joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18018a0e0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xd0]
mov rax, qword [rcx + 0xd8]
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x1802b0e70]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
mov rcx, qword [0x18041dec0]
not ebx
cmp dword [rcx + 0x3ee8], ebx
jne 0x18018a16d
xor r9d, r9d
movsxd r8, edx
mov ecx, ebx
lea edx, [r9 + 4]
call fcn.180176250
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x18018a200
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xd8]
lea r9, [0x1802b0e70]
movss xmm2, dword [rcx + 0xf0]
movss xmm3, dword [rcx + 0xf4]
movsxd rcx, dword [rcx + 0xd0]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x18019d480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x18041dec0]
mov rcx, qword [rax + 0x4ae8]
mov r10, qword [rax + 0x3ea0]
movsxd rax, dword [rcx + 0x7c]
movups xmm0, xmmword [rcx + 0x170]
movss xmm4, dword [rcx + 0x170]
movss xmm3, dword [rcx + 0x174]
movss xmm2, dword [rcx + 0x178]
movss xmm1, dword [rcx + 0x17c]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x68
mov rax, qword [r10 + 0x278]
add r9, qword [rcx + 0x18]
movups xmmword [r10 + 0x218], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x278]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, byte [r9 + 0x57]
mov rdx, qword [r10 + 0x278]
mov rcx, qword [rcx + 0x1a0]
add rsp, 0x38
jmp fcn.180193250

Function at 0x18019d550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x18041dec0]
mov rcx, qword [rax + 0x4ae8]
mov r9, qword [rax + 0x3ea0]
movups xmm0, xmmword [r9 + 0x218]
movups xmmword [rcx + 0x170], xmm0
mov rax, qword [r9 + 0x278]
movups xmm0, xmmword [rcx + 0x150]
movss xmm4, dword [rcx + 0x150]
movss xmm3, dword [rcx + 0x154]
movss xmm2, dword [rcx + 0x158]
movss xmm1, dword [rcx + 0x15c]
movups xmmword [r9 + 0x218], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x278]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, byte [rcx + 0x207]
mov rcx, qword [rcx + 0x1a0]
mov rdx, qword [r9 + 0x278]
add rsp, 0x38
jmp fcn.180193250
Function at 0x1801bc350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x1801bc384
cmp ecx, r10d
jge 0x1801bc372
mov rcx, rbx
call fcn.1801b5a90
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x1801bc3be
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x1801bc3a0
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x1801bc3ed
mov edx, dword [0x18041fd70]
mov rax, qword gs:[0x58]
mov ecx, 0x10
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x1801bc41f
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
nop dword [rax]
cmp rax, r8
jb 0x1801bc409
xor dl, dl
jmp 0x1801bc412
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x1801bc400
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x1801bc3c2
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x1801bc494
mov edx, dword [0x18041fd70]
mov rax, qword gs:[0x58]
mov ecx, 0x10
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x1801bc4ae
mov rcx, rbx
call fcn.1801c17d0
test eax, eax
je 0x1801bc487
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1801cd4c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13d0
call fcn.180269ca0
sub rsp, rax
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov ebx, r8d
mov edi, edx
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsp + 0x34], eax
mov r9d, 1
mov dword [rsp + 0x13b4], 0xffffffff
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x34], eax
inc r9
cmp r9, 0x270
jb 0x1801cd510
mov ebp, 0x80000000
mov dword [rsp + 0x30], 0x270
cmp edi, ebp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
lea eax, [rdi - 0x80000000]
lea esi, [rdi + rbp]
cmovae esi, eax
lea edi, [rbx + rbp]
cmp ebx, ebp
lea eax, [rbx - 0x80000000]
cmovae edi, eax
sub edi, esi
cmp edi, 0xffffffff
jne 0x1801cd579
call fcn.180103240
mov ecx, eax
jmp 0x1801cd5b8
inc edi
mov ebx, edi
call fcn.180103240
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1801cd5b4
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1801cd5b4
nop word [rax + rax]
lea rcx, [rsp + 0x20]
call fcn.180103240
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1801cd5a0
shr rcx, 0x20
lea edx, [rsi + rcx]
cmp edx, ebp
lea ecx, [rdx - 0x80000000]
lea eax, [rdx + rbp]
cmovae eax, ecx
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.180269d00
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1801e0160
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1801e033a
cmp byte [0x18041b6d0], 0
jne 0x1801e033a
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov rdi, qword [0x1803d9018]
lea r14, [0x1803d9008]
cmp qword [0x1803d9020], 0x10
cmovae r14, qword [0x1803d9008]
movabs rbx, 0x7fffffffffffffff
cmp rdi, rbx
ja 0x1801e0363
lea esi, [rax + 0xf]
cmp rdi, 0x10
jae 0x1801e020b
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rsi
movups xmm0, xmmword [r14]
movaps xmmword [rbp - 0x60], xmm0
jmp 0x1801e0251
mov rax, rdi
or rax, rsi
cmp rax, rbx
ja 0x1801e0225
mov rbx, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbx, rcx
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x60]
call fcn.1800c14d0
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movaps xmm0, xmmword [rbp - 0x60]
xorps xmm2, xmm2
movaps xmmword [rbp - 0x40], xmm2
xorps xmm3, xmm3
movss dword [rbp - 0x30], xmm3
mov dword [rbp - 0x2c], 0xff
mov dword [rbp - 0x28], 0xff
mov dword [rbp - 0x24], 0xff
mov qword [rbp - 0x20], 0xff
mov rdx, qword [0x18041fa20]
cmp rdx, qword [0x18041fa28]
je 0x1801e02d5
movups xmmword [rdx], xmm0
movaps xmm0, xmmword [rbp - 0x50]
movups xmmword [rdx + 0x10], xmm0
mov byte [rbp - 0x60], 0
movss dword [rdx + 0x20], xmm2
xorps xmm0, xmm0
shufps xmm0, xmm2, 0x55
movss dword [rdx + 0x24], xmm0
xorps xmm1, xmm1
shufps xmm1, xmm2, 0xaa
movss dword [rdx + 0x28], xmm1
movss dword [rdx + 0x2c], xmm2
movss dword [rdx + 0x30], xmm3
movups xmm0, xmmword [rbp - 0x2c]
movups xmmword [rdx + 0x34], xmm0
add qword [0x18041fa20], 0x48
jmp 0x1801e02e9
lea r8, [rbp - 0x60]
lea rcx, [0x18041fa18]
call fcn.1801c69f0
mov rsi, qword [rbp - 0x48]
cmp rsi, 0x10
jb 0x1801e0324
lea rdx, [rsi + 1]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801e031f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1801e031f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18026980c
xor r8d, r8d
lea rdx, [0x180298f79]
lea rcx, [0x1803d9008]
call fcn.1800d2220
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180269d00
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1800c1490
int3
add rcx, 8
jmp 0x1801e0160
Function at 0x18020bee0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x48
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18020bf16
cmp byte [0x18041b6d0], 0
jne 0x18020bf16
lea rdx, [0x1803d6a90]
lea rcx, [rsp + 0x20]
call fcn.1800be2c0
mov rcx, rax
call fcn.1802476d0
add rsp, 0x48
ret

Function at 0x18020c460
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1801e033a
cmp byte [0x18041b6d0], 0
jne 0x1801e033a
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov rdi, qword [0x1803d9018]
lea r14, [0x1803d9008]
cmp qword [0x1803d9020], 0x10
cmovae r14, qword [0x1803d9008]
movabs rbx, 0x7fffffffffffffff
cmp rdi, rbx
ja 0x1801e0363
lea esi, [rax + 0xf]
cmp rdi, 0x10
jae 0x1801e020b
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rsi
movups xmm0, xmmword [r14]
movaps xmmword [rbp - 0x60], xmm0
jmp 0x1801e0251
mov rax, rdi
or rax, rsi
cmp rax, rbx
ja 0x1801e0225
mov rbx, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbx, rcx
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x60]
call fcn.1800c14d0
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movaps xmm0, xmmword [rbp - 0x60]
xorps xmm2, xmm2
movaps xmmword [rbp - 0x40], xmm2
xorps xmm3, xmm3
movss dword [rbp - 0x30], xmm3
mov dword [rbp - 0x2c], 0xff
mov dword [rbp - 0x28], 0xff
mov dword [rbp - 0x24], 0xff
mov qword [rbp - 0x20], 0xff
mov rdx, qword [0x18041fa20]
cmp rdx, qword [0x18041fa28]
je 0x1801e02d5
movups xmmword [rdx], xmm0
movaps xmm0, xmmword [rbp - 0x50]
movups xmmword [rdx + 0x10], xmm0
mov byte [rbp - 0x60], 0
movss dword [rdx + 0x20], xmm2
xorps xmm0, xmm0
shufps xmm0, xmm2, 0x55
movss dword [rdx + 0x24], xmm0
xorps xmm1, xmm1
shufps xmm1, xmm2, 0xaa
movss dword [rdx + 0x28], xmm1
movss dword [rdx + 0x2c], xmm2
movss dword [rdx + 0x30], xmm3
movups xmm0, xmmword [rbp - 0x2c]
movups xmmword [rdx + 0x34], xmm0
add qword [0x18041fa20], 0x48
jmp 0x1801e02e9
lea r8, [rbp - 0x60]
lea rcx, [0x18041fa18]
call fcn.1801c69f0
mov rsi, qword [rbp - 0x48]
cmp rsi, 0x10
jb 0x1801e0324
lea rdx, [rsi + 1]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801e031f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1801e031f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18026980c
xor r8d, r8d
lea rdx, [0x180298f79]
lea rcx, [0x1803d9008]
call fcn.1800d2220
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180269d00
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1800c1490
int3
add rcx, 8
jmp 0x1801e0160
Function at 0x18020cc40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r10, qword [rcx + 0x10]
xor r11d, r11d
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [r10 + rax], r11b
jne 0x18020cc60
add rax, r10
cmp r10, rax
je 0x18020cca9
movzx r9d, byte [r10]
movzx ecx, r9b
or cl, 0x20
movzx edx, cl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova edx, r9d
inc r10
movsx ecx, dl
add ecx, r11d
imul r11d, ecx, 0x401
mov ecx, r11d
shr ecx, 6
xor r11d, ecx
cmp r10, rax
jne 0x18020cc71
mov rcx, qword [0x18041b098]
lea edi, [r11 + r11*8]
call fcn.1801309e0
mov rcx, qword [0x1803cd030]
mov ebx, eax
call fcn.18025f340
mov r8, qword [0x1803cd030]
mov eax, edi
shr eax, 0xb
xor eax, edi
mov edx, dword [r8 + 8]
mov rcx, qword [r8 + 0x10]
mov dword [rcx + rdx*8], ebx
inc dword [r8 + 8]
mov r8, qword [0x1803cd030]
imul edx, eax, 0x8001
mov ecx, dword [r8 + 8]
mov rax, qword [r8 + 0x10]
mov dword [rax + rcx*8], edx
movabs rdx, 0x1055ac3a667f09d9
inc dword [r8 + 8]
mov rcx, qword [0x1803cd030]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18025f4a0

Function at 0x18020cf30
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18020cffd
cmp byte [0x18041b6d0], 0
jne 0x18020cffd
mov rbx, qword [0x1803cd038]
mov rdx, qword [0x1803cd028]
add rdx, 0x4b8
lea rcx, [rsp + 0x28]
call fcn.1800be2c0
mov r8, rax
xor edx, edx
mov rcx, rbx
call fcn.180134760
mov rdx, qword [0x1803cd028]
add rdx, 0x4b8
lea rcx, [rsp + 0x48]
call fcn.1800be2c0
nop
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1803cd028]
call fcn.18014a650
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x18020cffd
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18020cff8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18020cff8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18026980c
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180269d00
add rsp, 0x70
pop rbx
ret

Function at 0x18020d1b0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x48
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18020d1e6
cmp byte [0x18041b6d0], 0
jne 0x18020d1e6
lea rdx, [0x1803d90b8]
lea rcx, [rsp + 0x20]
call fcn.1800be2c0
mov rcx, rax
call fcn.1802460d0
add rsp, 0x48
ret
Function at 0x18020da10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
movsxd rax, dword [0x18041fc14]
mov r9, 0xffffffffffffffff
mov rsi, qword [0x18041f688]
add rax, rax
xor ebx, ebx
movaps xmmword [rsp + 0x20], xmm6
movss xmm6, dword [0x18041fc18]
mov edi, ebx
mov r10, r9
mov r11, qword [rsi + rax*8 + 8]
inc r10
cmp byte [r11 + r10], bl
jne 0x1801e4100
add r10, r11
cmp r11, r10
je 0x1801e4143
movzx r8d, byte [r11]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r11
movsx eax, cl
add eax, edi
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
cmp r11, r10
jne 0x1801e4111
lea eax, [rdi + rdi*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
movsxd rax, dword [0x18041fc10]
imul edi, ecx, 0x8001
add rax, rax
mov r10, qword [rsi + rax*8 + 8]
inc r9
cmp byte [r10 + r9], bl
jne 0x1801e4162
add r9, r10
cmp r10, r9
je 0x1801e41a5
movzx r8d, byte [r10]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r10
movsx eax, cl
add eax, ebx
imul ebx, eax, 0x401
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp r10, r9
jne 0x1801e4173
mov rcx, qword [0x1803cd030]
lea ebx, [rbx + rbx*8]
call fcn.18025f340
mov r8, qword [0x1803cd030]
mov eax, ebx
shr eax, 0xb
xor eax, ebx
imul edx, eax, 0x8001
mov ecx, dword [r8 + 8]
mov rax, qword [r8 + 0x10]
mov dword [rax + rcx*8], edx
inc dword [r8 + 8]
mov rdx, qword [0x1803cd030]
mov ecx, dword [rdx + 8]
mov rax, qword [rdx + 0x10]
mov dword [rax + rcx*8], edi
inc dword [rdx + 8]
mov rdx, qword [0x1803cd030]
mov ecx, dword [rdx + 8]
mov rax, qword [rdx + 0x10]
movss dword [rax + rcx*8], xmm6
inc dword [rdx + 8]
movabs rdx, 0x578c752848ecfa0c
mov rcx, qword [0x1803cd030]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rdi
jmp fcn.18025f4a0
add rcx, 8
jmp 0x1801e40c0

Function at 0x18020dba0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18020dbd2
cmp byte [0x18041b6d0], 0
jne 0x18020dbd2
mov rcx, qword [0x1803cd028]
mov edx, 0xf8502fc1
add rsp, 0x28
jmp fcn.180153d40
add rsp, 0x28
ret
Function at 0x18020ee00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x18041b2b8]
mov rsi, rcx
movsxd rdx, dword [rcx + 4]
xor r11d, r11d
mov r10, qword [rax + rdx*8]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [r10 + rax], r11b
jne 0x1800d5be0
add rax, r10
cmp r10, rax
je 0x1800d5c29
movzx r9d, byte [r10]
movzx ecx, r9b
or cl, 0x20
movzx edx, cl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova edx, r9d
inc r10
movsx ecx, dl
add ecx, r11d
imul r11d, ecx, 0x401
mov ecx, r11d
shr ecx, 6
xor r11d, ecx
cmp r10, rax
jne 0x1800d5bf1
mov ebx, dword [rsi]
lea eax, [r11 + r11*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul edi, ecx, 0x8001
mov rcx, qword [0x1803cd030]
call fcn.18025f340
mov rdx, qword [0x1803cd030]
mov ecx, dword [rdx + 8]
mov rax, qword [rdx + 0x10]
mov dword [rax + rcx*8], ebx
inc dword [rdx + 8]
movabs rdx, 0x43a66c31c68491c0
mov rcx, qword [0x1803cd030]
call fcn.18025f4a0
lea rax, vtable.std::_Func_impl_no_alloc_class__public:_void___cdecl_Base::bodyguard_manager::spawn_void____ptr64::_2::_lambda_1___void___.0
mov dword [rsp + 0x2c], edi
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x20]
mov rax, qword [0x1803cd030]
mov r8d, edi
xor edx, edx
mov qword [rsp + 0x30], rsi
mov rcx, qword [rax]
mov eax, dword [rcx]
mov rcx, qword [0x18041b098]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x58], rax
call fcn.180130450
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
lea rcx, [0x1803d9068]
jmp 0x1800d5bb0
Function at 0x18020f180
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
xor r9d, r9d
lea r11, [0x1802a187a]
lea r10, str.am_criminal_damage
nop
movzx r8d, byte [r10]
lea edx, [r8 - 0x41]
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
inc r10
cmp r10, r11
jne 0x1801e63a0
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul r8d, ecx, 0x8001
mov rax, qword [section..data]
mov rcx, qword [rax + 0x320]
mov rdx, qword [rcx]
movzx eax, word [rcx + 8]
lea rcx, [rdx + rax*8]
cmp rdx, rcx
je 0x1801e6430
mov rax, qword [rdx]
test rax, rax
je 0x1801e6427
cmp dword [rax + 8], 0
je 0x1801e6427
cmp qword [rax + 0x118], 0
je 0x1801e6427
cmp dword [rax + 0x128], r8d
je 0x1801e6432
add rdx, 8
cmp rdx, rcx
jne 0x1801e6406
xor eax, eax
test rax, rax
je 0x1801e6531
lea rax, [rbp + 0x17]
mov qword [rbp + 0x6f], rax
lea rax, vtable.std::_Func_impl_no_alloc_class__public:_void___cdecl__public:_void___cdecl__void___cdecl_Base::submenus::network::main_void_::_2::_lambda_6_::operator___void_const___ptr64::_2::_lambda_1_::operator___void_const___ptr64::_5::_lambda_1___void___.0
mov qword [rbp + 0x17], rax
lea rax, [rbp + 0x17]
mov qword [rbp + 0x4f], rax
lea rax, [rbp - 0x29]
mov qword [rbp + 0x77], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], 0
mov qword [rbp - 0x11], 0xf
mov edx, 0x30
lea rcx, [rbp - 0x29]
call fcn.1800c14d0
mov rdx, rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x19], 0x27
mov qword [rbp - 0x11], 0x2f
movups xmm0, xmmword [str.network:scripts:ongoing:criminal_damage]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1802cf7e8]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x1802cf7f8]
mov dword [rax + 0x20], ecx
movzx eax, word [0x1802cf7fc]
mov word [rdx + 0x24], ax
movzx eax, byte [0x1802cf7fe]
mov byte [rdx + 0x26], al
mov byte [rdx + 0x27], 0
mov qword [rbp + 7], 0xf
mov qword [rbp + 0xf], 0xf
movsd xmm0, qword [str.Criminal_Damage]
movsd qword [rbp - 9], xmm0
mov eax, dword [0x1802a1610]
mov dword [rbp - 1], eax
movzx eax, word [0x1802a1614]
mov word [rbp + 3], ax
movzx eax, byte [0x1802a1616]
mov byte [rbp + 5], al
mov byte [rbp + 6], 0
lea r9, [rbp + 0x17]
lea r8, [rbp - 0x29]
lea rdx, [rbp - 9]
lea rcx, [0x18041fc4c]
call fcn.18024b480
add rsp, 0xa0
pop rbp
ret
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], 0xa
mov qword [rbp + 0xf], 0xf
movsd xmm0, qword [str.None_Found]
movsd qword [rbp - 9], xmm0
movzx eax, word [0x1802cf808]
mov word [rbp - 1], ax
mov byte [rbp + 1], 0
lea rdx, [rbp - 9]
lea rcx, [0x18041fc4c]
call fcn.18024c520
add rsp, 0xa0
pop rbp
ret
add rcx, 8
jmp 0x1801e6380