joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004d1b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x10
mov r14, qword [rcx + 0x10]
mov rbx, rdx
movsxd r15, dword [rcx + 0x1c]
shl r15, 4
add r15, r14
cmp r14, r15
je 0x18004d333
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 8], r12
mov qword [rsp], r13
nop dword [rax]
movsxd rdi, dword [r14 + 4]
mov ebp, dword [r14 + 0xc]
mov r12d, dword [r14]
add ebp, edi
mov r13d, dword [r14 + 8]
cmp edi, ebp
jge 0x18004d30e
mov rsi, rdi
nop dword [rax]
mov r10, qword [rbx]
mov eax, edi
sub eax, dword [rbx + 0x18]
mov r11d, r13d
mov r8, qword [rbx + 8]
cdq
movsxd r9, dword [r10 + 0x14]
imul r9, rsi
add r9, qword [r10]
mov qword [rbx + 0x20], r9
idiv dword [r8 + 0x20]
movsxd rax, dword [r8 + 0x14]
movsxd rcx, edx
imul rcx, rax
add rcx, qword [r8]
mov qword [rbx + 0x28], rcx
movsxd rdx, dword [r10 + 0x18]
mov eax, edx
mov r10, rdx
imul eax, r12d
movsxd rcx, eax
add rcx, r9
mov r9d, r12d
sub r9d, dword [rbx + 0x14]
cmp dword [rbx + 0x10], 0xfe
jge 0x18004d2c0
nop dword [rax + rax]
mov r8, qword [rbx + 8]
mov eax, r9d
cdq
inc r9d
dec r11d
idiv dword [r8 + 0x1c]
mov rax, qword [rbx + 0x28]
imul edx, dword [r8 + 0x18]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
mov edx, 0x100
mov eax, dword [rbx + 0x10]
inc eax
imul r8d, eax
movzx eax, byte [rcx]
shr r8d, 8
sub edx, r8d
imul edx, eax
sar edx, 8
add dl, r8b
mov byte [rcx], dl
add rcx, r10
test r11d, r11d
jg 0x18004d270
jmp 0x18004d301
mov r8, qword [rbx + 8]
mov eax, r9d
cdq
inc r9d
dec r11d
idiv dword [r8 + 0x1c]
mov rax, qword [rbx + 0x28]
imul edx, dword [r8 + 0x18]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
mov edx, 0x100
movzx eax, byte [rcx]
sub edx, r8d
imul edx, eax
sar edx, 8
add dl, r8b
mov byte [rcx], dl
add rcx, r10
test r11d, r11d
jg 0x18004d2c0
inc edi
inc rsi
cmp edi, ebp
jl 0x18004d210
add r14, 0x10
cmp r14, r15
jne 0x18004d1f0
mov r13, qword [rsp]
mov r12, qword [rsp + 8]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
add rsp, 0x10
pop r15
pop r14
pop rbx
ret
Function at 0x180050d10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push r14
push r15
mov eax, dword [rcx + 0x10]
mov ebx, edx
mov r10d, dword [rsp + 0x48]
mov r11d, eax
and eax, 0xff00ff
shr r11d, 8
inc r10d
movsxd r8, r8d
imul eax, r10d
and r11d, 0xff00ff
imul r11d, r10d
mov r14, rcx
mov r15d, r9d
mov r9, qword [rcx]
shr eax, 8
movsxd rdx, dword [r9 + 0x14]
xor eax, r11d
imul r8, rdx
and eax, 0xff00ff
add r8, qword [r9]
xor eax, r11d
mov r11d, dword [rsp + 0x40]
mov qword [rcx + 8], r8
dec r11d
imul ebx, dword [r9 + 0x18]
mov ecx, eax
shr ecx, 0x18
movsxd r10, ebx
add r10, r8
cmp cl, 0xff
jb 0x180050dc1
test r11d, r11d
js 0x180050ec0
nop dword [rax]
movsxd r8, dword [r9 + 0x18]
mov edx, r15d
mov rcx, r10
nop word [rax + rax]
mov dword [rcx], eax
dec edx
add rcx, r8
test edx, edx
jg 0x180050da0
mov r9, qword [r14]
movsxd rcx, dword [r9 + 0x14]
add r10, rcx
sub r11d, 1
jns 0x180050d90
pop r15
pop r14
pop rbx
ret
test r11d, r11d
js 0x180050ec0
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], rsi
mov esi, 0x100
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r12
mov r12d, eax
shr eax, 8
and r12d, 0xff00ff
and eax, 0xff00ff
mov ecx, eax
shr ecx, 0x10
sub esi, ecx
nop dword [rax]
movsxd rbp, dword [r9 + 0x18]
mov edi, r15d
mov rbx, r10
nop word [rax + rax]
mov edx, dword [rbx]
mov r8d, 0x100
mov r9d, edx
dec edi
shr edx, 8
and r9d, 0xff00ff
and edx, 0xff00ff
imul r9d, esi
imul edx, esi
shr r9d, 8
shr edx, 8
and r9d, 0xff00ff
and edx, 0xff00ff
add r9d, r12d
add edx, eax
mov ecx, edx
shl edx, 8
shr ecx, 8
and ecx, 0xff00ff
sub r8d, ecx
mov ecx, r9d
shl r8d, 8
or r8d, edx
shr ecx, 8
and ecx, 0xff00ff
and r8d, 0xff00ff00
mov edx, 0x100
sub edx, ecx
or edx, r9d
and edx, 0xff00ff
xor edx, r8d
mov dword [rbx], edx
add rbx, rbp
test edi, edi
jg 0x180050e10
mov r9, qword [r14]
movsxd rcx, dword [r9 + 0x14]
add r10, rcx
sub r11d, 1
jns 0x180050e00
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x20]
pop r15
pop r14
pop rbx
ret
Function at 0x180052030
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x20
mov qword [rsp + 0x40], rdi
mov ebp, r9d
movsxd rbx, r8d
mov rdi, rcx
mov qword [rsp + 0x50], r15
mov r15d, edx
cmp ebx, dword [rcx + 0x80]
jle 0x180052084
mov qword [rcx + 0x80], rbx
mov rcx, qword [rcx + 0x78]
mov qword [rsp + 0x48], r14
call fcn.180124068
test ebx, ebx
jne 0x180052073
xor eax, eax
jmp 0x18005207b
mov rcx, rbx
call fcn.180124500
mov r14, qword [rsp + 0x48]
mov qword [rdi + 0x78], rax
mov rsi, qword [rdi + 0x78]
mov r9d, ebx
mov rdx, rsi
mov r8d, r15d
mov rcx, rdi
call fcn.180038c20
mov rax, qword [rdi + 0x48]
imul ebp, dword [rdi + 0x58]
movsxd rcx, dword [rax + 0x18]
mov eax, ecx
imul eax, r15d
mov r15, qword [rsp + 0x50]
sar ebp, 8
movsxd r10, eax
add r10, qword [rdi + 0x70]
mov rdi, qword [rsp + 0x40]
cmp ebp, 0xfe
jge 0x180052189
mov r11, rcx
nop
movzx ecx, byte [rsi]
lea rsi, [rsi + 1]
mov r9d, ecx
mov edx, 0x100
shl r9d, 0x10
dec ebx
or r9d, ecx
mov ecx, 0x100
imul r9d, ebp
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shl r9d, 8
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r8d
shl edx, 8
shr eax, 8
or edx, r9d
and eax, 0xff00ff
and edx, 0xff00ff00
sub ecx, eax
or ecx, r8d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r10], ecx
add r10, r11
test ebx, ebx
jg 0x1800520d0
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret
mov r9, rcx
nop dword [rax]
movzx ecx, byte [rsi]
lea rsi, [rsi + 1]
mov edx, ecx
mov eax, 0x100
sub eax, ecx
shl edx, 0x10
or edx, ecx
dec ebx
mov ecx, dword [r10]
mov r8d, ecx
shr ecx, 8
and r8d, 0xff00ff
and ecx, 0xff00ff
imul r8d, eax
imul ecx, eax
shr r8d, 8
shr ecx, 8
and r8d, 0xff00ff
and ecx, 0xff00ff
add r8d, edx
add ecx, edx
mov edx, 0x100
mov eax, ecx
shl ecx, 8
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r8d
shl edx, 8
or edx, ecx
shr eax, 8
and eax, 0xff00ff
and edx, 0xff00ff00
mov ecx, 0x100
sub ecx, eax
or ecx, r8d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r10], ecx
add r10, r9
test ebx, ebx
jg 0x180052190
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret
Function at 0x180052230
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x20
mov qword [rsp + 0x40], rdi
mov ebp, r9d
movsxd rbx, r8d
mov rdi, rcx
mov qword [rsp + 0x50], r15
mov r15d, edx
cmp ebx, dword [rcx + 0x80]
jle 0x180052284
mov qword [rcx + 0x80], rbx
mov rcx, qword [rcx + 0x78]
mov qword [rsp + 0x48], r14
call fcn.180124068
test ebx, ebx
jne 0x180052273
xor eax, eax
jmp 0x18005227b
mov rcx, rbx
call fcn.180124500
mov r14, qword [rsp + 0x48]
mov qword [rdi + 0x78], rax
mov rsi, qword [rdi + 0x78]
mov r9d, ebx
mov rdx, rsi
mov r8d, r15d
mov rcx, rdi
call fcn.180053340
mov rax, qword [rdi + 0x48]
imul ebp, dword [rdi + 0x58]
movsxd rcx, dword [rax + 0x18]
mov eax, ecx
imul eax, r15d
mov r15, qword [rsp + 0x50]
sar ebp, 8
movsxd r10, eax
add r10, qword [rdi + 0x70]
mov rdi, qword [rsp + 0x40]
cmp ebp, 0xfe
jge 0x180052389
mov r11, rcx
nop
movzx ecx, byte [rsi]
lea rsi, [rsi + 1]
mov r9d, ecx
mov edx, 0x100
shl r9d, 0x10
dec ebx
or r9d, ecx
mov ecx, 0x100
imul r9d, ebp
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shl r9d, 8
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r8d
shl edx, 8
shr eax, 8
or edx, r9d
and eax, 0xff00ff
and edx, 0xff00ff00
sub ecx, eax
or ecx, r8d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r10], ecx
add r10, r11
test ebx, ebx
jg 0x1800522d0
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret
mov r9, rcx
nop dword [rax]
movzx ecx, byte [rsi]
lea rsi, [rsi + 1]
mov edx, ecx
mov eax, 0x100
sub eax, ecx
shl edx, 0x10
or edx, ecx
dec ebx
mov ecx, dword [r10]
mov r8d, ecx
shr ecx, 8
and r8d, 0xff00ff
and ecx, 0xff00ff
imul r8d, eax
imul ecx, eax
shr r8d, 8
shr ecx, 8
and r8d, 0xff00ff
and ecx, 0xff00ff
add r8d, edx
add ecx, edx
mov edx, 0x100
mov eax, ecx
shl ecx, 8
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r8d
shl edx, 8
or edx, ecx
shr eax, 8
and eax, 0xff00ff
and edx, 0xff00ff00
mov ecx, 0x100
sub ecx, eax
or ecx, r8d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r10], ecx
add r10, r9
test ebx, ebx
jg 0x180052390
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret
Function at 0x180052430
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rbx, r8d
mov ebp, r9d
mov r15d, edx
mov rsi, rcx
cmp ebx, dword [rcx + 0x80]
jle 0x180052482
mov qword [rcx + 0x80], rbx
mov rcx, qword [rcx + 0x78]
call fcn.180124068
lea rcx, [rbx + rbx*2]
test rcx, rcx
jne 0x180052479
xor eax, eax
jmp 0x18005247e
call fcn.180124500
mov qword [rsi + 0x78], rax
mov rdi, qword [rsi + 0x78]
mov r9d, ebx
mov rdx, rdi
mov r8d, r15d
mov rcx, rsi
call fcn.1800534d0
mov rax, qword [rsi + 0x48]
imul ebp, dword [rsi + 0x58]
movsxd rcx, dword [rax + 0x18]
mov eax, ecx
imul eax, r15d
sar ebp, 8
movsxd r11, eax
add r11, qword [rsi + 0x70]
cmp ebp, 0xfe
jge 0x1800525a4
mov rsi, rcx
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r11]
mov rcx, rdi
mov edx, 0x100
add rdi, 3
dec ebx
movzx r10d, byte [rcx + 1]
movzx r9d, byte [rcx + 2]
or r10d, 0xff0000
shl r9d, 0x10
imul r10d, ebp
shr r10d, 8
and r10d, 0xff00ff
mov eax, r10d
shr eax, 0x10
sub edx, eax
movzx eax, byte [rcx]
or r9d, eax
mov ecx, 0x100
mov eax, r8d
imul r9d, ebp
and eax, 0xff00ff
shr r8d, 8
imul eax, edx
and r8d, 0xff00ff
imul r8d, edx
mov edx, 0x100
shr r9d, 8
and r9d, 0xff00ff
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r10d, r8d
mov eax, r10d
shl r10d, 8
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl edx, 8
shr eax, 8
or edx, r10d
and eax, 0xff00ff
and edx, 0xff00ff00
sub ecx, eax
or ecx, r9d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r11], ecx
add r11, rsi
test ebx, ebx
jg 0x1800524d0
jmp 0x1800525e7
mov r8, rcx
nop word [rax + rax]
mov rax, rdi
dec ebx
add rdi, 3
movzx ecx, byte [rax + 2]
movzx edx, word [rax]
or ecx, 0xffffff00
shl ecx, 8
mov word [rsp + 0x50], dx
movzx eax, byte [rsp + 0x51]
or ecx, eax
movzx eax, dl
shl ecx, 8
or ecx, eax
mov dword [r11], ecx
add r11, r8
test ebx, ebx
jg 0x1800525b0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x180052600
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rbx, r8d
mov ebp, r9d
mov r15d, edx
mov rsi, rcx
cmp ebx, dword [rcx + 0x80]
jle 0x180052652
mov qword [rcx + 0x80], rbx
mov rcx, qword [rcx + 0x78]
call fcn.180124068
lea rcx, [rbx + rbx*2]
test rcx, rcx
jne 0x180052649
xor eax, eax
jmp 0x18005264e
call fcn.180124500
mov qword [rsi + 0x78], rax
mov rdi, qword [rsi + 0x78]
mov r9d, ebx
mov rdx, rdi
mov r8d, r15d
mov rcx, rsi
call fcn.180053900
mov rax, qword [rsi + 0x48]
imul ebp, dword [rsi + 0x58]
movsxd rcx, dword [rax + 0x18]
mov eax, ecx
imul eax, r15d
sar ebp, 8
movsxd r11, eax
add r11, qword [rsi + 0x70]
cmp ebp, 0xfe
jge 0x180052774
mov rsi, rcx
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r11]
mov rcx, rdi
mov edx, 0x100
add rdi, 3
dec ebx
movzx r10d, byte [rcx + 1]
movzx r9d, byte [rcx + 2]
or r10d, 0xff0000
shl r9d, 0x10
imul r10d, ebp
shr r10d, 8
and r10d, 0xff00ff
mov eax, r10d
shr eax, 0x10
sub edx, eax
movzx eax, byte [rcx]
or r9d, eax
mov ecx, 0x100
mov eax, r8d
imul r9d, ebp
and eax, 0xff00ff
shr r8d, 8
imul eax, edx
and r8d, 0xff00ff
imul r8d, edx
mov edx, 0x100
shr r9d, 8
and r9d, 0xff00ff
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r10d, r8d
mov eax, r10d
shl r10d, 8
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl edx, 8
shr eax, 8
or edx, r10d
and eax, 0xff00ff
and edx, 0xff00ff00
sub ecx, eax
or ecx, r9d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r11], ecx
add r11, rsi
test ebx, ebx
jg 0x1800526a0
jmp 0x1800527b7
mov r8, rcx
nop word [rax + rax]
mov rax, rdi
dec ebx
add rdi, 3
movzx ecx, byte [rax + 2]
movzx edx, word [rax]
or ecx, 0xffffff00
shl ecx, 8
mov word [rsp + 0x50], dx
movzx eax, byte [rsp + 0x51]
or ecx, eax
movzx eax, dl
shl ecx, 8
or ecx, eax
mov dword [r11], ecx
add r11, r8
test ebx, ebx
jg 0x180052780
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1800527d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rdi, r8d
mov ebp, r9d
mov r15d, edx
mov rsi, rcx
cmp edi, dword [rcx + 0x80]
jle 0x180052826
mov qword [rcx + 0x80], rdi
mov rcx, qword [rcx + 0x78]
call fcn.180124068
lea rcx, [rdi*4]
test rcx, rcx
jne 0x18005281d
xor eax, eax
jmp 0x180052822
call fcn.180124500
mov qword [rsi + 0x78], rax
mov rbx, qword [rsi + 0x78]
mov r9d, edi
mov rdx, rbx
mov r8d, r15d
mov rcx, rsi
call fcn.180053b50
mov rax, qword [rsi + 0x48]
imul ebp, dword [rsi + 0x58]
movsxd rcx, dword [rax + 0x18]
mov eax, ecx
mov r11, rcx
imul eax, r15d
sar ebp, 8
movsxd r10, eax
add r10, qword [rsi + 0x70]
cmp ebp, 0xfe
jge 0x180052940
nop word [rax + rax]
mov edx, dword [rbx]
lea rbx, [rbx + 4]
mov r9d, edx
mov ecx, 0x100
and edx, 0xff00ff
shr r9d, 8
imul edx, ebp
and r9d, 0xff00ff
imul r9d, ebp
dec edi
shr edx, 8
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
shl r9d, 8
sub edx, eax
mov eax, r8d
shl edx, 8
shr eax, 8
or edx, r9d
and eax, 0xff00ff
and edx, 0xff00ff00
sub ecx, eax
or ecx, r8d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r10], ecx
add r10, r11
test edi, edi
jg 0x180052870
jmp 0x1800529eb
mov edx, dword [rbx]
lea rbx, [rbx + 4]
mov r9d, edx
mov ecx, 0x100
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
dec edi
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
shl r9d, 8
sub edx, eax
mov eax, r8d
shl edx, 8
shr eax, 8
or edx, r9d
and eax, 0xff00ff
and edx, 0xff00ff00
sub ecx, eax
or ecx, r8d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r10], ecx
add r10, r11
test edi, edi
jg 0x180052940
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x180052b30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rdi, r8d
mov ebp, r9d
mov r15d, edx
mov rsi, rcx
cmp edi, dword [rcx + 0x80]
jle 0x180052b86
mov qword [rcx + 0x80], rdi
mov rcx, qword [rcx + 0x78]
call fcn.180124068
lea rcx, [rdi*4]
test rcx, rcx
jne 0x180052b7d
xor eax, eax
jmp 0x180052b82
call fcn.180124500
mov qword [rsi + 0x78], rax
mov rbx, qword [rsi + 0x78]
mov r9d, edi
mov rdx, rbx
mov r8d, r15d
mov rcx, rsi
call fcn.180038e90
mov rax, qword [rsi + 0x48]
imul ebp, dword [rsi + 0x58]
movsxd rcx, dword [rax + 0x18]
mov eax, ecx
mov r11, rcx
imul eax, r15d
sar ebp, 8
movsxd r10, eax
add r10, qword [rsi + 0x70]
cmp ebp, 0xfe
jge 0x180052ca0
nop word [rax + rax]
mov edx, dword [rbx]
lea rbx, [rbx + 4]
mov r9d, edx
mov ecx, 0x100
and edx, 0xff00ff
shr r9d, 8
imul edx, ebp
and r9d, 0xff00ff
imul r9d, ebp
dec edi
shr edx, 8
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
shl r9d, 8
sub edx, eax
mov eax, r8d
shl edx, 8
shr eax, 8
or edx, r9d
and eax, 0xff00ff
and edx, 0xff00ff00
sub ecx, eax
or ecx, r8d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r10], ecx
add r10, r11
test edi, edi
jg 0x180052bd0
jmp 0x180052d4b
mov edx, dword [rbx]
lea rbx, [rbx + 4]
mov r9d, edx
mov ecx, 0x100
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
dec edi
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
shl r9d, 8
sub edx, eax
mov eax, r8d
shl edx, 8
shr eax, 8
or edx, r9d
and eax, 0xff00ff
and edx, 0xff00ff00
sub ecx, eax
or ecx, r8d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r10], ecx
add r10, r11
test edi, edi
jg 0x180052ca0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x180052e30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rax, qword [rcx]
mov ebx, r8d
shr r8d, 8
and ebx, 0xff00ff
and r8d, 0xff00ff
mov r10d, 0x100
mov edi, r9d
mov r11, rdx
movsxd rsi, dword [rax + 0x18]
mov eax, r8d
shr eax, 0x10
sub r10d, eax
nop
mov ecx, dword [r11]
mov edx, 0x100
mov r9d, ecx
dec edi
shr ecx, 8
and r9d, 0xff00ff
and ecx, 0xff00ff
imul r9d, r10d
imul ecx, r10d
shr r9d, 8
shr ecx, 8
and r9d, 0xff00ff
and ecx, 0xff00ff
add r9d, ebx
add ecx, r8d
mov eax, ecx
shl ecx, 8
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl edx, 8
or edx, ecx
shr eax, 8
and eax, 0xff00ff
and edx, 0xff00ff00
mov ecx, 0x100
sub ecx, eax
or ecx, r9d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r11], ecx
add r11, rsi
test edi, edi
jg 0x180052e70
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x180055cd0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [rcx + 0x228]
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne fcn.1801f6270
xor al, al
ret

Function at 0x180055ea0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [rcx + 0x228]
mov rcx, qword [rax + 8]
test rcx, rcx
jne fcn.1801f6270
xor al, al
ret

Function at 0x180061bf0
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x38]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x60]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x48]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x180061c72
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x180061c74
cmp rax, rcx
je 0x180061c72
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x180061c62
jmp 0x180061c74
xor eax, eax
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x180061c84
mov eax, dword [rax + 0x14]
ret
xor eax, eax
ret
Function at 0x180081da0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov ecx, send
shr ebx, 0xf
and ebx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov edi, ebx
or edi, 2
mov ecx, reloc.WS2_32.dll_select
test al, 1
cmove edi, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov esi, edi
or esi, 4
mov ecx, 0xa5
test al, 1
cmove esi, edi
mov ebx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x180081e1f
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x180081e1f
and ebx, 0xfffffffd
or ebx, 4
mov eax, dword [0x18067b530]
mov rsi, qword [rsp + 0x38]
and eax, 0x70
or eax, ebx
mov rbx, qword [rsp + 0x30]
mov dword [0x18067b530], eax
add rsp, 0x20
pop rdi
ret

Function at 0x180081e40
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x18067b530]
mov rdx, rcx
mov r9, rcx
shl rdx, 4
and edx, 0x10
mov r8d, edx
or r8d, 0x20
test cl, 2
cmove r8d, edx
mov ecx, r8d
or ecx, 0x40
test r9b, 0x10
cmove ecx, r8d
and eax, 0xffffff8f
or ecx, eax
mov dword [0x18067b530], ecx
jmp fcn.180081da0
Function at 0x180085cc0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x1a0
mov rax, qword [0x18065f280]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbp, rdx
mov rdi, rcx
call fcn.180081da0
lea rax, [rbp - 0x10]
cmp rax, 0x95
ja case.0x180085d11.19
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x85e94]
mov r8d, dword [rcx + rax*4 + 0x85e88]
add r8, rcx
jmp r8
mov dl, 1
mov rcx, rdi
call fcn.180232960
mov rcx, rdi
movzx r14d, al
call fcn.180085b00
jmp 0x180085e58
mov dl, 1
mov rcx, rdi
call fcn.180232960
mov ecx, dword [0x18067b530]
lea rdx, [rsp + 0x30]
and ecx, 0xffffff8f
bts ebp, 0x10
mov dword [rsp + 0x34], ecx
xor esi, esi
mov rcx, rdi
mov dword [rsp + 0x30], ebp
movzx ebx, al
mov dword [rsp + 0x38], esi
call fcn.180232ab0
test al, al
jne 0x180085e67
test bl, bl
jmp 0x180085e5b
mov dl, 1
mov rcx, rdi
call fcn.180232960
mov rdx, qword [rdi + 0xe0]
lea rcx, [rsp + 0x40]
xor esi, esi
mov r9d, 0x103
mov r8d, 0x102
mov dword [rsp + 0x20], esi
movzx r14d, al
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x180085e58
mov edx, 2
mov qword [rsp + 0x1e0], r15
mov ecx, ebp
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
mov ecx, ebp
mov r15d, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea rcx, [rsp + 0x90]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetKeyboardState]
xorps xmm0, xmm0
mov dword [rsp + 0x28], esi
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], 8
lea r8, [rsp + 0x90]
mov edx, ebx
mov ecx, ebp
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
je 0x180085e1e
mov word [rsp + 0x70], si
jmp 0x180085e23
movzx esi, word [rsp + 0x70]
mov eax, dword [0x18067b530]
lea rdx, [rsp + 0x30]
and eax, 0xffffff8f
movzx ecx, r15w
mov dword [rsp + 0x34], eax
movzx eax, si
mov dword [rsp + 0x30], ecx
mov rcx, rdi
mov dword [rsp + 0x38], eax
call fcn.180232ab0
mov r15, qword [rsp + 0x1e0]
test al, al
jne 0x180085e67
test r14b, r14b
jne 0x180085e67
call fcn.1802d2800
test rax, rax
je 0x180085e69
mov al, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.18011d9a0
add rsp, 0x1a0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180085f30
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
mov edi, edx
mov rbp, rcx
call fcn.180081da0
sar rbx, 0x10
lea eax, [rdi - 0x30]
movzx ecx, bl
mov esi, edi
cmp eax, 9
ja 0x180085f87
lea eax, [rcx - 0x47]
cmp eax, 0xb
ja case.0x180085f7d.74
lea rdx, [0x180000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x85ff4]
add rcx, rdx
jmp rcx
add edi, 0x10030
jmp case.0x180085f7d.74
mov edx, 1
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, eax
mov edx, 2
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx ecx, ax
test ecx, ecx
cmovne edi, ecx
cmp esi, 0x20
jae case.0x180085f7d.74
test byte [0x18067b530], 6
mov eax, 0
cmovne esi, eax
mov eax, dword [0x18067b530]
lea rdx, [rsp + 0x20]
and eax, 0xffffff8f
mov dword [rsp + 0x20], edi
mov rcx, rbp
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], esi
call fcn.180232ab0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret