joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Intermediate_tjsp_ttucson_teorder_tvpro_tuchome_twebcgi_tsearchservices_tfinite_tviewcart_tlike_tasdfg_tkamera_tgeral_tbbs_tinternaldata_tGraphicsHTML_tdetail_tktmlpro_tslideshow_twebparts_torganizacion_tseminare_tcomum_tnewyear_tjsscripts_taaa_teg_torganizer_tcasestudies_tactiveusers_tlavoro_terreurs_tpodium_tsimpleviewer_tstayout_troam_tfms_tdmca_tlanguage_tfriend_tentrust_tsmileys_tsusan_tquizzes_tmessagerie_tcgidata_tupload_tfreelisting_tphase
mov r10, rax
sub rbx, rax
movabs rdi, 0x453d9e2c776ca015
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 6]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x193
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 7]
mov byte [r9 - 7], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x193
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x193
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x193
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x193
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x193
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
add r11d, 6
cmp r11d, 6
jb 0x140004d10
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140005ca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Intermediate_tjsp_ttucson_teorder_tvpro_tuchome_twebcgi_tsearchservices_tfinite_tviewcart_tlike_tasdfg_tkamera_tgeral_tbbs_tinternaldata_tGraphicsHTML_tdetail_tktmlpro_tslideshow_twebparts_torganizacion_tseminare_tcomum_tnewyear_tjsscripts_taaa_teg_torganizer_tcasestudies_tactiveusers_tlavoro_terreurs_tpodium_tsimpleviewer_tstayout_troam_tfms_tdmca_tlanguage_tfriend_tentrust_tsmileys_tsusan_tquizzes_tmessagerie_tcgidata_tupload_tfreelisting_tphase
mov r10, rax
sub rbx, rax
movabs rdi, 0x453d9e2c776ca015
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x193
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x193
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x193
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x193
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x193
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x193
sub rcx, rax
movzx eax, byte [rcx + rsi]
add r11d, 6
xor al, byte [rbx + r9 + 8]
lea r9, [r9 + 0xc]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 6
jb 0x140005cf0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000a520
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000a582
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000e510
test al, al
jne 0x14000a594
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000a550
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x74
mov dword [rbp - 0x20], 0x2b0002
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2b0026
mov dword [rbp - 0x18], 0x210037
mov dword [rbp - 0x14], 0x250027
mov dword [rbp - 0x10], 0x24003a
call fcn.140005e60
mov rcx, rax
call 0x14000a520
mov qword [0x1400171b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x69
mov dword [rbp - 0x20], 0x2b0002
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2b0026
mov dword [rbp - 0x18], 0x210037
mov dword [rbp - 0x14], 0x560056
call fcn.140002590
mov rcx, rax
call 0x14000a520
lea rcx, [rbp - 0x20]
mov qword [0x1400171a8], rax
mov dword [rbp - 0x20], 0x1a0027
mov dword [rbp - 0x1c], 0x90010
mov dword [rbp - 0x18], 0x6d001e
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000a520
Function at 0x14000b750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400171c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x6001a
mov dword [rbp - 0x1c], 0x90011
mov dword [rbp - 0x18], 0x5e001e
mov dword [rbp - 0x14], 0x4a0057
mov dword [rbp - 0x10], 0xd000d
mov dword [rbp - 0xc], 0x650018
call fcn.140002e40
mov rcx, rax
call rbx
mov rbx, qword [0x1400171c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400171a0], rax
mov dword [rbp - 0x20], 0x7001e
mov dword [rbp - 0x1c], 0xc001a
mov dword [rbp - 0x18], 0x8001c
mov dword [rbp - 0x14], 0x4a0011
mov dword [rbp - 0x10], 0xd000d
mov dword [rbp - 0xc], 0x650018
call fcn.140002e40
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x1400157e0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400171b0], rax
mov word [rbp - 0x10], 0x237f
mov byte [rbp - 0xe], 0x75
call fcn.140005220
mov rcx, qword [0x1400171a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140017130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x911061a
mov dword [rbp - 0x1c], 0x11d281e
mov dword [rbp - 0x18], 0x140a
mov word [rbp - 0x14], 0x6a5e
call fcn.140001180
mov rcx, qword [0x1400171a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140017130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0
mov dword [rbp - 0x1c], 0x10000300
mov dword [rbp - 0x18], 0xb111126
mov word [rbp - 0x14], 0x6a48
call fcn.140001180
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015880]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170e8], rax
mov byte [rbp - 0x10], 9
call fcn.140004e60
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015810]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170f0], rax
mov dword [rbp - 0x10], 0x6310186d
call fcn.1400029f0
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400157d0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170e0], rax
mov byte [rbp - 0x10], 9
call fcn.140004e60
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015740]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170d8], rax
mov dword [rbp - 0x10], 0x221b1b60
mov byte [rbp - 0xc], 0x73
call fcn.140003790
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015830]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x3567
mov byte [rbp - 0xe], 0x75
call fcn.140005220
mov rcx, qword [0x1400171b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp rax
Function at 0x14000c740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000a582
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000e510
test al, al
jne 0x14000a594
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000a550
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x74
mov dword [rbp - 0x20], 0x2b0002
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2b0026
mov dword [rbp - 0x18], 0x210037
mov dword [rbp - 0x14], 0x250027
mov dword [rbp - 0x10], 0x24003a
call fcn.140005e60
mov rcx, rax
call 0x14000a520
mov qword [0x1400171b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x69
mov dword [rbp - 0x20], 0x2b0002
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2b0026
mov dword [rbp - 0x18], 0x210037
mov dword [rbp - 0x14], 0x560056
call fcn.140002590
mov rcx, rax
call 0x14000a520
lea rcx, [rbp - 0x20]
mov qword [0x1400171a8], rax
mov dword [rbp - 0x20], 0x1a0027
mov dword [rbp - 0x1c], 0x90010
mov dword [rbp - 0x18], 0x6d001e
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000a520
Function at 0x14000f080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000f2ae
mov word [rbp + 0x50], 0x6e49
mov word [rbp + 0x58], 0x6e49
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000f134
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000f120
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000f165
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000f150
cmp rdi, rbx
jne 0x14000f282
mov r13, rsi
mov word [rbp - 0x50], 0x6e49
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000f1a6
lea rcx, [rbp - 0x50]
inc rbx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000f192
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000f2a8
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x6e0028
call fcn.1400027f0
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000f218
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x6e0033
call fcn.1400027f0
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000f218
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x6e0028
mov dword [rbp - 0x42], 0x6e0008
call fcn.1400027f0
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.1400027f0
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x6e0028
call fcn.1400027f0
movzx eax, word [rax]
cmp edi, eax
jl 0x14000f275
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x6e0033
call fcn.1400027f0
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000f275
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x6e0028
mov dword [rbp - 0x32], 0x6e0008
call fcn.1400027f0
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.1400027f0
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000f282
inc r14
jmp 0x14000f180
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000f2ae
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000f0f0
mov rax, qword [rbp - 8]
jmp 0x14000f2b0
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140d1e4e0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140d1e4ed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140d1e4fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140d1e4e5
lea eax, [rcx + 1]
jmp 0x140d1e50b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140d1e51e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140d1e504
sub eax, 3
jb 0x140d1e53e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140d1e58d
sar eax, 1
movsxd rbp, eax
jb 0x140d1e574
jmp 0x140d1e54c
add ebx, ebx
jne 0x140d1e54a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140d1e574
inc ecx
add ebx, ebx
jne 0x140d1e55a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140d1e574
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140d1e56d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140d1e55c
add ecx, 2
jmp 0x140d1e579
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140d1e4a2
jmp 0x140d1e4ed
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0xcfd000]
mov eax, dword [rdi]
or eax, eax
je 0x140d1e5ed
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xd79114]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140d1e59d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140d1e5e7
mov qword [rbx], rax
add rbx, 8
jmp 0x140d1e5bd
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140d1e631
cmp al, 0xef
ja 0x140d1e619
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140d1e5f9
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140d1e608
mov eax, dword [rdi]
add rdi, 4
jmp 0x140d1e608
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140d1e6b0], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140d1e6b0
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140d1e6a0
sub rsp, 0xffffffffffffff80
jmp 0x1400013c9
Function at 0x140006300
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x210
call fcn.140018520
cmp byte [rax], 0
je 0x140006399
mov ecx, 0x210
call fcn.1400091b0
cmp byte [rax + 8], 0
jne 0x140006399
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x140006399
mov rbx, qword [0x140bd7ca0]
test rbx, rbx
jne 0x140006368
mov r8d, 0xfe4
lea rdx, str.D:_FILES_deskstop_back_upmultigamesimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140bd7ca0]
cmp byte [rbx + 0x37a9], 0
je 0x140006385
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.140009760
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov ecx, 0x214
call fcn.140018520
cmp byte [rax], 0
je 0x14000642c
mov ecx, 0x214
call fcn.1400091b0
cmp byte [rax + 8], 0
jne 0x14000642c
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14000642c
mov rbx, qword [0x140bd7ca0]
test rbx, rbx
jne 0x1400063fb
mov r8d, 0xfe4
lea rdx, str.D:_FILES_deskstop_back_upmultigamesimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140bd7ca0]
cmp byte [rbx + 0x37a9], 0
je 0x140006418
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.140009760
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov ecx, 0x212
call fcn.140018520
cmp byte [rax], 0
je 0x1400064bf
mov ecx, 0x212
call fcn.1400091b0
cmp byte [rax + 8], 0
jne 0x1400064bf
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1400064bf
mov rbx, qword [0x140bd7ca0]
test rbx, rbx
jne 0x14000648e
mov r8d, 0xfe4
lea rdx, str.D:_FILES_deskstop_back_upmultigamesimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140bd7ca0]
cmp byte [rbx + 0x37a9], 0
je 0x1400064ab
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.140009760
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov ecx, 0x216
call fcn.140018520
cmp byte [rax], 0
je 0x140006552
mov ecx, 0x216
call fcn.1400091b0
cmp byte [rax + 8], 0
jne 0x140006552
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x140006552
mov rbx, qword [0x140bd7ca0]
test rbx, rbx
jne 0x140006521
mov r8d, 0xfe4
lea rdx, str.D:_FILES_deskstop_back_upmultigamesimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140bd7ca0]
cmp byte [rbx + 0x37a9], 0
je 0x14000653e
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.140009760
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x140009a60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x70
mov rbp, qword [0x140bd7ca0]
mov rbx, rcx
movaps xmmword [rsp + 0x60], xmm6
mov r14, rbp
movaps xmmword [rsp + 0x50], xmm7
movaps xmm6, xmm1
movaps xmm7, xmm2
lea rax, [rbp + 8]
cmp rax, rcx
je 0x140009ab7
mov r8d, 0x59b
lea rdx, str.D:_FILES_deskstop_back_upmultigamesimgui.cpp
lea rcx, str.g.IO__this___Can_only_add_events_to_current_context._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbp, qword [0x140bd7ca0]
cmp byte [rbx + 0x37a1], 0
je 0x140009c61
movss xmm1, dword [0x140160934]
xorps xmm2, xmm2
comiss xmm7, xmm1
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
jbe 0x140009b04
comiss xmm7, xmm2
cvttss2si eax, xmm7
jae 0x140009afd
movd xmm0, eax
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm7
jp 0x140009afb
je 0x140009afd
dec eax
movd xmm7, eax
cvtdq2ps xmm7, xmm7
comiss xmm6, xmm1
jbe 0x140009b29
comiss xmm6, xmm2
cvttss2si eax, xmm6
jae 0x140009b22
movd xmm0, eax
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm6
jp 0x140009b20
je 0x140009b22
dec eax
movd xmm6, eax
cvtdq2ps xmm6, xmm6
mov esi, dword [rbp + 0x37c0]
sub esi, 1
movsxd rdi, esi
js 0x140009b7f
lea rbx, [rdi + rdi*2]
shl rbx, 3
nop
cmp esi, dword [rbp + 0x37c0]
jl 0x140009b62
mov r8d, 0x6fb
lea rdx, str.D:_FILES_deskstop_back_upmultigamesimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbp + 0x37c8]
cmp dword [rbx + rax], 1
je 0x140009c09
dec esi
sub rbx, 0x18
sub rdi, 1
jns 0x140009b40
movsd xmm0, qword [r14 + 0xdfc]
lea rax, [rsp + 0x28]
movsd qword [rsp + 0x28], xmm0
movss xmm0, dword [rax]
ucomiss xmm0, xmm6
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
movss xmm1, dword [rax + 4]
jp 0x140009bbe
jne 0x140009bbe
ucomiss xmm1, xmm7
jp 0x140009bbe
je 0x140009c61
lea rbx, [r14 + 0x37c0]
movss dword [rsp + 0x38], xmm6
mov ecx, dword [rbx]
mov r8d, dword [rbx + 4]
movss dword [rsp + 0x3c], xmm7
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 1
cmp ecx, r8d
jne 0x140009c3f
inc ecx
test r8d, r8d
je 0x140009c2b
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140009c30
movss xmm0, dword [rbx + rax + 8]
movss xmm1, dword [rbx + rax + 0xc]
lea rax, [rsp + 0x20]
movss dword [rsp + 0x20], xmm0
movss dword [rsp + 0x24], xmm1
jmp 0x140009b93
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140024ff0
movsxd rax, dword [rbx]
movups xmm0, xmmword [rsp + 0x30]
movsd xmm1, qword [rsp + 0x40]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 8]
movups xmmword [rax + rcx*8], xmm0
movsd qword [rax + rcx*8 + 0x10], xmm1
inc dword [rbx]
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
movaps xmm7, xmmword [rsp + 0x50]
mov rsp, r11
pop r14
ret