joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800070a4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rdi, rdx
movaps xmmword [rax - 0x28], xmm6
movabs rax, qword [0x142378188]
lea rdx, [rbp - 9]
mov rcx, rdi
mov rbx, r9
mov r14, r8
mov rsi, qword [rax + 0x48]
call fcn.1800018ec
mov r8, rbx
lea rdx, [rbp - 0x29]
mov rcx, rdi
call fcn.1800018ec
movsd xmm0, qword [rbp - 9]
lea r8, [rbp + 7]
mov r15d, dword [rbp - 1]
lea rdx, [rbp - 0x19]
mov rcx, rsi
movsd qword [rbp - 0x19], xmm0
mov dword [rbp - 0x11], r15d
call fcn.180001f34
test al, al
je 0x1800072bd
movsd xmm0, qword [rbp - 0x29]
lea r8, [rbp + 0x17]
mov eax, dword [rbp - 0x21]
lea rdx, [rbp - 0x19]
mov rcx, rsi
movsd qword [rbp - 0x19], xmm0
mov dword [rbp - 0x11], eax
call fcn.180001f34
test al, al
je 0x1800072bd
call fcn.180023fa4
movss xmm0, dword [0x1800bf258]
lea rcx, [rbp + 0x27]
movss xmm1, dword [0x1800bf25c]
mov rbx, rax
movss dword [rbp + 0x27], xmm0
movss xmm0, dword [0x1800bf260]
movss dword [rbp + 0x2f], xmm0
movss dword [rbp + 0x2b], xmm1
mov dword [rbp + 0x33], 0x3f800000
call fcn.18002201c
movss xmm0, dword [rbp + 0x17]
lea r8, [rbp - 0x29]
movss xmm1, dword [rbp + 0x1b]
lea rdx, [rbp - 0x19]
movss xmm6, dword [0x18009d9b4]
mov r9d, eax
movss dword [rbp - 0x29], xmm0
mov rcx, rbx
movss xmm0, dword [rbp + 7]
movss dword [rbp - 0x25], xmm1
movss xmm1, dword [rbp + 0xb]
movss dword [rbp - 0x19], xmm0
movss dword [rbp - 0x15], xmm1
movss dword [rsp + 0x20], xmm6
call fcn.180033470
xor eax, eax
mov dword [rbp - 0x19], 0xecabb39b
mov byte [rbp - 0xf], al
xor edx, edx
mov dword [rbp - 0x15], 0x8597feec
mov word [rbp - 0x11], 0x8680
movsxd rcx, edx
lea eax, [rdx - 0x27]
inc edx
xor byte [rbp + rcx - 0x19], al
cmp edx, 0xa
jb 0x1800071ee
lea rdx, [rbp - 0x19]
mov byte [rbp - 0xf], 0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1800072bd
movdqa xmm0, xmmword [0x18009da80]
lea rcx, [rbp + 0x27]
movups xmmword [rbp + 0x27], xmm0
call fcn.180024174
mov ebx, eax
call fcn.180023fa4
movsd xmm0, qword [rsi + 0x17c0]
mov rdi, rax
movss xmm2, dword [rsi + 0x17c8]
movsd qword [rbp - 0x29], xmm0
movss xmm3, dword [rbp - 0x29]
movss xmm0, dword [rbp - 0x25]
subss xmm0, dword [rbp - 5]
subss xmm3, dword [rbp - 9]
movd xmm1, r15d
subss xmm2, xmm1
mulss xmm0, xmm0
mulss xmm3, xmm3
mulss xmm2, xmm2
addss xmm0, xmm3
addss xmm0, xmm2
call fcn.1800725ac
movss xmm2, dword [0x18009d9d0]
lea rdx, [rbp - 0x19]
movss xmm1, dword [rbp + 0xb]
mov r9d, ebx
divss xmm2, xmm0
mov rcx, rdi
mov dword [rsp + 0x20], 0x3c
movss xmm0, dword [rbp + 7]
subss xmm1, xmm6
movss dword [rbp - 0x19], xmm0
movss dword [rbp - 0x15], xmm1
call fcn.1800324ac
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18000a834
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov rbx, r8
cmp byte [0x1800fb23b], sil
mov rdi, r9
mov r8, rdx
je 0x18000a928
mov rax, qword [rdx]
mov rcx, r8
xor edx, edx
mov r10, qword [rax + 0x1d8]
call r10
test rax, rax
je 0x18000a928
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x18000a928
xor eax, eax
mov word [rsp + 0x20], 0xaea9
mov byte [rsp + 0x22], al
mov r8d, esi
movsxd rdx, r8d
lea eax, [r8 - 0x27]
inc r8d
xor byte [rsp + rdx + 0x20], al
cmp r8d, 2
jb 0x18000a893
mov rax, qword [rcx]
mov byte [rsp + 0x22], sil
mov rdx, qword [rax + 0x60]
call rdx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.18006c920
test rax, rax
je 0x18000a928
cmp byte [0x1800fb23c], sil
jne 0x18000a928
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000a928
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
cmp eax, 0x31
ja 0x18000a8fe
movabs rcx, 0x300000001f068
bt rcx, rax
jb 0x18000a928
cmp byte [0x1800fb200], sil
jne 0x18000a928
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp qword [0x1800fb0b0], rax
jne 0x18000a928
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x58]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x60]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18000a938
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp byte [0x1800fb23e], 0
mov r14, r9
mov rbx, r8
mov rdi, rdx
jne 0x18000a972
cmp byte [0x1800fb23a], 0
je 0x18000ab6a
mov rax, qword [rdx]
mov rcx, rdi
xor edx, edx
mov r9, qword [rax + 0x1d8]
call r9
test rax, rax
je 0x18000ab6a
mov rsi, qword [rax + 0x10]
test rsi, rsi
je 0x18000ab6a
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x198]
call rdx
test rax, rax
je 0x18000ab6a
mov edx, dword [rax + 0x170]
test edx, edx
je 0x18000ab6a
mov rax, qword [rbx]
mov rcx, rbx
mov r8, qword [rax + 0x78]
call r8
mov rbx, rax
test rax, rax
je 0x18000ab6a
cmp rax, rdi
je 0x18000ab6a
mov eax, dword [rax + 0x3e0]
cmp dword [rdi + 0x3e0], eax
jne 0x18000a9f9
test eax, eax
jne 0x18000ab6a
mov rax, qword [rbx]
mov rcx, rbx
mov rdx, qword [rax + 0xe0]
call rdx
cmp eax, 1
jl 0x18000ab6a
cmp byte [0x1800fb23e], 0
je 0x18000aad2
xor eax, eax
mov word [rbp - 0x30], 0xb4b2
mov byte [rbp - 0x2e], al
xor r8d, r8d
movsxd rdx, r8d
lea eax, [r8 - 0x27]
inc r8d
xor byte [rbp + rdx - 0x30], al
cmp r8d, 2
jb 0x18000aa2c
mov rax, qword [rsi]
mov rcx, rsi
mov byte [rbp - 0x2e], 0
mov rdx, qword [rax + 0x60]
call rdx
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.18006c920
test rax, rax
jne 0x18000aad2
cmp byte [0x1800fb23f], al
je 0x18000aa89
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x28]
cmp eax, 0x16
ja 0x18000ab6a
mov ecx, 0x61c004
bt ecx, eax
jae 0x18000ab6a
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x1800fb0e8]
movsxd rdx, dword [0x1800fb240]
cmp rax, rdx
ja 0x18000aaaa
test edx, edx
jne 0x18000ab6a
mov rbx, qword [rbp + 0x30]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + 0x58]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x1800fb0e8], rax
jmp 0x18000ab6a
cmp byte [0x1800fb23a], 0
je 0x18000ab6a
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx]
mov rdx, qword [rax + 0xe0]
call rdx
mov rcx, qword [rdi + 0x10]
movsd xmm0, qword [rax]
mov ebx, dword [rax + 8]
mov rax, qword [rcx]
movsd qword [rbp - 0x10], xmm0
mov rdx, qword [rax + 0xe0]
call rdx
movd xmm1, ebx
movsd xmm0, qword [rax]
movss xmm2, dword [rax + 8]
movsd qword [rbp - 0x20], xmm0
subss xmm2, xmm1
movss xmm3, dword [rbp - 0x20]
movss xmm0, dword [rbp - 0x1c]
subss xmm0, dword [rbp - 0xc]
subss xmm3, dword [rbp - 0x10]
mulss xmm2, xmm2
mulss xmm0, xmm0
mulss xmm3, xmm3
addss xmm0, xmm3
addss xmm0, xmm2
call fcn.1800725ac
movss xmm1, dword [0x18009db00]
comiss xmm1, xmm0
jb 0x18000ab6a
mov rcx, qword [rbp + 0x30]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x148]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x18000ac60
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor ebp, ebp
mov rdi, r9
cmp byte [0x1800fb239], bpl
mov r14, r8
mov r9, rdx
je 0x18000adcd
mov rax, qword [rdx]
mov rcx, r9
xor edx, edx
mov r10, qword [rax + 0x1d8]
call r10
test rax, rax
je 0x18000adcd
mov rsi, qword [rax + 0x10]
test rsi, rsi
je 0x18000adcd
mov rbx, qword [rsp + 0x60]
lea edx, [rbp + 0xd]
mov rcx, rbx
xorps xmm2, xmm2
call fcn.18000b264
lea edx, [rbp + 0xe]
xorps xmm2, xmm2
mov rcx, rbx
call fcn.18000b264
lea edx, [rbp + 0x3a]
xorps xmm2, xmm2
mov rcx, rbx
call fcn.18000b264
lea edx, [rbp + 0x3b]
xorps xmm2, xmm2
mov rcx, rbx
call fcn.18000b264
lea edx, [rbp + 0x3f]
xorps xmm2, xmm2
mov rcx, rbx
call fcn.18000b264
lea edx, [rbp + 0x55]
xorps xmm2, xmm2
mov rcx, rbx
call fcn.18000b264
lea edx, [rbp + 0x57]
xorps xmm2, xmm2
mov rcx, rbx
call fcn.18000b264
lea edx, [rbp + 0x56]
xorps xmm2, xmm2
mov rcx, rbx
call fcn.18000b264
xor eax, eax
mov word [rsp + 0x20], 0xb4b2
mov byte [rsp + 0x22], al
mov r8d, ebp
movsxd rdx, r8d
lea eax, [r8 - 0x27]
inc r8d
xor byte [rsp + rdx + 0x20], al
cmp r8d, 2
jb 0x18000ad3e
mov rax, qword [rsi]
mov rcx, rsi
mov byte [rsp + 0x22], bpl
mov rdx, qword [rax + 0x60]
call rdx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.18006c920
test rax, rax
je 0x18000adcd
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000adcd
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x28]
cmp eax, 0x31
ja 0x18000ada3
movabs rcx, 0x300000001f068
bt rcx, rax
jb 0x18000adcd
cmp byte [0x1800fb200], bpl
jne 0x18000adcd
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp qword [0x1800fb0b0], rax
jne 0x18000adcd
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x58]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x18000b004
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x1800fb23c], 0
mov rdi, r9
mov rbx, r8
je 0x18000b08c
movss xmm2, dword [0x18009db04]
mov edx, 0x52
mov rcx, qword [rsp + 0x50]
call fcn.18000b264
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000b08c
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
cmp eax, 0x31
ja 0x18000b062
movabs rcx, 0x300000001f068
bt rcx, rax
jb 0x18000b08c
cmp byte [0x1800fb200], 0
jne 0x18000b08c
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp qword [0x1800fb0b0], rax
jne 0x18000b08c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x58]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x60]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18001c994
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x18001c9c2
xor eax, eax
jmp 0x18001caa8
cmp qword [rcx + 0x68], 0
je 0x18001c9d3
call fcn.18001cac4
jmp 0x18001caa8
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18001c9ea
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18001c9ec
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18001ca1e
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.18006ccb0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x18001caa2
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x18001ca55
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x18001ca7e
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.180077e54
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x18001caa2
cmp rsi, rbx
ja 0x18001ca5c
test rsi, rsi
je 0x18001caa2
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.180077e54
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1800256a4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
not r8d
test rdx, rdx
je 0x1800256d2
movzx eax, byte [r9]
inc r9
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x18009e720]
xor r8d, dword [rax + rcx*4]
sub rdx, 1
jne 0x1800256af
not r8d
mov eax, r8d
ret

Function at 0x1800256dc
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x180025736
mov r11b, 0x23
lea rdi, [0x18009e720]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x180025720
cmp rdx, 2
jb 0x180025720
cmp byte [r10], r11b
jne 0x180025720
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x1800256fe
jmp 0x180025777
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x180025777
mov r11b, 0x23
lea rdi, [0x18009e720]
cmp dl, r11b
jne 0x18002575b
cmp byte [r10], r11b
jne 0x18002575b
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x180025749
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x18003d180
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
mov r10, rdx
movzx r9d, cx
mov eax, 0x5e6ea9af
shr ecx, 0x10
mul r8d
mov r11d, r8d
mov ebx, r8d
shr edx, 0xb
imul eax, edx, 0x15b0
sub r11d, eax
test r8d, r8d
je 0x18003d279
xor edx, edx
cmp r11d, 7
jbe 0x18003d225
lea r8d, [rdx + 7]
movzx eax, byte [r10]
add edx, 8
add r9d, eax
add r8d, 8
movzx eax, byte [r10 + 1]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 7]
add ecx, r9d
add r9d, eax
add r10, 8
add ecx, r9d
cmp r8d, r11d
jb 0x18003d1be
cmp edx, r11d
jae 0x18003d244
mov eax, r11d
sub eax, edx
mov edx, eax
movzx eax, byte [r10]
inc r10
add r9d, eax
add ecx, r9d
sub rdx, 1
jne 0x18003d231
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
sub ebx, r11d
mov r11d, 0x15b0
jne 0x18003d1b2
mov rbx, qword [rsp + 8]
shl ecx, 0x10
lea eax, [r9 + rcx]
ret
Function at 0x18004565c
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
Function at 0x18005a8a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x1800fb24f], 0
mov rbx, r8
je 0x18005a950
mov rax, qword [rdx]
mov rcx, rdx
mov r9, qword [rax + 0x18]
call r9
mov r9, rax
test rax, rax
je 0x18005a950
movdqa xmm0, xmmword [0x1800a6fd0]
xor r8d, r8d
movdqu xmmword [rsp + 0x30], xmm0
movsxd rdx, r8d
lea ecx, [r8 - 0x27]
inc r8d
xor byte [rsp + rdx + 0x30], cl
cmp r8d, 0xf
jb 0x18005a8e0
mov rax, qword [rax]
mov rcx, r9
mov byte [rsp + 0x3f], 0
mov rdx, qword [rax + 0x10]
call rdx
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.18006c920
test rax, rax
je 0x18005a950
or dword [rbx + 0x24], 0x80018
mov rcx, rbx
movss xmm0, dword [0x1800bf2a4]
mov rax, qword [rbx]
movss xmm3, dword [0x1800bf2a0]
movss xmm2, dword [0x1800bf29c]
movss xmm1, dword [0x1800bf298]
movss dword [rsp + 0x20], xmm0
call qword [rax + 0x160]
add rsp, 0x40
pop rbx
ret
Function at 0x1800664d8
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x1800fb278]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
test al, 1
je 0x18006650b
cmp byte [0x1800fb273], cl
sete al
mov byte [0x1800fb273], al
jmp 0x180066511
mov al, byte [0x1800fb273]
test al, al
je 0x180066536
cmp byte [0x1800fb272], cl
je 0x180066523
mov byte [0x1800fb272], cl
mov rax, qword [rdi + 0xd80]
mov dword [rax + 8], 0xc13a147b
mov byte [rbx + 0xa], cl
jmp 0x18006654d
cmp byte [rbx + 0xa], cl
jne 0x18006654d
mov rax, qword [rdi + 0xd80]
mov dword [rax + 8], 0x3fd0a3d7
mov byte [rbx + 0xa], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180066594
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x1800fb274]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
test al, 1
je 0x1800665c7
cmp byte [0x1800fb272], cl
sete al
mov byte [0x1800fb272], al
jmp 0x1800665cd
mov al, byte [0x1800fb272]
test al, al
je 0x1800665f2
cmp byte [0x1800fb273], cl
je 0x1800665df
mov byte [0x1800fb273], cl
mov rax, qword [rdi + 0xd80]
mov dword [rax + 8], 0x4079999a
mov byte [rbx + 9], cl
jmp 0x180066609
cmp byte [rbx + 9], cl
jne 0x180066609
mov rax, qword [rdi + 0xd80]
mov dword [rax + 8], 0x3fd0a3d7
mov byte [rbx + 9], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180066614
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
cmp byte [0x1800fb26c], 0
mov rbx, rdx
je 0x180066777
mov rcx, qword [rdx + 0x100]
xor eax, eax
mov byte [rbp - 0x12], al
xor r8d, r8d
mov dword [rbp - 0x20], 0xafbab69f
mov dword [rbp - 0x1c], 0x8ebebcb5
mov dword [rbp - 0x18], 0x8db7bd86
mov word [rbp - 0x14], 0x8388
movsxd rdx, r8d
lea eax, [r8 - 0x27]
inc r8d
xor byte [rbp + rdx - 0x20], al
cmp r8d, 0xe
jb 0x18006665b
mov byte [rbp - 0x12], 0
lea rdx, [rbp - 0x20]
mov rax, qword [rcx]
mov r9b, 1
xorps xmm2, xmm2
call qword [rax + 0x490]
movdqa xmm0, xmmword [0x1800a7e80]
xor eax, eax
mov rcx, qword [rbx + 0x100]
xor r8d, r8d
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x10], al
movsxd rdx, r8d
lea eax, [r8 - 0x27]
inc r8d
xor byte [rbp + rdx - 0x20], al
cmp r8d, 0x10
jb 0x1800666a2
mov byte [rbp - 0x10], 0
lea rdx, [rbp - 0x20]
mov rax, qword [rcx]
mov r9b, 1
xorps xmm2, xmm2
call qword [rax + 0x490]
movdqa xmm0, xmmword [0x1800a7ea0]
xor r8d, r8d
mov rcx, qword [rbx + 0x100]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x829e8584
mov word [rbp - 0xc], 0x99
movsxd rdx, r8d
lea eax, [r8 - 0x27]
inc r8d
xor byte [rbp + rdx - 0x20], al
cmp r8d, 0x15
jb 0x1800666f1
mov byte [rbp - 0xb], 0
lea rdx, [rbp - 0x20]
mov rax, qword [rcx]
mov r9b, 1
xorps xmm2, xmm2
call qword [rax + 0x490]
movdqa xmm0, xmmword [0x1800a7e70]
xor eax, eax
mov rcx, qword [rbx + 0x100]
xor r8d, r8d
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 6], al
mov dword [rbp - 0x10], 0x8284839d
mov dword [rbp - 0xc], 0x858083ac
mov word [rbp - 8], 0x869f
movsxd rdx, r8d
lea eax, [r8 - 0x27]
inc r8d
xor byte [rbp + rdx - 0x20], al
cmp r8d, 0x1a
jb 0x18006674c
mov byte [rbp - 6], 0
lea rdx, [rbp - 0x20]
mov rax, qword [rcx]
mov r9b, 1
xorps xmm2, xmm2
call qword [rax + 0x490]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x180066d04
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
cmp byte [0x1800fb270], 0
mov rbx, rdx
je 0x180066df0
movdqa xmm0, xmmword [0x1800a7e60]
mov r8d, 0x8e
movdqa xmm1, xmmword [0x1800a7e90]
movdqu xmmword [rbp - 0x39], xmm0
mov byte [0x1800fb270], 0
mov rax, qword [rdx]
movdqa xmm0, xmmword [0x1800a7e20]
movdqu xmmword [rbp - 0x29], xmm1
mov dword [rbp + 0x47], 0x35157864
movdqa xmm1, xmmword [0x1800a7e50]
mov r10, qword [rax + 0x30]
xor eax, eax
movdqu xmmword [rbp - 0x19], xmm0
xor edx, edx
mov dword [rbp + 0x4b], 0x131353e
movdqa xmm0, xmmword [0x1800a7e40]
movdqu xmmword [rbp - 9], xmm1
mov dword [rbp + 0x4f], 0x1941070c
movdqa xmm1, xmmword [0x1800a7e30]
movdqu xmmword [rbp + 7], xmm0
mov word [rbp + 0x53], 0x5d4c
movdqa xmm0, xmmword [str.PNRSS]
movdqu xmmword [rbp + 0x17], xmm1
mov byte [rbp + 0x55], al
movdqa xmm1, xmmword [0x1800a7e10]
movdqu xmmword [rbp + 0x27], xmm0
movdqu xmmword [rbp + 0x37], xmm1
movsxd rcx, edx
lea eax, [rdx - 0x27]
inc edx
xor byte [rbp + rcx - 0x39], al
cmp edx, r8d
jb 0x180066dc4
and qword [rsp + 0x20], 0
lea r9, [0x18009de82]
lea rdx, [rbp - 0x39]
mov byte [rbp + 0x55], 0
mov rcx, rbx
call r10
cmp byte [0x1800fb271], 0
je 0x180066e23
and qword [rsp + 0x20], 0
lea r9, [0x18009de82]
mov byte [0x1800fb271], 0
lea rdx, str.function_GetPlayerLook__local_aSystem.GetViewCameraPos__local_bSystem.GetViewCameraDir__local_cScaleVector_b_100_local_dDifferenceVectors_a_c_local_elocal_fPhysics.RayWorldIntersection_a_c_1_ent_terrainent_staticent_rigident_sleeping_rigident_living_g_localActor.id_NULL_ENTITY_e_return_e_1_end_function_SpawnHelper3_g_local_hGetPlayerLook__if_h_then_if_LastHelpers_then_LastHelpers:DeleteThis__end_local_ih.pos_local_jclass_RigidBodyEx__positioni_scalex1_y1_z1_name_Nickname__propertiesobject_Model_objects_props_toy_duck_toy_duck_cap.cgf_local_kSystem.SpawnEntity_j_k:SetAngles_g_localActor:GetAngles___LastHelpersk_end_end_SpawnHelper3__
mov rax, qword [rbx]
mov r8d, 0x2a0
mov rcx, rbx
call qword [rax + 0x30]
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rbp
ret
Function at 0x18007e788
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.18006bd70
sub rsp, rax
mov rax, qword [0x1800f9d08]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.18008c0fc
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x18007e7d7
mov rax, rbp
jmp 0x18007e8df
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0xfc590]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.18008e4e0
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0xfc590]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x18007e8db
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18007e8db
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.18008e4e0
test rax, rax
js 0x18007e8db
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x18007e8db
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x18007e8cd
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x18007e8cd
cmp byte [rcx], 0xd
jne 0x18007e8b3
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x18007e8c2
cmp byte [rcx + 1], 0xa
jne 0x18007e8c2
inc rcx
jmp 0x18007e8c2
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0xfa0f0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x18007e895
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x18007e8df
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.18006c1b0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret