movss xmm1, dword [rax + 0x50]
xorps xmm0, xmm0
call fcn.140075ee0
nop
mov rcx, qword [rsp + 0xe8]
call fcn.140013490
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14013adc0
add rsp, 0xc8
pop rdi
pop rsi
ret
Function at 0x140050400
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x140050439
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140050527
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x1400504cf
cmp qword [rsp + 0x20], 0
jle 0x1400504cf
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x140050479
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.1400145d0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x140050517
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x140050517
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x140050530
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
cmp qword [rsp + 0x70], 0
jg 0x140050552
xor eax, eax
jmp 0x1400506fb
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x68], 0
je 0x140050578
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x1400506fb
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x140050611
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.14000fc20
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400145d0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x80], 0
je 0x1400506eb
mov rcx, qword [rsp + 0x60]
call fcn.1400521e0
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x1400506b2
mov rax, qword [rsp + 0x60]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x1400506b0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x1400506fb
jmp 0x140050637
cmp qword [rsp + 0x20], 0
jbe 0x1400506eb
mov rax, qword [rsp + 0x60]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x58
ret
Function at 0x140051cb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140441080]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xa0]
cmp qword [rax + 0x68], 0
je 0x140051ced
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x140051cf4
mov al, 1
jmp 0x140051e3d
call fcn.140052d00
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
movzx edx, ax
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x48]
call qword [rax + Ordinal_26]
mov word [rsp + 0x30], ax
call fcn.140052d00
movzx ecx, word [rsp + 0x30]
movzx edx, cx
movzx ecx, ax
call fcn.140052d80
movzx eax, al
test eax, eax
je 0x140051d44
xor al, al
jmp 0x140051e3d
mov qword [rsp + 0x58], reloc.WLDAP32.dll_Ordinal_32
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
add rcx, 0x74
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x60]
mov rdx, rcx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x140051daa
cmp dword [rsp + 0x34], 1
je 0x140051db6
cmp dword [rsp + 0x34], 3
je 0x140051e2b
jmp 0x140051e3b
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x72], 0
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jbe 0x140051e02
mov rax, qword [rsp + 0xa0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x40], rax
je 0x140051e02
xor al, al
jmp 0x140051e3d
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x140051e1c
mov dword [rsp + 0x38], 1
jmp 0x140051e24
mov dword [rsp + 0x38], 0
movzx eax, byte [rsp + 0x38]
jmp 0x140051e3d
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x72], 0
mov al, 1
jmp 0x140051e3d
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14013adc0
add rsp, 0x98
ret
Function at 0x1400522a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140441080]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xa0]
cmp qword [rax + 0x68], 0
je 0x1400522dd
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400522e4
mov al, 1
jmp 0x140052428
call fcn.140052c10
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
mov edx, eax
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x48]
call qword [rax + Ordinal_26]
mov dword [rsp + 0x38], eax
call fcn.140052c10
mov ecx, dword [rsp + 0x38]
mov edx, ecx
mov ecx, eax
call fcn.140052c70
movzx eax, al
test eax, eax
je 0x14005232f
xor al, al
jmp 0x140052428
mov qword [rsp + 0x58], reloc.WLDAP32.dll_Ordinal_32
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
add rcx, 0x74
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x60]
mov rdx, rcx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140052395
cmp dword [rsp + 0x30], 1
je 0x1400523a1
cmp dword [rsp + 0x30], 3
je 0x140052416
jmp 0x140052426
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jbe 0x1400523ed
mov rax, qword [rsp + 0xa0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x40], rax
je 0x1400523ed
xor al, al
jmp 0x140052428
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140052407
mov dword [rsp + 0x34], 1
jmp 0x14005240f
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x140052428
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140052428
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14013adc0
add rsp, 0x98
ret
Function at 0x140057180
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x1400571b6
mov eax, 0xfffffffd
jmp 0x1400572b3
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x1400571d6
mov eax, 0xfffffffd
jmp 0x1400572b3
cmp dword [rsp + 0x20], 0
jne 0x1400571e4
xor eax, eax
jmp 0x1400572b3
mov eax, dword [rsp + 0x20]
inc eax
cdqe
lea rdx, [0x140156680]
mov rcx, rax
call fcn.14013b468
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14005721c
mov eax, 0xfffffffe
jmp 0x1400572b3
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov byte [rcx + rax], 0
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
movsxd rax, dword [rsp + 0x20]
mov r9, qword [rsp + 0x78]
mov r8, rax
mov edx, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x38], rax
movsxd rax, dword [rsp + 0x20]
cmp qword [rsp + 0x38], rax
je 0x140057283
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.14013b05c
mov eax, 0xfffffffd
jmp 0x1400572b3
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
call fcn.140059720
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.14013b05c
mov eax, dword [rsp + 0x28]
add rsp, 0x68
ret

Function at 0x140063f50
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x140395040]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x140063fd6
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
jmp 0x140063f82
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret
Function at 0x140063fe0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x140395040]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x1400640db
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x1400640d6
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 1], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x1400640ab
cmp qword [rsp + 0x38], 2
jb 0x1400640ab
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400640ab
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400640ab
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140064027
jmp 0x140064164
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp]
test eax, eax
je 0x140064164
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x14006413a
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14006413a
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14006413a
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x1400640db
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x14007a820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss dword [rsp + 0x20], xmm3
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, qword [rsp + 0x70]
call fcn.14001c240
mov eax, dword [rsp + 0x78]
and eax, 1
test eax, eax
je 0x14007a8ea
mov edx, dword [rsp + 0x80]
mov ecx, reloc.WS2_32.dll_sendto
call fcn.14007a5f0
movss dword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, reloc.WS2_32.dll_send
call fcn.14007a5f0
movss xmm1, dword [rsp + 0x20]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x28], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, reloc.WS2_32.dll_select
call fcn.14007a5f0
movss dword [rsp + 0x24], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, reloc.WS2_32.dll_recvfrom
call fcn.14007a5f0
movss xmm1, dword [rsp + 0x24]
subss xmm1, xmm0
movaps xmm0, xmm1
movss xmm1, dword [rsp + 0x28]
movaps xmm2, xmm1
movaps xmm1, xmm0
lea rcx, [rsp + 0x44]
call fcn.14001c240
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.14005fcb0
mov eax, dword [rsp + 0x78]
and eax, 2
test eax, eax
je 0x14007a98c
mov edx, dword [rsp + 0x80]
mov ecx, 7
call fcn.14007a5f0
movss dword [rsp + 0x2c], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 6
call fcn.14007a5f0
movss xmm1, dword [rsp + 0x2c]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x34], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 5
call fcn.14007a5f0
movss dword [rsp + 0x30], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 4
call fcn.14007a5f0
movss xmm1, dword [rsp + 0x30]
subss xmm1, xmm0
movaps xmm0, xmm1
movss xmm1, dword [rsp + 0x34]
movaps xmm2, xmm1
movaps xmm1, xmm0
lea rcx, [rsp + 0x4c]
call fcn.14001c240
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.14005fcb0
mov eax, dword [rsp + 0x78]
and eax, 4
test eax, eax
je 0x14007aa2e
mov edx, dword [rsp + 0x80]
mov ecx, ntohl
call fcn.14007a5f0
movss dword [rsp + 0x38], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 0xa
call fcn.14007a5f0
movss xmm1, dword [rsp + 0x38]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 9
call fcn.14007a5f0
movss dword [rsp + 0x3c], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 8
call fcn.14007a5f0
movss xmm1, dword [rsp + 0x3c]
subss xmm1, xmm0
movaps xmm0, xmm1
movss xmm1, dword [rsp + 0x40]
movaps xmm2, xmm1
movaps xmm1, xmm0
lea rcx, [rsp + 0x54]
call fcn.14001c240
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.14005fcb0
movss xmm0, dword [rsp + 0x88]
ucomiss xmm0, dword [0x14042f990]
jp 0x14007aa42
je 0x14007aa66
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.140062890
movzx eax, al
test eax, eax
je 0x14007aa66
movss xmm1, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x70]
call fcn.14005fc60
movss xmm0, dword [rsp + 0x90]
ucomiss xmm0, dword [0x14042f990]
jp 0x14007aa7a
je 0x14007aa9e
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.140062890
movzx eax, al
test eax, eax
je 0x14007aa9e
movss xmm1, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
call fcn.14005fc60
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x14009ea90
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140441080]
xor rax, rsp
mov qword [rsp + 0x60], rax
call fcn.140068f20
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x5c], 0
lea rdx, [rsp + 0x50]
mov rcx, qword [0x14047d8d8]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x5c]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm0, eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm1, eax
movaps xmm2, xmm0
lea rcx, [rsp + 0x48]
call fcn.14001c240
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 8], rax
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x14047d8e0]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
cvtsi2ss xmm0, rax
cvtsi2ss xmm1, qword [0x14047d8e8]
divss xmm0, xmm1
mov rax, qword [rsp + 0x20]
movss dword [rax + 0x10], xmm0
mov rax, qword [rsp + 0x40]
mov qword [0x14047d8e0], rax
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14009eb85
mov dword [rsp + 0x28], 1
jmp 0x14009eb8d
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x28]
mov byte [rax + 0x138], cl
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14009ebbc
mov dword [rsp + 0x2c], 1
jmp 0x14009ebc4
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x2c]
mov byte [rax + 0x139], cl
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14009ebf3
mov dword [rsp + 0x30], 1
jmp 0x14009ebfb
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x30]
mov byte [rax + 0x13a], cl
mov rax, qword [rsp + 0x20]
mov byte [rax + 0x13b], 0
call fcn.14009e2d0
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0xc0]
test eax, eax
je 0x14009ec36
mov dword [rsp + 0x34], 0xffffffff
jmp 0x14009ec3f
call fcn.14006d510
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
cmp dword [reloc.WS2_32.dll_htons], eax
je 0x14009ec62
mov eax, dword [rsp + 0x38]
mov dword [reloc.WS2_32.dll_htons], eax
call fcn.14009e1a0
call fcn.14009e3f0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14013adc0
add rsp, 0x78
ret