joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400020f0
Capabilities:
Encode data using xor

Disassembly:
adc cl, cl
jg 0x1400020d8
push 0xffffffffdea55f33
invalid
add eax, 0x2fa9a9fb
outsb dx, byte [rsi]
retf
jo 0x1400020c2
jrcxz sym.DUI70.dll_private:_void___cdecl_DirectUI::DUIFactory::ClearParser_void____ptr64
adc ch, byte [rbx - 0x2f5e6fd2]
push 0x73062837
jmp 0x14000217c
invalid
invalid
loop 0x140002109
invalid
and eax, 0x27851dd4
test dword [rdi], esp
xchg ebp, eax
in al, 0xe3
sti
jrcxz 0x14000212f
push rax
xchg ebp, eax
je 0x140002186
mov edi, 0x148786be
jbe 0x14000210d
fsub qword [rdx + rdi]
pop rbx
jbe 0x140002173
loop 0x140002176
xor byte [rbp + rcx*8 - 0x205237bf], bl

Function at 0x1400049cc
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
jo 0x1400049da
mov ebp, 0x201c868c
invalid
xor al, 0x69
and ah, byte [rbp + 0x13]
push rbp
ret
adc edx, dword gs:[rbp - 0x3d]
mov ah, bh
jne 0x1400049c3
xor byte [rbp + rdx - 0x75], ah
jae 0x140004a2e
add dword [rdx], ebp
jb 0x140004998
inc dword [rsp + rsi*4]
xor al, 0x4f
pop rax
not edx
sub bl, bh
invalid
lea edx, [rbp - 0x44]
jbe 0x1400049c6
mov ebp, dword [rsi - 0x395aada3]
or eax, 0x23a2be52
movabs al, byte [0x42c3ff8ff0dfe203]
invalid

Function at 0x140005494
Capabilities:
Encode data using xor

Disassembly:
sub bh, byte [rcx - 0x307ac61f]
mov fs, word [rdx]
stosb byte [rdi], al
add al, 0x92
mov esi, 0x2f3483a4
stosb byte [rdi], al
movsb byte [rdi], byte [rsi]
xor dword [rdi + rbp], 0xffffffaa
jne 0x1400054a0
invalid

Function at 0x140008324
Capabilities:
Encode data using xor

Disassembly:
or dh, dl
cmp eax, 0x74b738a8
sub al, 0x79
insd dword [rdi], dx
jns 0x14000839b
pop rdx
pushfq
pop rax
outsb dx, byte [rsi]
mov esp, dword [0xee4fbf15]
fnstsw word [rcx]
sal byte [r14], cl
xchg edx, eax
mov r11b, byte [r9]
or byte [rsi - 0xf7a0361], al
mov r14d, 0x21832043
inc dword [rbp + 0x4d9f565f]
sub eax, 0x33b29c61
xor dword [0x18dc9892d], ebp
pop rsp
jne 0x14000832c
cmp ecx, dword [rdi - 0x7f]
invalid
xchg edi, eax

Function at 0x14000a090
Capabilities:
Encode data using xor

Disassembly:
jns 0x14000a0a0
and al, 0xf
mov esp, 0x265cecdb
insb byte [rdi], dx
bsf ebx, ebx
in al, dx
pop rsp
insb byte [rdi], dx
xor al, 0x2f
ror byte [rcx + 0x5079fe7d], cl
vmulps ymm3, ymm12, ymm0
scasb al, byte [rdi]
jne 0x14000a07b
xor eax, 0x60f77e3c
jns 0x14000a095
mul dword [rax + 0x79]
cld
or dword [rax + 0x4d37a9d3], 0x726bb029
invalid
mov al, 0x6b
jb 0x14000a11f

Function at 0x140011780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
enter 0, 0

Function at 0x14001179c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [rax], al
mov dl, al
xor dl, 0xff
mov byte [rsp + 0xb5], dl
mov qword [rsp + 0xa8], rcx
mov byte [rsp + 0xa7], al
call sym.DUI70.dll_public_virtual:_void___cdecl_DirectUI::PatternProvider_class_DirectUI::ScrollItemProvider__struct_IScrollItemProvider__6_::Init_class_DirectUI::ElementProvider____ptr64____ptr64
mov rcx, rax
mov qword [rsp + 0x98], rcx
add byte [rax - 0x77], cl
test byte [rax + rdx*4], ah
add byte [rax], al
add al, ch
invalid
sbb al, byte [rax]
add byte [rax], al
Function at 0x140011820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rsi, qword [rsp + 0x90]
mov r10d, dword [rsi + r9 + 0x20]
mov edi, r10d

Function at 0x140011830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov bx, word [rsp + 0xb6]
mov r14, qword [rsp + 0x98]
add r14, rdi
invalid
Function at 0x1407c8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407c81df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407c8089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407c806f
add dl, dl
jne 0x1407c8096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407c80f6
xor eax, eax
add dl, dl
jne 0x1407c80a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407c81ad
add dl, dl
jne 0x1407c80b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c80c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c80d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c80dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407c80ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407c807e
mov eax, 1
add dl, dl
jne 0x1407c8106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c8113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407c80fb
sub eax, ebx
mov ebx, 1
jne 0x1407c814c
mov ecx, 1
add dl, dl
jne 0x1407c812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407c813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407c8123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407c807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407c8168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407c8175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407c815d
cmp eax, 0x7d00
jae 0x1407c819b
cmp eax, 0x500
jb 0x1407c8196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407c807e
cmp eax, 0x7f
ja 0x1407c819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407c807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407c81d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407c807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140011109
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001cdc0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140037067]
call fcn.1400118c5
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14001ce17
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001cf23
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001cebc
cmp qword [rbp + 0x28], 0
jle 0x14001cebc
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001ce5c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140011843
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x14001cf12
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14001cf12
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400114f1
Capabilities:
Terminate process

Disassembly:
jmp 0x14001ffc0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011622
Capabilities:
Parse pe header

Disassembly:
jmp 0x140020af0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140020b10
xor al, al
jmp 0x140020b91
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140020b23
xor al, al
jmp 0x140020b91
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140020b4d
xor al, al
jmp 0x140020b91
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140020b61
xor al, al
jmp 0x140020b91
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140020b73
xor al, al
jmp 0x140020b91
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140020b8f
xor al, al
jmp 0x140020b91
mov al, 1
add rsp, 0x38
ret
Function at 0x1400118ac
Capabilities:
Write file on windows

Disassembly:
jmp 0x140018ca0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x140030018]
xor rax, rbp
mov qword [rbp + 0x1a0], rax
lea rcx, [0x140037067]
call fcn.1400118c5
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x140018d06
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140018d0d
mov al, 1
jmp 0x140018e67
call fcn.140011285
mov rcx, qword [rbp + 0x1d0]
mov rcx, qword [rcx]
mov qword [rbp + 0x198], rcx
mov edx, eax
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x198]
call qword [rax + 0x18]
mov dword [rbp + 0x164], eax
call fcn.140011285
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.14001175d
movzx eax, al
test eax, eax
je 0x140018d68
xor al, al
jmp 0x140018e67
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x140018dcd
cmp dword [rbp + 0x194], 1
je 0x140018dd8
cmp dword [rbp + 0x194], 3
je 0x140018e56
jmp 0x140018e65
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140018e28
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140018e28
xor al, al
jmp 0x140018e67
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140018e43
mov dword [rbp + 0x194], 1
jmp 0x140018e4d
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x140018e67
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140018e67
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140028c00]
call fcn.14001173f
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rbp
call fcn.140011447
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x140002a50
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x20
lea rax, [fcn.140002a50]
mov qword [rsp + 8], rax
jmp 0x140002ab4

Function at 0x140002a9c
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 0x10]
and rax, qword [rsp + 0x10]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp]
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rsp + 0x1c]
add edx, dword [rsp + 0x1c]
mov dword [rsp + 0x1c], edx
mov edx, dword [rsp + 0x1c]
add edx, dword [rsp + 0x1c]
mov dword [rsp + 0x1c], edx
mov edx, dword [rax + rcx]
mov rcx, qword [rsp + 0x10]
and rcx, qword [rsp + 0x10]
and al, 0x10
and al, 0x10
mov qword [rsp + 0x10], rcx
cmp edx, 0x4550
cli
push rax
add byte [r8], r8b
jne 0x140002add
mov rax, qword [rsp]
add rsp, 0x20
ret
mov rax, qword [rsp + 8]
mov ecx, 0x51bb34d8
sub ecx, dword [rsp + 0x1c]
mov dword [rsp + 0x1c], ecx
mov dx, word [rax]
mov qword [rsp + 0x10], 0x2de5886d
cmp dx, 0x5a4d
mov qword [rsp], rax
je 0x140002a62
mov al, byte [rsp + 0x19]
mov byte [rsp + 0x19], al
mov cx, word [rsp + 0x1a]
sub cx, 0x9774
mov rdx, qword [rsp]
add rdx, 0xfffffffffffff000
mov word [rsp + 0x1a], cx
and rdx, 0xfffffffffffff000
mov r8d, dword [rsp + 0x1c]
mov dword [rsp + 0x1c], r8d
mov qword [rsp + 8], rdx
jmp 0x140002ab4

Function at 0x140002aa4
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 0x10]
and rax, qword [rsp + 0x10]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp]
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rsp + 0x1c]
add edx, dword [rsp + 0x1c]
mov dword [rsp + 0x1c], edx
mov edx, dword [rsp + 0x1c]
add edx, dword [rsp + 0x1c]
mov dword [rsp + 0x1c], edx
mov edx, dword [rax + rcx]
mov rcx, qword [rsp + 0x10]
and rcx, qword [rsp + 0x10]
and al, 0x10
and al, 0x10
mov qword [rsp + 0x10], rcx
cmp edx, 0x4550
cli
push rax
add byte [r8], r8b
jne 0x140002add
mov rax, qword [rsp]
add rsp, 0x20
ret
mov rax, qword [rsp + 8]
mov ecx, 0x51bb34d8
sub ecx, dword [rsp + 0x1c]
mov dword [rsp + 0x1c], ecx
mov dx, word [rax]
mov qword [rsp + 0x10], 0x2de5886d
cmp dx, 0x5a4d
mov qword [rsp], rax
je 0x140002a62
mov al, byte [rsp + 0x19]
mov byte [rsp + 0x19], al
mov cx, word [rsp + 0x1a]
sub cx, 0x9774
mov rdx, qword [rsp]
add rdx, 0xfffffffffffff000
mov word [rsp + 0x1a], cx
and rdx, 0xfffffffffffff000
mov r8d, dword [rsp + 0x1c]
mov dword [rsp + 0x1c], r8d
mov qword [rsp + 8], rdx
jmp 0x140002ab4
Function at 0x140002ca0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov dword [rsp + 0x50], 0x7c8472f7
mov ax, word [rsp + 0x56]
cmp rcx, 0
mov qword [rsp + 0x28], rcx
mov word [rsp + 0x26], ax
je 0x140002d27
jmp 0x140002d33
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x50]
xor ecx, 0x4b19465d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], 0x12f76b47
imul edx, dword [rsp + 0x4c], 0x5f4909b2
mov dword [rsp + 0x4c], edx
mov r8b, byte [rsp + 0x4b]
mov r9b, byte [rsp + 0x4b]
mov edx, dword [rsp + 0x34]
or r8b, r9b
mov byte [rsp + 0x4b], r8b
mov qword [rsp + 0x40], 0
cmp ecx, edx
jbe 0x140002cc3
mov al, byte [rsp + 0x4b]
and al, byte [rsp + 0x4b]
mov rcx, qword [rsp + 0x38]
mov byte [rsp + 0x4b], al
mov rax, rcx
add rsp, 0x58
ret
call fcn.140002a50
mov qword [rsp + 0x40], rax
jmp 0x140002cc3
xor eax, eax
mov edx, eax
mov rcx, qword [rsp + 0x28]
call fcn.140002da0
mov qword [rsp + 0x40], rax
jmp 0x140002cc3

Function at 0x140003210
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rsp + 0x48]
cmp qword [rsp + 0x68], rcx
sete r9b
mov r10, qword [rsp + 0x30]
xor r10, 0xffffffffffffffff
mov qword [rsp + 0xc0], r10
mov al, byte [rsp + 0xd3]
add byte [rax], al
mul byte [rsp + 0xd3]
mov r11b, byte [rsp + 0xbd]
mov byte [rsp + 0xd3], al
and r11b, r9b
test r11b, 1
test bl, 1

Function at 0x140003520
Capabilities:
Encode data using xor

Disassembly:
mov edx, eax
mov ecx, edx
mov r9, qword [rsp + 0x30]
mov r11b, byte [r9 + rcx]
sub r11b, bl
mov bl, byte [rsp + 0x53]
xor bl, 0xff
mov byte [rsp + 0x53], bl
mov r10, qword [rsp + 0x20]
mov byte [r10 + rcx], r11b
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x48], rcx
add eax, 0x20
mov edx, dword [rsp + 0x2c]
sub al, 0x39
ror byte [rcx - 0x7df0dbfc], 1
ja 0x14000355d
invalid
invalid
jmp 0x140003443
Function at 0x140f6b160
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140f6b2e7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f6b191
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f6b177
add dl, dl
jne 0x140f6b19e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f6b1fe
xor eax, eax
add dl, dl
jne 0x140f6b1ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f6b2b5
add dl, dl
jne 0x140f6b1be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f6b1cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f6b1d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f6b1e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f6b1f2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f6b186
mov eax, 1
add dl, dl
jne 0x140f6b20e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f6b21b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f6b203
sub eax, ebx
mov ebx, 1
jne 0x140f6b254
mov ecx, 1
add dl, dl
jne 0x140f6b236
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f6b243
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f6b22b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f6b186
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f6b270
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f6b27d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f6b265
cmp eax, 0x7d00
jae 0x140f6b2a3
cmp eax, 0x500
jb 0x140f6b29e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f6b186
cmp eax, 0x7f
ja 0x140f6b2a6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f6b186
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f6b2da
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f6b186
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180001f6c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r8d, r8d
movzx eax, byte [r8 + rdx]
movabs r9, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, r9
cmp r8, 8
jb 0x180001f47
mov rax, rcx
ret
mov rdx, rcx
movabs rcx, 0xcbf29ce484222325
jmp 0x180001f44
Function at 0x18000ad40
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov rax, qword gs:[0x60]
xor r14d, r14d
mov rbp, rdx
mov r8, rcx
test rax, rax
je 0x18000adf8
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov r9, qword [rsi]
jmp 0x18000adf3
mov r10, qword [r9 + 0x50]
test r10, r10
je 0x18000adf0
or rdx, 0xffffffffffffffff
inc rdx
cmp word [r10 + rdx*2], r14w
jne 0x18000ad8a
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], r14w
jne 0x18000ad98
cmp rdx, rax
jne 0x18000adf0
mov rbx, r14
test rdx, rdx
je 0x18000addb
mov rdi, r10
mov r11, rbp
sub rdi, rbp
movzx ecx, word [rdi + r11]
movzx eax, word [r11]
or cx, 0x20
or ax, 0x20
cmp cx, ax
jne 0x18000adf0
inc rbx
add r11, 2
cmp rbx, rdx
jb 0x18000adb9
mov rax, qword [r9 + 0x20]
mov qword [r8], rax
mov eax, dword [r9 + 0x30]
mov qword [r8 + 0x10], rax
mov qword [r8 + 8], r10
jmp 0x18000ae0a
mov r9, qword [r9]
cmp r9, rsi
jne 0x18000ad7d
lea rax, [0x1800161f0]
mov qword [r8], r14
mov qword [r8 + 8], rax
mov qword [r8 + 0x10], r14
mov rbx, qword [rsp + 0x10]
mov rax, r8
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret

Function at 0x18000e054
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, 0x26
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x18000e073
mov r8d, dword [0x180018b28]
dec r8d
jmp 0x18000e08c
mov ecx, 0x28
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r8d, dword [0x180018b28]
test al, 1
je 0x18000e093
inc r8d
mov dword [0x180018b28], r8d
mov rcx, qword [0x180018b38]
movabs rax, 0x2aaaaaaaaaaaaaab
sub rcx, qword [0x180018b30]
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test r8d, r8d
jns 0x18000e0cb
dec edx
mov dword [0x180018b28], edx
jmp 0x18000e0d7
cmp r8d, edx
jl 0x18000e0d7
and dword [0x180018b28], 0
mov ecx, 0x25
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x18000e102
movsxd rax, dword [0x180018b28]
lea rcx, [rax + rax*2]
mov rax, qword [0x180018b30]
mov rcx, qword [rax + rcx*8 + 8]
mov byte [rcx], 0
jmp 0x18000e12b
mov ecx, 0x27
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x18000e12b
movsxd rax, dword [0x180018b28]
lea rcx, [rax + rax*2]
mov rax, qword [0x180018b30]
mov rcx, qword [rax + rcx*8 + 8]
mov byte [rcx], 1
add rsp, 0x28
ret
Function at 0x180011258
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r8, qword [rcx]
mov rbp, rdx
test r8, r8
je 0x1800112d3
movsxd rax, dword [r8 + 0x3c]
mov ecx, dword [rax + r8 + 0x88]
add rcx, r8
je 0x1800112d3
mov r11d, dword [rcx + 0x1c]
xor edx, edx
mov ebx, dword [rcx + 0x24]
add r11, r8
mov r9d, dword [rcx + 0x20]
add rbx, r8
mov esi, dword [rcx + 0x18]
add r9, r8
test esi, esi
je 0x1800112d3
mov eax, dword [r9]
mov rdi, rbp
add rax, r8
sub rdi, rax
movzx ecx, byte [rax]
movzx r10d, byte [rax + rdi]
sub ecx, r10d
jne 0x1800112c5
inc rax
test r10d, r10d
jne 0x1800112b0
test ecx, ecx
je 0x1800112ea
inc edx
add r9, 4
cmp edx, esi
jb 0x1800112a4
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx ecx, word [rbx + rdx*2]
mov eax, dword [r11 + rcx*4]
add rax, r8
jmp 0x1800112d5