joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400266c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
xor eax, eax
lea r8, [0x140073aed]
mov dword [rsp + 0x2c], eax
lea r11, [0x14006f090]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, [0x140073aec]
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov edx, r10d
mov r9b, 0x57
nop
cmp r9b, 0x23
jne 0x140026713
cmp byte [r8], r9b
jne 0x140026713
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x140026700
mov ecx, dword [rbx + 0x2ef4]
lea rax, [0x140032590]
mov edi, dword [rbx + 0x2ef0]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x140032660]
mov qword [rsp + 0x38], rax
lea rax, [0x140032750]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x140026819
inc edi
test ecx, ecx
je 0x14002677f
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x140026784
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x140026819
mov rax, qword [0x14036e540]
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
test rax, rax
je 0x1400267ad
inc dword [rax + 0x3b8]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, qword [rbx + 0x2ef8]
mov rbp, rax
test rsi, rsi
je 0x140026802
movsxd rcx, dword [rbx + 0x2ef0]
mov rdx, rsi
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [0x14036e540]
test rcx, rcx
je 0x1400267f9
dec dword [rcx + 0x3b8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x2ef8], rbp
mov rbp, qword [rsp + 0x60]
mov dword [rbx + 0x2ef4], edi
movsxd rax, dword [rbx + 0x2ef0]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2ef8]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2ef0]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400282c0
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x140028310
lea r11, [0x14006f090]
nop dword [rax]
cmp r9b, 0x23
jne 0x1400282f3
cmp byte [r8], r9b
jne 0x1400282f3
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400282e0
mov r11, qword [0x14036e540]
not eax
movsxd rcx, dword [r11 + 0x1a08]
mov r9, qword [r11 + 0x1a10]
mov r10, rcx
mov rdx, rcx
mov r8, r9
test ecx, ecx
je 0x140028378
nop dword [rax]
nop dword [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x140028369
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x14002836c
mov rdx, r8
test rdx, rdx
jne 0x140028340
mov r8, qword [r11 + 0x1a10]
shl r10, 4
add r10, r8
cmp r9, r10
je 0x14002838e
cmp dword [r9], eax
jne 0x14002838e
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x14002d520
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x14036e540]
lea r8, [0x14006f090]
mov rbx, qword [rax + 0x1a20]
add rbx, 0x1f0
movsxd rdx, dword [rbx]
mov r9, qword [rbx + 8]
mov edi, dword [r9 + rdx*4 - 4]
not edi
mov eax, edi
shr edi, 8
xor rax, 0xffffffffffffffe7
movzx ecx, al
xor edi, dword [r8 + rcx*4]
mov eax, edi
shr edi, 8
xor rax, 3
movzx ecx, al
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x14002d5c4
lea ecx, [rdx + 1]
test r8d, r8d
je 0x14002d5aa
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x14002d5af
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140033530
mov edx, dword [rbx]
mov r9, qword [rbx + 8]
movsxd rax, edx
mov dword [r9 + rax*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140032020
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x40
xor eax, eax
mov qword [rsp + 0x50], rbx
mov rbx, qword [0x14036e540]
mov qword [rsp + 0x68], r14
mov r14, rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov ecx, dword [rbx + 0x2f04]
mov edi, dword [rbx + 0x2f00]
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x30], eax
mov byte [rsp + 0x3c], al
cmp edi, ecx
jne 0x1400320ff
inc edi
test ecx, ecx
je 0x140032078
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x14003207d
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x1400320ff
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
test rbx, rbx
je 0x14003209b
inc dword [rbx + 0x3b8]
movsxd rcx, edi
shl rcx, 5
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, qword [rbx + 0x2f08]
mov rbp, rax
test rsi, rsi
je 0x1400320e8
movsxd r8, dword [rbx + 0x2f00]
mov rdx, rsi
shl r8, 5
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [0x14036e540]
test rdx, rdx
je 0x1400320df
dec dword [rdx + 0x3b8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rsp + 0x60]
mov qword [rbx + 0x2f08], rbp
mov rbp, qword [rsp + 0x58]
mov dword [rbx + 0x2f04], edi
movsxd rcx, dword [rbx + 0x2f00]
lea rdx, [0x140073ba4]
mov rax, qword [rbx + 0x2f08]
movups xmm0, xmmword [rsp + 0x20]
shl rcx, 5
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rcx + rax], xmm0
movups xmmword [rcx + rax + 0x10], xmm1
movsxd rcx, dword [rbx + 0x2f00]
mov rdi, rcx
shl rdi, 5
lea eax, [rcx + 1]
mov rcx, r14
mov dword [rbx + 0x2f00], eax
add rdi, qword [rbx + 0x2f08]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
cmovne r14, rax
mov rcx, r14
call fcn.140022250
mov rbx, qword [rsp + 0x50]
lea r8, [r14 + 1]
mov qword [rdi], rax
mov r11d, 0xffffffff
movzx r9d, byte [r14]
mov edx, r11d
mov r14, qword [rsp + 0x68]
test r9b, r9b
je 0x1400321c0
lea r10, [0x14006f090]
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x1400321a3
cmp byte [r8], r9b
jne 0x1400321a3
cmp byte [r8 + 1], r9b
cmove edx, r11d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r10 + rcx*4]
test r9b, r9b
jne 0x140032190
not edx
mov rax, rdi
mov dword [rdi + 8], edx
add rsp, 0x40
pop rdi
ret
Function at 0x1400321d0
Capabilities:
Hash data with crc32

Disassembly:
push r13
push r14
sub rsp, 0x38
mov r13, qword [0x14036e540]
mov qword [rsp + 0x50], rbx
mov rbx, rdx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x30], rdi
mov rdi, rcx
mov qword [rsp + 0x28], r12
test rdx, rdx
jne 0x140032219
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x140032210
test r13, r13
je 0x140032225
inc dword [r13 + 0x3b8]
lea rcx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x58], rax
mov r14, rax
lea r12, [rax + rbx]
call sub.VCRUNTIME140.dll_memcpy
xor ebp, ebp
mov byte [r12], 0
xor esi, esi
mov rdi, r14
cmp r14, r12
jae 0x1400323e7
mov qword [rsp + 0x20], r15
movzx eax, byte [rdi]
cmp al, 0xa
je 0x140032431
cmp al, 0xd
je 0x140032431
mov rbx, rdi
cmp rdi, r12
jae 0x140032293
nop
movzx eax, byte [rbx]
cmp al, 0xa
je 0x140032293
cmp al, 0xd
je 0x140032293
inc rbx
cmp rbx, r12
jb 0x140032280
mov byte [rbx], 0
movzx eax, byte [rdi]
cmp al, 0x3b
je 0x1400323d0
cmp al, 0x5b
jne 0x1400323b7
cmp rbx, rdi
jbe 0x1400323b7
cmp byte [rbx - 1], 0x5d
lea r14, [rbx - 1]
jne 0x1400323b7
lea rsi, [rdi + 1]
mov byte [r14], 0
mov r8, r14
mov rcx, rsi
sub r8, rsi
mov edx, 0x5d
call sub.VCRUNTIME140.dll_memchr
mov r15, rax
test rax, rax
je 0x140032302
lea rcx, [rax + 1]
mov edx, 0x5b
sub r14, rcx
mov r8, r14
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140032302
mov byte [r15], 0
jmp 0x14003230c
lea rsi, [0x140073aec]
mov rax, rdi
movzx r9d, byte [rsi]
lea r11, [rax + 1]
mov r10, qword [0x14036e540]
mov r14d, 0xffffffff
lea r8, [rsi + 1]
mov eax, r14d
test r9b, r9b
je 0x140032366
nop dword [rax]
cmp r9b, 0x23
jne 0x140032343
cmp byte [r8], r9b
jne 0x140032343
cmp byte [r8 + 1], r9b
cmove eax, r14d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
lea rcx, [0x14006f090]
inc r8
xor eax, dword [rcx + rdx*4]
test r9b, r9b
jne 0x140032330
mov r8d, dword [r10 + 0x2ef0]
xor edx, edx
not eax
test r8d, r8d
jle 0x140032390
mov r9, qword [r10 + 0x2ef8]
lea rcx, [r9 + 8]
cmp dword [rcx], eax
je 0x140032396
inc edx
add rcx, 0x30
cmp edx, r8d
jl 0x140032381
xor esi, esi
xor ebp, ebp
jmp 0x1400323d0
movsxd rax, edx
lea rsi, [rax + rax*2]
shl rsi, 4
add rsi, r9
je 0x140032392
mov r8, r11
mov rdx, rsi
mov rcx, r13
call qword [rsi + reloc.WS2_32.dll_recv]
mov rbp, rax
jmp 0x1400323d0
test rsi, rsi
je 0x1400323d0
test rbp, rbp
je 0x1400323d0
mov r9, rdi
mov r8, rbp
mov rdx, rsi
mov rcx, r13
call qword [rsi + 0x18]
lea rdi, [rbx + 1]
cmp rdi, r12
jb 0x140032263
mov r14, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
test r14, r14
je 0x140032417
mov rax, qword [0x14036e540]
test rax, rax
je 0x140032417
dec dword [rax + 0x3b8]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [r13 + 0x2ed4], 1
add rsp, 0x38
pop r14
pop r13
ret
inc rdi
jmp 0x140032263
Function at 0x140032440
Capabilities:
Write file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov rbx, qword [0x14036e540]
xor r15d, r15d
mov r14, rcx
mov dword [rbx + 0x2ed8], r15d
test rcx, rcx
je 0x14003257b
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
lea rdi, [rbx + 0x2ee0]
mov dword [rbx + 0x2ed8], r15d
mov r8d, dword [rdi + 4]
test r8d, r8d
jns 0x1400324ac
mov eax, r8d
mov rcx, rdi
cdq
sub eax, edx
mov edx, r15d
sar eax, 1
add eax, r8d
test eax, eax
cmovg edx, eax
call fcn.140033400
mov r8d, dword [rdi + 4]
mov dword [rdi], r15d
mov eax, r15d
test r8d, r8d
jne 0x1400324c5
lea edx, [r8 + 8]
mov rcx, rdi
call fcn.140033400
mov eax, dword [rdi]
movsxd rcx, eax
mov ebp, r15d
mov rax, qword [rdi + 8]
mov byte [rcx + rax], r15b
inc dword [rdi]
mov ecx, dword [rdi]
cmp dword [rbx + 0x2ef0], r15d
jle 0x140032517
mov rsi, r15
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rbx + 0x2ef8]
mov r8, rdi
add r9, rsi
mov rcx, rbx
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add rsi, 0x30
cmp ebp, dword [rbx + 0x2ef0]
jl 0x1400324f0
mov ecx, dword [rdi]
test ecx, ecx
lea eax, [rcx - 1]
lea rdi, [0x14036e534]
mov rcx, r14
cmove eax, r15d
lea rdx, [0x140073ba8]
movsxd rsi, eax
mov rax, qword [rbx + 0x2ee8]
test rax, rax
cmovne rdi, rax
call fcn.140022480
mov rbp, qword [rsp + 0x40]
mov rbx, rax
test rax, rax
je 0x140032571
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
Function at 0x14003d360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14003d4f1
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14003d3d0
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14003cd80
mov r8d, dword [rbx + 0x80]
mov r9d, edi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14003c3d0
mov dword [rbx + 0x80], 0
jmp 0x14003d4dd
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14003b350
movzx edx, word [rbx + 0x4c]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rsi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rsi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], edi
movsd xmm0, qword [rsi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], edi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x4c], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180022670
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x60
mov rax, qword [0x180280f80]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor ecx, ecx
xor esi, esi
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1800226b9
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], sil
jmp 0x1800227a9
mov ecx, 1
mov qword [rsp + 0x78], rdi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
jne 0x1800226eb
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], sil
jmp 0x1800227a4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xorps xmm0, xmm0
mov qword [rsp + 0x40], rsi
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], rsi
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], sil
jne 0x180022710
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.18000a5f0
cmp qword [rsp + 0x40], rsi
jne 0x180022784
mov rdx, qword [rsp + 0x48]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], sil
cmp rdx, 0xf
jbe 0x1800227a4
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002277d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002277d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d81fc
jmp 0x1800227a4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov rdi, qword [rsp + 0x78]
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800d8800
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rsi
ret
Function at 0x1800259f0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180280f80]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180025ac3
cmp byte [rcx + 0x71], 0
je 0x180025ac3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180025abf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180025a84
sub eax, 1
je 0x180025a88
cmp eax, 2
jne 0x180025abf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800d8800
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180025ab6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180025abf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180025a6c
xor al, al
jmp 0x180025a6c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800d8800
add rsp, 0x60
pop rbx
ret

Function at 0x180031dd0
Capabilities:
Hash data with md5

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x180280f80]
xor rax, rsp
mov qword [rbp + 0x47], rax
xorps xmm0, xmm0
mov dword [rbp - 0x19], 0x67452301
mov edx, 0x20
mov dword [rbp - 0x15], 0xefcdab89
mov qword [rbp - 9], rdx
shr edx, 3
and edx, 0x3f
mov dword [rbp - 0x11], 0x98badcfe
mov eax, edx
movups xmmword [rbp - 1], xmm0
mov dword [rbp - 1], ecx
lea rcx, [rbp - 1]
add rcx, rax
mov dword [rbp - 0xd], 0x10325476
mov eax, 0x3f
sub eax, edx
xor edx, edx
movups xmmword [rbp + 0xf], xmm0
movups xmmword [rbp + 0x1f], xmm0
movups xmmword [rbp + 0x2f], xmm0
mov byte [rcx], 0x80
inc rcx
cmp eax, 8
jae 0x180031e76
mov r8d, eax
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x19]
call fcn.1800315e0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0x2f], rax
movups xmmword [rbp + 0xf], xmm0
movups xmmword [rbp + 0x1f], xmm0
jmp 0x180031e81
add eax, 0xfffffff8
mov r8d, eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rbp - 9]
lea rdx, [rbp - 1]
mov dword [rbp + 0x37], eax
lea rcx, [rbp - 0x19]
mov eax, dword [rbp - 5]
mov dword [rbp + 0x3b], eax
call fcn.1800315e0
mov eax, dword [rbp - 0x13]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1800d8800
add rsp, 0x90
pop rbp
ret
Function at 0x180044340
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x180280f80]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov edi, edx
mov qword [rsp + 0x28], rcx
mov rbx, rcx
xor edx, edx
mov ecx, edi
xor esi, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r9d, eax
lea eax, [rdi - 0x21]
cmp eax, 0x84
ja case.0x18004439c.41
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x44564]
mov ecx, dword [rdx + rax*4 + 0x4455c]
add rcx, rdx
jmp rcx
bts r9d, 8
shl r9d, 0x10
lea rdx, [rsp + 0x30]
mov ecx, r9d
mov r8d, 0x20
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
test eax, eax
jne 0x18004450a
sub edi, 1
je 0x1800444d7
sub edi, 1
je 0x18004449a
sub edi, 2
je 0x180044466
sub edi, 1
je 0x180044429
cmp edi, 1
jne 0x18004450a
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 7
mov qword [rbx + 0x18], 0xf
mov rcx, qword [str.Mouse_5]
mov dword [rbx], ecx
movzx ecx, word [0x1801712b4]
mov word [rbx + 4], cx
movzx ecx, byte [0x1801712b6]
mov byte [rbx + 6], cl
mov byte [rbx + 7], sil
jmp 0x18004453a
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 7
mov qword [rbx + 0x18], 0xf
mov rax, qword [str.Mouse_4]
mov dword [rbx], eax
movzx eax, word [0x1801712ac]
mov word [rbx + 4], ax
movzx eax, byte [0x1801712ae]
mov byte [rbx + 6], al
mov byte [rbx + 7], sil
jmp 0x18004453a
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0xc
mov qword [rbx + 0x18], 0xf
movsd xmm0, qword [str.Middle_Mouse]
movsd qword [rbx], xmm0
mov eax, dword [0x180171290]
mov dword [rbx + 8], eax
mov byte [rbx + 0xc], sil
jmp 0x18004453a
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0xb
mov qword [rbx + 0x18], 0xf
movsd xmm0, qword [str.Right_Mouse]
movsd qword [rbx], xmm0
movzx eax, word [0x1801712a0]
mov word [rbx + 8], ax
movzx eax, byte [0x1801712a2]
mov byte [rbx + 0xa], al
mov byte [rbx + 0xb], sil
jmp 0x18004453a
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0xa
mov qword [rbx + 0x18], 0xf
movsd xmm0, qword [str.Left_Mouse]
movsd qword [rbx], xmm0
movzx eax, word [0x180171280]
mov word [rbx + 8], ax
mov byte [rbx + 0xa], sil
jmp 0x18004453a
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rsi
inc r8
cmp byte [rax + r8], sil
jne 0x180044524
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.18000a5f0
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800d8800
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18004a8e0
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x180280f80]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r8d, dword [0x18028d760]
xor ebx, ebx
mov rax, qword gs:[0x58]
mov qword [r11 - 0xe8], rbx
mov dword [rsp + 0xb0], ebx
mov qword [r11 - 0x28], rcx
mov r9, qword [rax + r8*8]
lea r8, [rsp + 0x50]
mov qword [r11 - 0x38], rcx
mov eax, 0xc
mov dword [0x180287558], ebx
mov dword [r11 - 0x40], ebx
mov dword [rsp + 0x20], 4
mov dword [rax + r9], ebx
mov eax, 8
mov dword [rax + r9], 1
lea r9, [rsp + 0x60]
movsxd rax, edx
lea rdx, [rsp + 0x54]
add rcx, rax
mov qword [r11 - 0x20], rcx
mov qword [r11 - 0x30], rcx
lea rcx, [r11 - 0xf8]
call fcn.1800557a0
mov rbp, rax
test rax, rax
je 0x18004aa95
mov rcx, qword [0x180287618]
lea rdx, [rsp + 0x58]
mov edi, dword [rsp + 0x54]
lea r9d, [rbx + 1]
mov esi, dword [rsp + 0x50]
mov r8d, esi
mov qword [rsp + 0x40], rbx
mov rax, qword [rcx]
mov qword [rsp + 0x38], rdx
mov edx, edi
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 0x15
mov dword [rsp + 0x20], 0x200
call qword [rax + 0xb8]
test eax, eax
js 0x18004aa95
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x68]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x98]
test eax, eax
jne 0x18004aa95
test esi, esi
jle 0x18004aa75
lea eax, [rdi*4]
mov r8, rbp
movsxd r11, eax
lea r10, [rbp + 1]
not r8
nop word [rax + rax]
test edi, edi
jle 0x18004aa69
mov rax, r10
mov r9, rdi
nop word [rax + rax]
mov ecx, dword [rsp + 0x68]
imul ecx, ebx
movsxd rdx, ecx
movzx ecx, byte [rax + 1]
add rdx, r8
add rdx, rax
add rdx, qword [rsp + 0x70]
mov byte [rdx], cl
movzx ecx, byte [rax]
mov byte [rdx + 1], cl
movzx ecx, byte [rax - 1]
mov byte [rdx + 2], cl
movzx ecx, byte [rax + 2]
add rax, 4
mov byte [rdx + 3], cl
sub r9, 1
jne 0x18004aa30
inc ebx
add r10, r11
sub r8, r11
cmp ebx, esi
jl 0x18004aa20
mov rcx, qword [rsp + 0x58]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0xa0]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rsp + 0x58]
jmp 0x18004aa97
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1800d8800
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret