joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004b10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180043ac8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, rdx
mov rbx, rcx
mov rdx, qword [0x180048540]
test rdx, rdx
jne 0x180004c11
movdqa xmm0, xmmword [0x180031e70]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x180031cc0]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0xbb87b7
mov byte [rsp + 0x54], 1
xor ecx, ecx
nop dword [rax]
lea eax, [rcx - 0x4e]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x23
jb 0x180004b70
mov byte [rsp + 0x54], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180004ba2
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.1800021f0
nop
lea rcx, [rsp + 0x58]
call fcn.180001230
mov rdx, rax
mov qword [0x180048540], rax
mov rax, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x180004c11
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004c05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004c50
call fcn.18000ef44
mov rdx, qword [0x180048540]
mov qword [rsp + 0x20], rdi
test rdx, rdx
je 0x180004c2c
mov rax, qword [rbx]
lea r8, [rsp + 0x20]
mov rcx, rbx
call qword [rax + 0x220]
movss xmm0, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18000f360
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
call fcn.1800158f4
int3
Function at 0x1800063a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x57]
sub rsp, 0xc0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
mov rax, qword [0x180043ac8]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov rax, qword [0x180048558]
movaps xmm8, xmm3
mov rdi, qword [rbp + 0x7f]
mov rbx, rcx
movq xmm6, r8
movq xmm7, rdx
test rax, rax
jne 0x180006469
movdqa xmm0, xmmword [0x180031ec0]
xor ecx, ecx
movdqa xmm1, xmmword [0x180031e60]
movdqa xmmword [rbp - 0x31], xmm0
movdqa xmm0, xmmword [0x180031c60]
movdqa xmmword [rbp - 0x11], xmm0
movdqa xmmword [rbp - 0x21], xmm1
mov dword [rbp - 1], 0xc5d7a5c2
mov dword [rbp + 3], 0xd8c8a1d6
mov dword [rbp + 7], 0xa9d8cbda
mov dword [rbp + 0xb], 0x100d0ce
nop dword [rax + rax]
lea eax, [rcx - 0x4e]
xor byte [rbp + rcx - 0x31], al
inc rcx
cmp rcx, 0x3e
jb 0x180006440
lea rcx, [rbp - 0x31]
mov byte [rbp + 0xe], 0
call fcn.1800048f0
mov qword [0x180048558], rax
test rax, rax
je 0x180006491
test rbx, rbx
je 0x180006491
movups xmm0, xmmword [rdi]
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x20], rcx
movaps xmm3, xmm8
mov rcx, rbx
movaps xmmword [rbp - 0x41], xmm0
movq r8, xmm6
movq rdx, xmm7
call rax
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.18000f360
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop rbp
ret
Function at 0x1800064d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xf8
mov rax, qword [0x180043ac8]
xor rax, rsp
mov qword [rbp - 9], rax
mov rdi, r9
mov r12, r8
mov r15, rdx
mov rbx, rcx
mov r14, qword [rbp + 0x8f]
mov rsi, qword [rbp + 0x6f]
mov r13, qword [rbp + 0x77]
mov rdx, qword [rbp + 0x87]
mov qword [rsp + 0x20], rdx
mov rax, qword [rbp + 0xaf]
mov qword [rsp + 0x28], rax
mov rdx, qword [0x180048520]
test rdx, rdx
jne 0x1800065fe
movdqa xmm0, xmmword [0x180031e70]
movdqu xmmword [rbp - 0x51], xmm0
movdqa xmm1, xmmword [0x180031cf0]
movdqu xmmword [rbp - 0x41], xmm1
mov dword [rbp - 0x31], 0x100a7aa
xor ecx, ecx
nop dword [rax]
lea eax, [rcx - 0x4e]
xor byte [rbp + rcx - 0x51], al
inc rcx
cmp rcx, 0x22
jb 0x180006560
mov byte [rbp - 0x2e], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
lea rax, [rbp - 0x51]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x180006590
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x29]
call fcn.1800021f0
nop
lea rcx, [rbp - 0x29]
call fcn.180001230
mov rdx, rax
mov qword [0x180048520], rax
mov rax, qword [rbp - 0x11]
cmp rax, 0x10
jb 0x1800065fe
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800065f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800066ce
call fcn.18000ef44
mov rdx, qword [0x180048520]
mov qword [rsp + 0x30], r15
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x38], xmm0
movss xmm1, dword [rdi]
movss dword [rsp + 0x48], xmm1
movss xmm0, dword [rdi + 4]
movss dword [rsp + 0x4c], xmm0
movss xmm1, dword [rsi]
movss dword [rsp + 0x50], xmm1
movss xmm0, dword [rsi + 4]
movss dword [rsp + 0x54], xmm0
movups xmm1, xmmword [r13]
movups xmmword [rsp + 0x58], xmm1
movss xmm0, dword [rbp + 0x7f]
movss dword [rsp + 0x68], xmm0
mov rax, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmmword [rsp + 0x6c], xmm1
movss xmm0, dword [r14]
movss dword [rbp - 0x75], xmm0
movss xmm1, dword [r14 + 4]
movss dword [rbp - 0x71], xmm1
movzx eax, byte [rbp + 0x97]
mov byte [rbp - 0x6d], al
movzx eax, byte [rbp + 0x9f]
mov byte [rbp - 0x6c], al
movzx eax, byte [rbp + 0xa7]
mov byte [rbp - 0x6b], al
mov rax, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x69], xmm0
test rdx, rdx
je 0x1800066ae
mov rax, qword [rbx]
lea r8, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x220]
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.18000f360
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1800158f4
int3
Function at 0x1800066e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x98
mov rax, qword [0x180043ac8]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x180048528]
test rax, rax
jne 0x1800067e0
movdqa xmm0, xmmword [0x180031e70]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x180031db0]
movdqu xmmword [rsp + 0x50], xmm1
mov word [rsp + 0x60], 0x100
xor ecx, ecx
nop
lea eax, [rcx - 0x4e]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x20
jb 0x180006740
mov byte [rsp + 0x61], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180006772
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.1800021f0
nop
lea rcx, [rsp + 0x68]
call fcn.180001230
mov qword [0x180048528], rax
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x1800067e0
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800067d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000684e
call fcn.18000ef44
mov rax, qword [0x180048528]
xorps xmm1, xmm1
movss dword [rsp + 0x38], xmm1
xorps xmm2, xmm2
movss dword [rsp + 0x3c], xmm2
mov qword [rsp + 0x20], rsi
movups xmm0, xmmword [rbp]
movups xmmword [rsp + 0x28], xmm0
test rax, rax
je 0x180006826
mov r9, qword [rdi]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rdi
call qword [r9 + 0x220]
movss xmm2, dword [rsp + 0x3c]
movss xmm1, dword [rsp + 0x38]
movss dword [rbx], xmm1
movss dword [rbx + 4], xmm2
mov rax, rbx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.18000f360
add rsp, 0x98
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1800158f4
int3
Function at 0x180006860
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x180043ac8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
movzx r14d, r9b
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rdx, qword [0x180048548]
test rdx, rdx
jne 0x18000696a
movdqa xmm0, xmmword [0x180031e70]
movdqu xmmword [rbp - 0x21], xmm0
movdqa xmm1, xmmword [0x180031bc0]
movdqu xmmword [rbp - 0x11], xmm1
mov dword [rbp - 1], 0xb2bd80b4
mov dword [rbp + 3], 0xb68ca3be
mov word [rbp + 7], 0x100
xor ecx, ecx
nop
lea eax, [rcx - 0x4e]
xor byte [rbp + rcx - 0x21], al
inc rcx
cmp rcx, 0x28
jb 0x1800068d0
mov byte [rbp + 8], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f], xmm1
lea rax, [rbp - 0x21]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x180006900
lea rdx, [rbp - 0x21]
lea rcx, [rbp + 0xf]
call fcn.1800021f0
nop
lea rcx, [rbp + 0xf]
call fcn.180001230
mov rdx, rax
mov qword [0x180048548], rax
mov rax, qword [rbp + 0x27]
cmp rax, 0x10
jb 0x18000696a
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000695e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800069b4
call fcn.18000ef44
mov rdx, qword [0x180048548]
mov qword [rbp - 0x39], rsi
movsd xmm0, qword [rdi]
movsd qword [rbp - 0x31], xmm0
mov eax, dword [rdi + 8]
mov dword [rbp - 0x29], eax
mov byte [rbp - 0x25], r14b
test rdx, rdx
je 0x180006996
mov rax, qword [rbx]
lea r8, [rbp - 0x39]
mov rcx, rbx
call qword [rax + 0x220]
movzx eax, byte [rbp - 0x24]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.18000f360
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1800158f4
int3
Function at 0x180007920
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x180043ac8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rbx, r9
movzx r14d, r8b
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [0x180048538]
test rdx, rdx
jne 0x180007a4a
movdqa xmm0, xmmword [0x180031e70]
movdqu xmmword [rbp - 0x31], xmm0
movdqa xmm1, xmmword [0x180031c10]
movdqu xmmword [rbp - 0x21], xmm1
movdqa xmm0, xmmword [0x180031b40]
movdqu xmmword [rbp - 0x11], xmm0
mov dword [rbp - 1], 0x8a8d9783
mov dword [rbp + 3], 0xba87b388
mov dword [rbp + 7], 0x88899989
mov word [rbp + 0xb], 0x80
mov byte [rbp + 0xd], 1
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx - 0x4e]
xor byte [rbp + rcx - 0x31], al
inc rcx
cmp rcx, 0x3d
jb 0x1800079b0
mov byte [rbp + 0xd], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f], xmm1
lea rax, [rbp - 0x31]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1800079e0
lea rdx, [rbp - 0x31]
lea rcx, [rbp + 0xf]
call fcn.1800021f0
nop
lea rcx, [rbp + 0xf]
call fcn.180001230
mov rdx, rax
mov qword [0x180048538], rax
mov rax, qword [rbp + 0x27]
cmp rax, 0x10
jb 0x180007a4a
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007a3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007ab8
call fcn.18000ef44
mov rdx, qword [0x180048538]
xorps xmm1, xmm1
movss dword [rbp - 0x3d], xmm1
xorps xmm2, xmm2
movss dword [rbp - 0x39], xmm2
movsd xmm0, qword [rsi]
movsd qword [rbp - 0x49], xmm0
mov eax, dword [rsi + 8]
mov dword [rbp - 0x41], eax
mov byte [rbp - 0x35], r14b
test rdx, rdx
je 0x180007a8c
mov rax, qword [rdi]
lea r8, [rbp - 0x49]
mov rcx, rdi
call qword [rax + 0x220]
movss xmm2, dword [rbp - 0x39]
movss xmm1, dword [rbp - 0x3d]
test rbx, rbx
je 0x180007a9a
movss dword [rbx], xmm1
movss dword [rbx + 4], xmm2
movzx eax, byte [rbp - 0x34]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.18000f360
add rsp, 0xa0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1800158f4
int3
Function at 0x18000b2a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180043ac8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [0x180048578]
movzx esi, r8b
mov rdi, rdx
mov rbx, rcx
test rax, rax
jne 0x18000b344
movdqa xmm0, xmmword [0x180031e70]
xor ecx, ecx
movdqa xmm1, xmmword [0x180031d10]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x180031b90]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x20], 0x808a8aae
mov dword [rbp - 0x1c], 0x8cbe9587
mov dword [rbp - 0x18], 0x848f8486
mov dword [rbp - 0x14], 0x100969a
nop dword [rax + rax]
lea eax, [rcx - 0x4e]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x3e
jb 0x18000b320
lea rcx, [rbp - 0x50]
mov byte [rbp - 0x11], 0
call fcn.180004840
mov qword [0x180048578], rax
movsd xmm0, qword [rdi]
mov edx, dword [rdi + 8]
movsd qword [rbp - 0x60], xmm0
mov dword [rbp - 0x58], edx
mov byte [rbp - 0x54], sil
test rax, rax
je 0x18000b370
mov r9, qword [rbx]
lea r8, [rbp - 0x60]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x220]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000f360
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000b390
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180043ac8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [0x1800497e8]
movzx ebx, cl
test rax, rax
jne 0x18000b426
movdqa xmm0, xmmword [0x180031e70]
xor ecx, ecx
movdqa xmm1, xmmword [0x180031d30]
movdqu xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x48], 0xb0a6bcbc
movdqu xmmword [rsp + 0x38], xmm1
mov dword [rsp + 0x4c], 0xb2b7b89a
mov dword [rsp + 0x50], 0xa8acb593
mov word [rsp + 0x54], 0xaa
mov byte [rsp + 0x56], 1
nop word [rax + rax]
lea eax, [rcx - 0x4e]
xor byte [rsp + rcx + 0x28], al
inc rcx
cmp rcx, 0x2d
jb 0x18000b400
lea rcx, [rsp + 0x28]
mov byte [rsp + 0x56], 0
call fcn.180004840
mov qword [0x1800497e8], rax
mov rcx, qword [0x180044c90]
mov byte [rsp + 0x20], bl
test rax, rax
je 0x18000b448
mov r9, qword [rcx]
lea r8, [rsp + 0x20]
mov rdx, rax
call qword [r9 + 0x220]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18000f360
add rsp, 0x60
pop rbx
ret
Function at 0x18000c0d0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x180043ac8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movzx edi, dl
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edx, edx
mov ecx, edi
xor ebp, ebp
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r9d, eax
cmp dil, 1
jne 0x18000c143
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 6
mov qword [rbx + 0x18], 0xf
mov ecx, dword [str.MOUSE0]
mov dword [rbx], ecx
movzx ecx, word [0x180031620]
mov word [rbx + 4], cx
mov byte [rbx + 6], bpl
jmp 0x18000c306
cmp dil, 2
jne 0x18000c17b
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 6
mov qword [rbx + 0x18], 0xf
mov eax, dword [str.MOUSE1]
mov dword [rbx], eax
movzx eax, word [0x180031628]
mov word [rbx + 4], ax
mov byte [rbx + 6], bpl
jmp 0x18000c306
cmp dil, 4
jne 0x18000c1be
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 7
mov qword [rbx + 0x18], 0xf
mov rax, qword [str.MBUTTON]
mov dword [rbx], eax
movzx eax, word [0x180031634]
mov word [rbx + 4], ax
movzx eax, byte [0x180031636]
mov byte [rbx + 6], al
mov byte [rbx + 7], bpl
jmp 0x18000c306
cmp dil, 5
jne 0x18000c1f0
xorps xmm0, xmm0
movabs rax, 0x314e4f5454554258
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 8
mov qword [rbx + 0x18], 0xf
mov qword [rbx], rax
mov byte [rbx + 8], bpl
jmp 0x18000c306
cmp dil, 6
jne 0x18000c222
xorps xmm0, xmm0
movabs rax, 0x324e4f5454554258
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 8
mov qword [rbx + 0x18], 0xf
mov qword [rbx], rax
mov byte [rbx + 8], bpl
jmp 0x18000c306
cmp dil, 0xa0
jne 0x18000c25a
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 6
mov qword [rbx + 0x18], 0xf
mov eax, dword [str.LSHIFT]
mov dword [rbx], eax
movzx eax, word [0x18003163c]
mov word [rbx + 4], ax
mov byte [rbx + 6], bpl
jmp 0x18000c306
cmp dil, 0xa1
jne 0x18000c28f
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 6
mov qword [rbx + 0x18], 0xf
mov eax, dword [str.RSHIFT]
mov dword [rbx], eax
movzx eax, word [0x180031644]
mov word [rbx + 4], ax
mov byte [rbx + 6], bpl
jmp 0x18000c306
lea eax, [rdi - 0x21]
cmp eax, 0x84
ja case.0x18000c2b4.41
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0xc334]
mov ecx, dword [rdx + rax*4 + 0xc32c]
add rcx, rdx
jmp rcx
bts r9d, 8
shl r9d, 0x10
lea rdx, [rsp + 0x30]
mov ecx, r9d
mov r8d, 0x80
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rbp
nop dword [rax]
inc r8
cmp byte [rax + r8], bpl
jne 0x18000c2f0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1800021f0
mov rax, rbx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18000f360
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000ca20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x18000ca43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x18000ca30
mov byte [rcx + 0x11], 0
mov rax, rcx
ret

Function at 0x18000ce80
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0x100
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x68], xmm11
movaps xmmword [r11 - 0x78], xmm12
mov rax, qword [0x180043ac8]
xor rax, rsp
mov qword [rbp - 0x29], rax
movaps xmm11, xmm2
xorps xmm6, xmm6
comiss xmm11, xmm6
mov rsi, r9
mov rdi, rcx
movaps xmm12, xmm1
jbe 0x18000d007
mov rax, qword [0x180048558]
mov qword [r11 + 8], rbx
mov rbx, qword [0x180044a60]
movaps xmmword [r11 - 0x28], xmm7
movaps xmmword [r11 - 0x38], xmm8
movaps xmmword [r11 - 0x48], xmm9
movss xmm9, dword [0x18003190c]
movaps xmmword [r11 - 0x58], xmm10
nop
movss xmm10, dword [rdi]
movaps xmm7, xmm6
movaps xmm8, xmm10
addss xmm8, xmm12
addss xmm7, dword [rdi + 4]
test rax, rax
jne 0x18000cf89
movdqa xmm0, xmmword [0x180031ec0]
xor ecx, ecx
movdqa xmm1, xmmword [0x180031e60]
movdqa xmmword [rbp - 0x69], xmm0
movdqa xmm0, xmmword [0x180031c60]
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmmword [rbp - 0x59], xmm1
mov dword [rbp - 0x39], 0xc5d7a5c2
mov dword [rbp - 0x35], 0xd8c8a1d6
mov dword [rbp - 0x31], 0xa9d8cbda
mov dword [rbp - 0x2d], 0x100d0ce
lea eax, [rcx - 0x4e]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0x3e
jb 0x18000cf60
lea rcx, [rbp - 0x69]
mov byte [rbp - 0x2a], 0
call fcn.1800048f0
mov qword [0x180048558], rax
test rax, rax
je 0x18000cfcd
test rbx, rbx
je 0x18000cfcd
movups xmm0, xmmword [rsi]
lea rcx, [rbp - 0x79]
movaps xmm1, xmm10
mov qword [rsp + 0x20], rcx
movaps xmmword [rbp - 0x79], xmm0
movaps xmm3, xmm9
movaps xmm0, xmm8
unpcklps xmm1, xmm7
unpcklps xmm0, xmm7
movq rdx, xmm1
movq r8, xmm0
mov rcx, rbx
call rax
mov rax, qword [0x180048558]
mov rbx, qword [0x180044a60]
addss xmm6, xmm9
comiss xmm11, xmm6
ja 0x18000cf00
movaps xmm10, xmmword [rsp + 0xb0]
movaps xmm9, xmmword [rsp + 0xc0]
movaps xmm8, xmmword [rsp + 0xd0]
movaps xmm7, xmmword [rsp + 0xe0]
mov rbx, qword [rsp + 0x110]
mov rcx, qword [rbp - 0x29]
xor rcx, rsp
call fcn.18000f360
lea r11, [rsp + 0x100]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
mov rsp, r11
pop rbp
ret
Function at 0x18000d040
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rdi
push rbp
lea rbp, [r11 - 0x18]
sub rsp, 0x110
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x48], xmm9
mov rax, qword [0x180043ac8]
xor rax, rsp
mov qword [rbp - 0x70], rax
movaps xmm9, xmm2
mov qword [rsp + 0x30], rcx
xorps xmm6, xmm6
mov rdi, r9
comiss xmm9, xmm6
jbe 0x18000d1e3
mov rax, qword [0x180048558]
mov qword [r11 + 0x10], rbx
mov rbx, qword [0x180044ff0]
movaps xmmword [r11 - 0x28], xmm7
movaps xmmword [r11 - 0x38], xmm8
movss xmm8, dword [0x18003190c]
movaps xmmword [r11 - 0x58], xmm10
movss xmm10, dword [rsp + 0x34]
movaps xmmword [r11 - 0x68], xmm11
movaps xmmword [r11 - 0x78], xmm12
movss xmm12, dword [rsp + 0x30]
movaps xmm11, xmm12
addss xmm11, xmm1
nop
movaps xmm7, xmm10
addss xmm7, xmm6
test rax, rax
jne 0x18000d15a
movdqa xmm0, xmmword [0x180031ec0]
xor ecx, ecx
movdqa xmm1, xmmword [0x180031e60]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [0x180031c60]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rsp + 0x60], xmm1
mov dword [rbp - 0x80], 0xc5d7a5c2
mov dword [rbp - 0x7c], 0xd8c8a1d6
mov dword [rbp - 0x78], 0xa9d8cbda
mov dword [rbp - 0x74], 0x100d0ce
nop word [rax + rax]
lea eax, [rcx - 0x4e]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 0x3e
jb 0x18000d130
lea rcx, [rsp + 0x50]
mov byte [rbp - 0x71], 0
call fcn.1800048f0
mov qword [0x180048558], rax
test rax, rax
je 0x18000d1a0
test rbx, rbx
je 0x18000d1a0
movups xmm0, xmmword [rdi]
lea rcx, [rsp + 0x40]
movaps xmm1, xmm12
mov qword [rsp + 0x20], rcx
movaps xmmword [rsp + 0x40], xmm0
movaps xmm3, xmm8
movaps xmm0, xmm11
unpcklps xmm1, xmm7
unpcklps xmm0, xmm7
movq rdx, xmm1
movq r8, xmm0
mov rcx, rbx
call rax
mov rax, qword [0x180048558]
mov rbx, qword [0x180044ff0]
addss xmm6, xmm8
comiss xmm9, xmm6
ja 0x18000d0d0
movaps xmm12, xmmword [rsp + 0xa0]
movaps xmm11, xmmword [rsp + 0xb0]
movaps xmm10, xmmword [rsp + 0xc0]
movaps xmm8, xmmword [rsp + 0xe0]
movaps xmm7, xmmword [rsp + 0xf0]
mov rbx, qword [rsp + 0x128]
mov rcx, qword [rbp - 0x70]
xor rcx, rsp
call fcn.18000f360
lea r11, [rsp + 0x110]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop rbp
ret
Function at 0x18000da50
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180043ac8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8, rcx
cmp edx, 1
jne 0x18000dc22
movdqa xmm0, xmmword [0x180031c80]
movdqa xmm1, xmmword [0x180031bb0]
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x78], rbx
xor ebx, ebx
mov ecx, ebx
mov qword [0x180044bd8], 1
movdqu xmmword [rbp - 0x38], xmm0
mov dword [rbp - 0x18], 0xbab9f381
movdqu xmmword [rbp - 0x28], xmm1
mov dword [rbp - 0x14], 0x100b2b2
nop word [rax + rax]
lea eax, [rcx - 0x4e]
xor byte [rbp + rcx - 0x38], al
inc rcx
cmp rcx, 0x26
jb 0x18000dac0
mov byte [rbp - 0x11], bl
nop dword [rax]
nop word [rax + rax]
mov edx, ebx
mov ecx, edx
movzx eax, byte [rbp + rcx - 0x38]
cmp byte [rcx + r9], al
jne 0x18000db34
inc edx
cmp edx, 7
jne 0x18000dae2
mov word [rbp - 0x40], 0x5a4d
nop dword [rax]
mov eax, ebx
mov edx, eax
movzx ecx, byte [rbp + rdx - 0x40]
cmp byte [rdx + r9], cl
jne 0x18000db39
inc eax
cmp eax, 2
jne 0x18000db02
add r9, 0x1000
nop dword [rax]
cmp byte [r9], 0xff
lea rax, [r9 + 1]
jne 0x18000db2f
cmp byte [rax], 0x23
je 0x18000db3e
mov r9, rax
jmp 0x18000db20
dec r9
jmp 0x18000dae0
dec r9
jmp 0x18000db00
movdqa xmm0, xmmword [0x180031e40]
mov rcx, rbx
movdqa xmm1, xmmword [0x180031e30]
movdqu xmmword [rbp - 0x38], xmm0
mov qword [0x180044bd8], r9
movdqu xmmword [rbp - 0x28], xmm1
mov dword [rbp - 0x18], 0xa4f6aa
mov byte [rbp - 0x14], 1
nop dword [rax]
lea eax, [rcx - 0x4e]
xor byte [rbp + rcx - 0x38], al
inc rcx
cmp rcx, 0x23
jb 0x18000db70
mov rdx, r9
mov byte [rbp - 0x14], bl
lea rcx, [rbp - 0x38]
call fcn.18000e100
movdqa xmm0, xmmword [0x180031c30]
mov rcx, rbx
movdqa xmm1, xmmword [0x180031d80]
movdqu xmmword [rbp - 0x38], xmm0
mov dword [rbp - 0x18], 0xfdbabab3
movdqu xmmword [rbp - 0x28], xmm1
mov word [rbp - 0x14], 0xff
mov byte [rbp - 0x12], 1
nop dword [rax]
lea eax, [rcx - 0x4e]
xor byte [rbp + rcx - 0x38], al
inc rcx
cmp rcx, 0x25
jb 0x18000dbc0
lea rcx, [rbp - 0x38]
mov byte [rbp - 0x12], bl
call fcn.18000e100
call fcn.18000dc50
movdqa xmm0, xmmword [0x180031ce0]
movdqu xmmword [rbp - 0x38], xmm0
mov dword [rbp - 0x28], 0xeba0a6ac
mov word [rbp - 0x24], 0xe8
mov byte [rbp - 0x22], 1
nop
lea eax, [rbx - 0x4e]
xor byte [rbp + rbx - 0x38], al
inc rbx
cmp rbx, 0x15
jb 0x18000dc00
mov rbx, qword [rsp + 0x78]
lea rcx, [rbp - 0x38]
mov byte [rbp - 0x22], 0
call fcn.18000e100
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000f360
add rsp, 0x60
pop rbp
ret