joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801d3c98
Capabilities:
Packed with generic packer

Disassembly:
popfq
call fcn.18028ceca
js 0x1801ab574
add r9, 0xfffffffff222b925
cmp r9b, 0xb0
jg 0x1801de93b
call fcn.1801bc36c
jo 0x180092033
lea rbp, [rbp + 1]
jb 0x18009fc0b
jno 0x180289a60
jae 0x1801d3d2b
invalid
pop rax
dec dword [rax - 0x2256c193]
retf
imul esi, esp, 0xffffffff
loope 0x1801d3cb7
sahf
sar dword [rdx + 0x6d], 1
invalid
pop rax
sub al, 0x7a
sub al, byte [rsi + 0x31]
cld
lodsb al, byte [rsi]
nop
in al, 0xa2
fisubr word [rdx - 0x384f1b4c]
jb 0x1801d3d61
outsb dx, byte [rsi]
sbb dword [rcx + rdx - 0x1d39edbd], edi
test ebp, ebx
bnd jmp 0x1801d3d11
invalid
add qword [rsp], 0xfffffffffff211df
mov rsi, r9
shr sil, 0xab
jns 0x1801bff5a
wait
adc dword [rcx + 0x7240dafa], ecx
invalid

Function at 0x1801d77cb
Capabilities:
Encode data using xor

Disassembly:
jge 0x1801350b1
call fcn.1800a7d9e
push rbp
pushfq
movabs rbp, 0xcbb4e1a6c9895913
and ebp, 0x9f242d14
xchg qword [rsp + 0x18], rax
add bpl, 0x25
push rbp
push r15
mov r15, rbp
jno 0x18009bcd0
js 0x1801d77c6
mov ch, 0xf5
add byte [rsp + rcx*4 - 0xe], dl
fldenv [rbp - 0x5c]
adc al, 0xd0
xchg esi, eax
xor eax, 0x4c7cd04d
loop 0x1801d7800
invalid

Function at 0x1801da8f4
Capabilities:
Parse pe header

Disassembly:
jne 0x18013b8a5
jne 0x18017bef5
je 0x180260705
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x68]
ret
sub r11b, r15b
bswap r11d

Function at 0x1801db545
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, r12
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx]
cmp r11w, 0xa23f

Function at 0x1801f19f0
Capabilities:
Authenticate hmac

Disassembly:
pushfq
add qword [rsp + 8], 0xf4aa
call fcn.18009d504

Function at 0x1801f22c1
Capabilities:
Encode data using xor

Disassembly:
mov r14, qword [rsp + 0x98]
shr dword [rsp + 0x50], 0xad
and word [rsp + 0x50], 0xe25
add dword [rsp + 0x50], r13d
mov r13, qword [rsp + 0x78]
shr byte [rsp + 0x50], 0x67
and byte [rsp + 0x40], 1
mov r8, qword [rsp + 0x40]
mov r8, qword [rsp + r8 - 0x604e5ee0]
call fcn.1801ad0bb
mov word [rbx], ss
or al, 0x94
cmp dword [rsi + 0x3e], edi
push rsi
sti
or al, 0x74
fnstcw word [rsi + 0x3e]
xchg esi, eax
cmp ecx, dword [rsp + rcx*2]
mov ah, 0x19
jbe 0x1801f2349
invalid
loop 0x1801f237e
invalid
test dword [rax], ebp
div dword [rdi + 0x4d0d6ac7]
push rbp
clc
invalid

Function at 0x1801f7c16
Capabilities:
Log keystrokes via polling

Disassembly:
call fcn.180184267
jae 0x1802688af
jae 0x1801ac394
jg 0x180253a09
call fcn.1802383b1
add r13, 0xffffffffb71ba990
lea r13, [r13 + rcx*8 + 0x2d2d7f14]
sub r13d, dword [rsp + 9]
or r13b, 0x2f
mov rcx, qword [rsp + 0x28]
call fcn.1800a65d0

Function at 0x180203a23
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
lea r15, [r15*2 - 0x147704c8]
add qword [rsp], 0x12660c
mov rdx, r15
add r15d, 0x9f9bc70c
mov r10, rdx
jb 0x180167bf9
jne 0x180092060
invalid
Function at 0x180203afb
Capabilities:
Packed with generic packer

Disassembly:
neg dword [rsp + r15 + 0x60]
mov r8, qword [rsp + r15 + 0x70]
not r15
seto byte [rsp + r15*4 + 0x54]
jo 0x18024501e
not word [rsp + r15*2 + 0x62]
call fcn.180207b6d
and r15b, 0x33
jno 0x18014d149
call fcn.18019c1f1
push rax
call fcn.1801d821f
push rsi
mov ah, 0xf5
invalid

Function at 0x180204f7b
Capabilities:
Packed with generic packer
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jns 0x180184633
mov r8, qword [rsp + 0x20]
movabs rax, 0x75b05139a917f493
test r8d, r8d
mov rax, qword [rsp + 8]
mov rax, qword [rax]
jle 0x18019f9f5
jg 0x180165e87
jae 0x1802676fe
ret 0xf894
shr bpl, 0x8a
push rsi
or qword [rsp + 0x20], r15
add qword [rsp + 8], 0x36b65
shl qword [rsp + 0x20], 0x7a
movabs rsi, 0xb2b5dfaf1e9d6634
not r15
jae 0x18011bccf
push rcx
call fcn.18014b2f5
cmp byte [rbx + 0x3f734183], ah
clc
or dl, byte [rdx - 0x36047657]
sbb eax, 0x83c850da
movabs dword [0x91b1d24af83f2b19], eax
pop rbx
imul ecx, dword [rbp - 0x1c2fb7b6], 0x67c3f1c3
xchg esp, eax
rol ah, 1
int1
push rax
mov dl, 0xd9
nop
invalid
movabs r15, 0x551a0dafc10de398
mov rax, rdx
mov rax, qword [rsp + rdx + 0x34aa6340]
mov rax, qword [rax + rdx*2 + 0x6954c620]
test dl, 0x2c
mov qword [rsp + rdx*2 + 0x6954c650], rdx
mov dword [rsp + rdx + 0x34aa6340], edx
lea rax, [rax + 0x10040a6]
movzx r15d, byte [rsp + 0x33]
movabs r15, 0xbd0d94841c397fbf
mov r15, rdx
call fcn.180256d07
shr byte [rcx + 0x79], 0xc7
stc
outsb dx, byte [rsi]
invalid

Function at 0x18020a75e
Capabilities:
Packed with generic packer

Disassembly:
add word [rsp + 0x28], 0x153e
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x48]
ret
lea r12, [rbx + r12*4 + 0xe15f916]
mov rbx, qword [rsp + rsi + 0x10]
mov rbx, qword [rbx + rsi]
add si, 0x8db3
je 0x1801ecdac
mov qword [rsp + r12 - 0xe16c542], rsi
call fcn.18012223f
sub r8d, 0xa196a80a
jl 0x18009ca58
je 0x18009356a
or byte [rsp], 0x86
pushfq
movabs r8, 0xc82ad9b1cd869812
or r8, 0xeab062d
mov rsi, qword [rsp + 0x18]
jbe 0x1800a67ce
shl r8, 0x10
jae 0x180126765
ficomp word [rbx]
lahf
invalid
or dword [rbp - 0x146f56d0], 0xf2aaf4b8
neg dword [rbx + 0x453a3fe6]
sub cl, byte ds:[rcx - 0x3f]
invalid
invalid
invalid
invalid
invalid
invalid
Function at 0x180222aa8
Capabilities:
Log keystrokes via polling

Disassembly:
or word [rsp + 0x30], 0x819
sub qword [rsp + 0x30], 0xffffffff9aa0b23b
add qword [rsp + 0x30], 0x71298031
or dword [rsp + 0x30], 0xda0801ad
call fcn.1800a7255
call fcn.1801778fe
test al, 0x48
mov dword [rsp + 0x18], 0xcd683c46
mov rbx, qword [rsp + 8]
popfq
not r10w
movabs r10, 0x4692ec93251ebc97
movsx r10, r10b
mov r10, qword [rsp + r10 + 0x71]
call fcn.180262938
jge 0x180222aa3
add eax, 0x21993
add byte [rax], al
invalid
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rcx - 0x80], al
cmp r15b, 0xf
mov r15, qword [rsp + 0x38]
jo 0x18016aaa7
and byte [rsp + r9*2 - 0x6e89e790], 0x83
movsb byte [rdi], byte [rsi]
jo 0x180222ad5
jbe 0x180222a50
or dword [rax - 0x7f], 0x44
and al, 0
movsb byte [rdi], byte [rsi]
pminub mm7, qword [rdi + 0x4c]
mov ebx, dword [rsp + 0x78]
add qword [rsp], 0x7fda0fa4
mov r11, qword [rsp + 0x78]
neg r9
jg 0x180145404
bnd jmp qword [rsi + 0x42]
sub word [rsp + r9 + 0x3744f470], 0xfb82
sub r9b, byte [rsp + r9 + 0x3744f477]
xor r9w, r9w
or r9w, 0x15af
mov r9, qword [rsp + r9*2 + 0x6e89d50a]
call fcn.18028a723
jle 0x18009d7ea
jg 0x180222b13
cdq
mov esi, fs
xchg esp, eax
jmp 0x180222a9d
fsubp st(4)
push rbx
push rdx
xor al, 0x62
rol esp, 0x9e
loopne 0x180222ab9
xchg edx, eax
int3

Function at 0x180222b01
Capabilities:
Log keystrokes via polling

Disassembly:
or word [rsp + 0x30], 0x819
sub qword [rsp + 0x30], 0xffffffff9aa0b23b
add qword [rsp + 0x30], 0x71298031
or dword [rsp + 0x30], 0xda0801ad
call fcn.1800a7255
call fcn.1801778fe
test al, 0x48
mov dword [rsp + 0x18], 0xcd683c46
mov rbx, qword [rsp + 8]
popfq
not r10w
movabs r10, 0x4692ec93251ebc97
movsx r10, r10b
mov r10, qword [rsp + r10 + 0x71]
call fcn.180262938
jge 0x180222aa3
add eax, 0x21993
add byte [rax], al
invalid
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rcx - 0x80], al
cmp r15b, 0xf
mov r15, qword [rsp + 0x38]
jo 0x18016aaa7
and byte [rsp + r9*2 - 0x6e89e790], 0x83
movsb byte [rdi], byte [rsi]
jo 0x180222ad5
jbe 0x180222a50
or dword [rax - 0x7f], 0x44
and al, 0
movsb byte [rdi], byte [rsi]
pminub mm7, qword [rdi + 0x4c]
mov ebx, dword [rsp + 0x78]
add qword [rsp], 0x7fda0fa4
mov r11, qword [rsp + 0x78]
neg r9
jg 0x180145404
bnd jmp qword [rsi + 0x42]
sub word [rsp + r9 + 0x3744f470], 0xfb82
sub r9b, byte [rsp + r9 + 0x3744f477]
xor r9w, r9w
or r9w, 0x15af
mov r9, qword [rsp + r9*2 + 0x6e89d50a]
call fcn.18028a723
jle 0x18009d7ea
jg 0x180222b13
cdq
mov esi, fs
xchg esp, eax
jmp 0x180222a9d
fsubp st(4)
push rbx
push rdx
xor al, 0x62
rol esp, 0x9e
loopne 0x180222ab9
xchg edx, eax
int3

Function at 0x18022a023
Capabilities:
Parse pe header

Disassembly:
lea rbp, [rbp - 0x3afea878]
neg r8b
jl 0x180125c2c
cmovo rsi, qword [rsp + 0x40]
or r8, qword [rsp + 0x40]
mov r11, qword [rsp + 0x40]
cmp rdx, r13
jno 0x18017c451
Function at 0x180237f8a
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
call fcn.180187790
lea rsi, [rsi + rdi - 0x5e085825]
js fcn.1801495d3
je 0x18019ad8b
shl qword [rsp + r15 - 0x5e085806], 0x61
and rdi, 0x4389053e
jne 0x1800a03a0

Function at 0x180239fc7
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
cmovge cx, r14w
and ecx, 0xbab230a8
jge 0x1802589d0
lea rax, [rax + rbx - 0x4e00707f]
mov qword [rsp + 0x50], rcx
call fcn.180142c82

Function at 0x18023c91d
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, qword [rsp + r11*2 + 0x38]
js 0x18015e99f
call fcn.1801bd5c3
call fcn.18009d496

Function at 0x18024661e
Capabilities:
Log keystrokes via polling

Disassembly:
and bl, 0xb
setle bl
lea rax, [rax + 0x152da692]
and dil, 0x2d
and dil, bl
not ebx
cmovae bx, di
mov qword [rsp + 0x10], rdi
lea rdi, [rdi*4 - 0xc4fc470]
xchg qword [rsp + 0x28], rax
mov rbx, qword [rsp + 8]
or qword [rsp + 0x10], 0x3007781f
sub dil, byte [rsp + 0x14]
je 0x18015e993
add dil, byte [rsp + 0x14]
xor word [rsp + 0x10], 0x8da3
js 0x180202bdb
mov rdi, qword [rsp + 0x20]
test dword [rsp + 0x10], 0x22be7711
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
ret
call 0x1802058d0
push rbx
pushfq
push rbp
push rsi
movabs rbp, 0xcc18029d671d8d9c
movabs rsi, 0xe339f98dbe229187
call fcn.18009ba46
call fcn.1801f27ed
rcl ecx, 1
cwde
adc eax, esp
frstor dword [rbp - 3]
test ch, bh
sub al, 0x29
rol dword [rcx - 0x6af75638], 0x6d
invalid
movsxd r13, r13d
mov rbp, qword [rsp + r13 + 0x57444e0c]
pushfq
shl r13w, 0xb4
sub r13b, 0x16
jle 0x18015c7a7
jb 0x18025511d
movabs r12, 0x1ca1e91040be243d
cmp qword [rsp + 0x20], 0x65a14e2c
jl fcn.18013885d
not r12w
setl byte [rsp + 0x20]
and esi, dword [rsp + 0x21]
mov r12, qword [rsp + rsi - 0x218d9df7]
shr si, 0xa2
js 0x180093b6c
movsx rsi, sil
jne 0x18011f5f6
jns 0x1801302c0

Function at 0x1802466cd
Capabilities:
Execute syscall

Disassembly:
mov word [rsp + rdi - 0x4e8], 0x9219
mov rdi, qword [rsp + 0x50]
setae byte [rsp + 0x38]
jo 0x18009bbf8
xor qword [rsp + 0x18], rsi
call fcn.180184136
Function at 0x18024a69d
Capabilities:
Encode data using xor

Disassembly:
xchg qword [rsp + 0x90], rax
mov r10, qword [rsp + 0x28]
neg qword [rsp + 0x50]
sub byte [rax - 9], cl
pop rsp
and al, 0x50
and r14, r12
sub r12b, r13b
movabs r11, 0x81af7494629ac217
shr word [rsp + 0x38], 0xc2
and qword [rsp + 0x38], 0xffffffffb422f80d
test byte [rsp + r14 - 0x42], 0x18
mov r13, qword [rsp + 0x10]
js 0x1801e16f2
cmp r12d, 0xbe004732
jns 0x18015a787
jae 0x18025477f
sbb dword [rax - 0x37], ebp
sub al, 0x84
add al, 0x4d
xor al, 0xe5
fsub dword [rax - 0x10]
cdq
mov al, 1
pop rsp
movsb byte [rdi], byte [rsi]
sub eax, 0x68900dec
shr cl, 1
js 0x18024a6a9
or al, 0xe4
add al, 0x4d
insb byte [rdi], dx
int 0x40
cwde
cmp dword [rax + 0x371942ec], ebx
lodsd eax, dword [rsi]
adc al, 0x44
in al, dx
mov ah, dh
mov dl, byte [r15]
or dh, al
mov al, 0xe
xchg esi, eax
movsb byte [rdi], byte [rsi]
jno 0x18024a769
invalid
jrcxz 0x18024a777
retf 0xd535
cld
xchg edi, eax
jg 0x18024a75d
mov al, 0xe
cwde
in eax, dx
movsd dword [rdi], dword [rsi]
xchg ecx, eax
mov ch, 0x40
out dx, eax
sbb byte [rsi], ah
and r12b, byte [r11]
push 0x7e649c82
invalid

Function at 0x180258426
Capabilities:
Authenticate hmac

Disassembly:
push r14
wait
sub byte [rbx*4 - 0x5e5e6e0f], 0x5c
sub al, 0x32
ror dword [rdi + rcx*8], cl
sti
invalid
call qword [rsi]
loope 0x1802583a7
fisub dword [rcx]
or eax, edx
fcomp dword [rdi - 0xe]
fiadd dword [rax + 0x972ef08]
out 0x36, al
xchg byte [rsi - 0x916af0], bl
jne 0x18025845c
push qword [rbp + 0x67]
sbb bl, ch
and al, 0xc0
wait
jle 0x1802583da
cdq
push rdi
std
mov ch, 0xa4
imul ebx, eax, 0xaef4e09b
cli
mov ebx, 0xddbeef7a
xor bh, byte [rsp + rdx + 0x35]
adc eax, 0x5b5c31a8
sub al, 0x1a
pop rdx
sbb ebx, dword [rbx]
pop rsi
pop qword [rsi]
sub eax, 0x5553524e
push rbx
push rbp
push rbx
push rbp
movabs rbp, 0x8383610ba0a9b7a9
not ebp
pushfq
sub bpl, 0x9c
ja fcn.1802306cc
xchg dword [rbp + 0xffffd82], ecx
test dword [rdi - 0x2f000509], edx
wait
mov ebx, 0xd81fc3f1
push 0xfffffffffffffff2
jne 0x180207bdc
rcr byte [rbx + 0x1fc3f1bb], 1
fsubr dword [rdx - 0xe]
xchg ecx, eax
mov cl, 0x9b
test eax, 0x70e832f5
pop rbx
jnp 0x18025847a
adc esi, dword [rdi - 0x1e6df590]
ror dword [rbx], 0x39
or dl, byte [rdx + 0x390bc1e1]
test dword [rdx - 0x48], eax
and bl, cl
jmp 0x1802583f2
jae 0x18025843a
push rax
sbb eax, 0xade51941
and dl, byte [rsp + rcx*2]
ja 0x1802584cc
push rsp
ror ebp, cl
invalid
push rsp
invalid

Function at 0x180258904
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
and dword [rsp + r12*2 - 0x764e011a], 0xe4151108
call fcn.1801f1abb
or dword [rdi + rdi], ebx
int3
add qword [rsp + 0x38], 0xffffffffffffdc8f
push r8
movabs r8, 0x2b8e57ae49867337
movzx r12w, r12b
neg r8d
mov rdx, qword [rsp + 0x40]
mov rdx, qword [rdx]
or r8d, dword [rsp + rcx*2 - 0x4a541fe]
cmp cl, 0
mov qword [rsp + 0x40], rcx
jno 0x180092180
Function at 0x180260627
Capabilities:
Log keystrokes via polling

Disassembly:
setbe r8b
shl r8b, 0x61
add qword [rsp], 0x57cf
xor r8, 0xffffffff8218efae
and r8, r8
movabs rdi, 0xb7ba0b253d0544aa
and edi, r8d
push rbp
add r8b, 7
jns 0x18016223a
mov rdi, qword [rsp + 8]
mov rdi, qword [rdi]
or r8w, 0x3309
movabs rbp, 0xb5902c16ea80b812
shr r8d, 0x29
add r8, 0x6c093615
sub r8, 0x3a958890
sub r8, r8
test r8, 0x190945bd
lea rdi, [rdi + r8 + 0x53a8f288]
lea rbp, [r8*2 - 0x697bb7d2]
call fcn.180262dc8

Function at 0x1802606a3
Capabilities:
Log keystrokes via polling

Disassembly:
jbe 0x1802688cb
bswap r9
jns 0x1800accae

Function at 0x180260742
Capabilities:
Parse pe header

Disassembly:
je 0x18021f98f
mov r15, qword [rsp + 0x38]
shl qword [rsp + r8*2 + 0x30], 0xac
xor r10d, dword [rsp + r8 + 0x28]
jge fcn.1800ad387
mov r10, qword [rsp + r8 + 0x40]
not r8b
mov r13, r11
or r13b, 0xac
add r8w, r13w
shr word [rsp + 0x30], 0x17
mov r8, qword [rsp + 0x50]
test r11b, r11b
setae r13b
call fcn.1801a8b50

Function at 0x180260791
Capabilities:
Parse pe header

Disassembly:
push r8
movabs r8, 0xd7b3350086227b3f
mov qword [rsp + 0x40], rbx
mov r15, qword [rsp + 0x28]
sub word [rsp + 0x28], 0x8e25
push rdx

Function at 0x1802653b5
Capabilities:
Log keystrokes via polling

Disassembly:
ja 0x180206d29
jbe 0x18026d66e

Function at 0x180268978
Capabilities:
Log keystrokes via polling

Disassembly:
call 0x18018402b
movsx r11w, r14b
lea rdx, [rdx + rsi*4 + 0x6f93a38e]
jge 0x18017b167

Function at 0x18026899b
Capabilities:
Log keystrokes via polling

Disassembly:
xor r11w, 0xc8a2
xchg qword [rsp + r11 + 0x339e], rsi
mov r15, qword [rsp + r11*2 + 0x66e4]

Function at 0x18026d159
Capabilities:
Parse pe header

Disassembly:
xor bx, si
add qword [rsp], 0x7ff52773
push r14
test qword [rsp + 0x10], r14
xchg qword [rsp + 0x58], rax
mov rsi, qword [rsp + 0x50]
lea r13, [rbx + r14*2 - 0x686684d8]
lea rbx, [rbx + rbx*8 - 0xdcb65eb]
je fcn.18020c73b
mov bl, r13b
add dword [rsp + 0x10], 0x1a1d0e15
jae 0x180271c42
shl r13, 0xa
mov rbx, qword [rsp + 0x20]
shl r13d, 0xf
or dword [rsp + r13 - 0x6fffffb8], 0x27a47e3a
setle r13b

Function at 0x18026d582
Capabilities:
Log keystrokes via polling

Disassembly:
movabs rbp, 0x54a8dbaef29f20a8
cmp bp, 0x6d1c
mov rdx, qword [rsp + 0x30]
mov rdx, qword [rdx]
movzx ebp, bp
call fcn.1802117ca

Function at 0x18026d5a1
Capabilities:
Log keystrokes via polling

Disassembly:
lea rbx, [r14*4 - 0x647933c5]
js fcn.1802363bc
movsx r14, bx
xchg qword [rsp + r14 + 0x765], rcx
mov r14, qword [rsp + 0x28]
add byte [rsp + 0x10], bh
call fcn.1801c9a5f
Function at 0x18026d5ce
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x48], rax
movabs r11, 0xad2ffb2c9d91fb2b
call int.18027a864
push rsi
sahf
sbb esi, ebx
wait
movabs byte [0x2ecf0e6777df2afb], al
sbb esi, dword [rbx - 0x2dcc4d75]
cmpsd dword [rsi], dword [rdi]
jg 0x13c11299c
push rbx
mov edx, 0x876f6acb
invalid
shr r12w, 0xe4
add edx, edx
shr dl, 0x29
jns 0x1801319a6
sub al, 0x5a
imul edx, ebp, 0xca78b014
movsd dword [rdi], dword [rsi]
std
add byte [rax - 0x62c6e18c], dh
xor al, 0x9c
mov al, 0x12
or eax, 0xf42c78ad
scasb al, byte [rdi]
fld dword [rcx - 4]
test byte [rax], bl
jp 0x1801e4bec
invalid
stc
xor dword [rbx], esi
sbb bh, ah
test eax, 0x956505ad
cdqe
and eax, 0x99f20e8c
push rbp
movabs dword [0x907ed77102eaf403], eax
invalid
mov rax, qword [rsp + 0x28]
push r12
movabs r12, 0xe320ce2360ad3bbd
neg r12
and r12w, r12w
push rdx
mov rdx, r12
cmp edx, 0xe0a74c3a
movsx dx, r12b
lea rax, [rax + 1]
push r15
push r11
jle 0x1801e4b96

Function at 0x180270cdc
Capabilities:
Encode data using xor

Disassembly:
push r10
call fcn.1800a655e
push rdx
invalid
setl byte [rsp + r8*2 + 0x18]
lea rcx, [rcx + r8 - 0x47cf08d8]
jae 0x18020d4ff
loopne 0x180270d1e
invalid
xor bh, byte [rdx + 0x232ad176]
ror dword [rcx - 0x27bfb066], 0x9b
push 0x62
enter 0xffffffffffff95f5, 0x4e
or byte [rdx], ah
movabs al, byte [0x5bf9873680e63ada]
fdiv st(2), st(0)
adc dword [rdi - 0x699a1c78], edi
lodsd eax, dword [rsi]
wait
sbb dword [rax + 0x27], ebp
invalid

Function at 0x1802713c8
Capabilities:
Authenticate hmac

Disassembly:
shl qword [rsp + 0x20], 0xe3
lea r12, [r14*4 - 0x28da6646]
sets r12b
mov r14, qword [rsp + 0x28]
jb fcn.18027be79
shr dword [rsp + 0x20], 0xb7
add qword [rsp + 8], 0x7fda8ef5
shl word [rsp + 0x20], 0x34
xor qword [rsp + 0x20], 0xffffffff8cbdc325

Function at 0x180271848
Capabilities:
Encode data using xor

Disassembly:
js 0x180271867
test dword [rbp - 0x16], eax
add esi, dword [rdx - 0x48]
invalid
mov rcx, qword [rsp + 0x10]
call fcn.18022330d
push rbx
sti
jnp 0x180271889
adc ch, byte [rdi]
xchg edi, eax
scasd eax, dword [rdi]
xchg esi, eax
mov bh, 0x16
jnp 0x180271804
xchg ebx, eax
mov edx, 0xaf570aeb
invalid
adc ebx, dword [rdx + 0x2b]
mov ah, byte [rdi - 0x68d9f081]
push rbx
invalid
xor bh, byte [rcx + 0x3aefb424]
xor ah, byte [rsp + rsi*8 + 1]
adc rax, 0x7377ed94
and eax, 0xf17cfb30
outsd dx, dword [rsi]
mov ecx, dword [rdx]
jbe 0x18027186d
in eax, 0xcd
leave
xchg ebp, eax
int1
xchg ebx, eax
and eax, dword [rdi - 0x6d]
int1
out dx, eax
mov ebp, 0x47767adf
outsd dx, dword [rsi]
mov eax, dword [rsi]
invalid

Function at 0x180271c10
Capabilities:
Parse pe header

Disassembly:
shr rdx, 0xe8
mov qword [rsp + 0x10], rsi
and rdx, 0x20955a0c
shl dl, 0x3e
test edx, edx
call fcn.18028aac5
cmp qword [rsp + r11 + 2], r11
mov r8, qword [rsp + r8*8 + 0x50]
call fcn.1801b337d
stc
xchg ebx, eax
invalid
neg dx
jno 0x18009b04f
lodsb al, byte [rsi]
in al, dx
mov al, 0x21
invalid
push rdi
push r15
pushfq
movabs r15, 0xe5a9811e5a9d3789
sub r15b, r15b
mov r15b, 0x2e
call fcn.1801cf5e0
jbe 0x18026f6f0
mov r13d, r8d
not dword [rsp + r8*4 + 0x12c]
mov r13, qword [rsp + r11*2 - 0x64]
shl r8, 0x3e
shr r8b, 1
jge 0x1801ecd6c
Function at 0x180271c4f
Capabilities:
Parse pe header

Disassembly:
setno byte [rsp + 0x20]
mov r12, qword [rsp + 0x20]
push r9
lea rax, [rax + r12 + 0x484b1e00]
add qword [rsp + r12 + 0x484b1e0f], 0x39c15
shl qword [rsp + r12 + 0x484b1e27], 0x3f
call fcn.18017648f
push r12
ja 0x1800a7187
jmp 0x180271cc8
invalid

Function at 0x180288761
Capabilities:
Encode data using base64
Log keystrokes via polling

Disassembly:
mov rax, qword [rbp + 8]
cmp qword [rax], 0
je 0x18003725a
jmp 0x1800372c5
lea rax, str.ITERATOR_LIST_CORRUPTED_
mov qword [rsp + 0x28], rax
lea rax, [0x18003e82c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x549
lea rdx, [0x18003e830]
mov ecx, 2
call qword [sym.imp.ucrtbased.dll__CrtDbgReport]
cmp eax, 1
jne 0x180037295
int3
mov qword [rsp + 0x20], 0
mov r9d, 0x549
lea r8, str.C:Program_FilesMicrosoft_Visual_Studio2022ProfessionalVCToolsMSVC14.37.32822includexmemory
lea rdx, [0x18003e96c]
lea rcx, str._ITERATOR_LIST_CORRUPTED__
call qword [sym.imp.ucrtbased.dll__invalid_parameter]
xor eax, eax
test eax, eax
jne 0x18003725a
xor eax, eax
test eax, eax
jne 0x18003724e
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x100]
mov rcx, qword [rcx + 8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x100]
mov qword [rax], 0
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
movabs r12, 0xf40ea79a5c036091
mov r10, qword [rsp + 0x60]
jae 0x180037287
mov r8, qword [rsp + 0x68]
cmovne r8d, dword [rsp + 0x6c]
mov r8, qword [rsp + 0x68]
mov r12, qword [rsp + 0x18]
call fcn.180092a41
xchg qword [rsp + 0x70], rsi
mov rcx, qword [rsp + 0x48]
jbe 0x180217a9c
or dword [rsp + 0x68], 0xf2a1958d
cmp r10, qword [rsp + 0x68]
jne 0x180267125
jbe 0x180288793
mov qword [rsp + 8], 0x7103dc48
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1802bddca
xor esi, dword [rax]
mov esp, 0x36e33f5
and eax, 0xdd148d4e
lea r10, [r11*8 - 0x64f7fbc5]
movzx r11, r11w
mov dword [rsp + rsi + 0x42dbf18f], 0x4d2c9228
lea rsi, [r10 + rsi*4 + 0x72407b2]
Function at 0x1802887aa
Capabilities:
Encode data using base64
Log keystrokes via polling
Packed with generic packer

Disassembly:
mov rax, qword [rbp + 8]
cmp qword [rax], 0
je 0x18003725a
jmp 0x1800372c5
lea rax, str.ITERATOR_LIST_CORRUPTED_
mov qword [rsp + 0x28], rax
lea rax, [0x18003e82c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x549
lea rdx, [0x18003e830]
mov ecx, 2
call qword [sym.imp.ucrtbased.dll__CrtDbgReport]
cmp eax, 1
jne 0x180037295
int3
mov qword [rsp + 0x20], 0
mov r9d, 0x549
lea r8, str.C:Program_FilesMicrosoft_Visual_Studio2022ProfessionalVCToolsMSVC14.37.32822includexmemory
lea rdx, [0x18003e96c]
lea rcx, str._ITERATOR_LIST_CORRUPTED__
call qword [sym.imp.ucrtbased.dll__invalid_parameter]
xor eax, eax
test eax, eax
jne 0x18003725a
xor eax, eax
test eax, eax
jne 0x18003724e
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x100]
mov rcx, qword [rcx + 8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x100]
mov qword [rax], 0
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
movabs r12, 0xf40ea79a5c036091
mov r10, qword [rsp + 0x60]
jae 0x180037287
mov r8, qword [rsp + 0x68]
cmovne r8d, dword [rsp + 0x6c]
mov r8, qword [rsp + 0x68]
mov r12, qword [rsp + 0x18]
call fcn.180092a41
xchg qword [rsp + 0x70], rsi
mov rcx, qword [rsp + 0x48]
jbe 0x180217a9c
or dword [rsp + 0x68], 0xf2a1958d
cmp r10, qword [rsp + 0x68]
jne 0x180267125
jbe 0x180288793
mov qword [rsp + 8], 0x7103dc48
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1802bddca
xor esi, dword [rax]
mov esp, 0x36e33f5
and eax, 0xdd148d4e
lea r10, [r11*8 - 0x64f7fbc5]
movzx r11, r11w
mov dword [rsp + rsi + 0x42dbf18f], 0x4d2c9228
lea rsi, [r10 + rsi*4 + 0x72407b2]
Function at 0x18028aed2
Capabilities:
Log keystrokes via polling

Disassembly:
push r11
mov r11, rsi
mov rsi, qword [rsp + 0x28]
mov rsi, qword [rsi]
mov qword [rsp + 0x28], r11
js fcn.18026d5ce
shl qword [rsp + 0x28], 0x41
ja 0x18015203b
setns byte [rsp + 0x28]
or r11, rbp
lea rsi, [rsi + 0x1bfb4a7]
push rdx
mov bp, r11w
cmovbe r11w, word [rsp + 0x35]
mov rdx, rbp
movsx ebp, word [rsp + 0x30]
push rdx
neg qword [rsp + 0x38]
sub rdx, 0xffffffffbf88b6b2
xchg qword [rsp + 0x48], rsi
mov rdx, qword [rsp + 8]
cmp r11w, word [rsp + 0x38]
call fcn.18017b9fc
Function at 0x180689268
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x18068927e
mov qword [rsp + 0x10], rdi
movzx r11, di
clc
sub edi, edi
not bx
cmovl bx, r11w
movzx ebx, r8b
xchg r9b, r9b
movzx r11w, spl
mov r11, rcx
mov r8, rdi
movsxd r10, r13d
nop
movzx r9d, byte [r11]
movzx r10d, byte [rdx]
jmp 0x1806892b5
inc r11
jmp 0x1806892bd
inc rdx
test bl, bl
jmp 0x1806892c7
je 0x1806892f3
mov ecx, r8d
clc
bt ax, 0xb8
cdqe
mov eax, 0x9d0d1e9f
rol eax, cl
cmp r15b, sil
add al, r8b
xor r9b, al
inc r8
cmp edi, 0xa11b98b7
cmc
stc
test r9b, r9b
jmp 0x1806892fb
je 0x18068930f
cmp r9b, r10b
jmp 0x180689309
je 0x1806892a8
cmp r9b, r10b
jae 0x18068932f
or eax, 0xffffffff
movzx ebx, r10w
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
jmp 0x18068932e
ret
mov rbx, qword [rsp + 8]
lahf
movzx rax, dx
seta dil
cdqe
bswap ax
sets ah
mov eax, edi
mov rdi, qword [rsp + 0x10]
ret