joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140043410
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140043444
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140043430
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140042e00
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140043469
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140037900
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400434e3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400434de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400434de
push rax
call 0x1401205cc
int3
call fcn.1400a45d0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400434f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140043524
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140043510
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140042e00
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140043549
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140037900
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400435c3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400435be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400435be
call 0x1401445a5
int3
call fcn.1400a45d0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400435d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140043604
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x1400435f0
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140042e00
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140043629
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140037900
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400436a3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004369e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004369e
call 0x140111717
int3
call fcn.1400a45d0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140049d80
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140049da3
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140049d90
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140042e00
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140049dc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140049de3
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140049dd0
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140042e00
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14004add0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x14004adf8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x14004ade0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x14006f260
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 0x28]
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x40
jae 0x14006f418
lea ecx, [r8*8]
mov qword [rsp + 0x30], rsi
add qword [rbx], rcx
mov byte [r8 + rbx + 0x2c], pe_nt_image_headers64
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jbe 0x14006f2d8
cmp eax, 0x40
jae 0x14006f2c2
nop word [rax + rax]
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x40
jb 0x14006f2b0
lea rsi, [rbx + 0x2c]
mov rcx, rbx
mov rdx, rsi
call fcn.14006f540
xor eax, eax
mov dword [rbx + 0x28], eax
jmp 0x14006f2e0
lea rsi, [rbx + 0x2c]
jae 0x14006f2f2
nop
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jb 0x14006f2e0
movzx eax, byte [rbx + 7]
mov rdx, rsi
mov byte [rbx + 0x64], al
mov rcx, rbx
movzx eax, byte [rbx + 6]
mov byte [rbx + 0x65], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 0x66], al
movzx eax, byte [rbx + 4]
mov byte [rbx + 0x67], al
movzx eax, byte [rbx + 3]
mov byte [rbx + 0x68], al
movzx eax, byte [rbx + 2]
mov byte [rbx + 0x69], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 0x6a], al
movzx eax, byte [rbx]
mov byte [rbx + 0x6b], al
call fcn.14006f540
movzx eax, byte [rbx + 0xb]
mov byte [rdi], al
movzx eax, byte [rbx + 0xa]
mov byte [rdi + 1], al
movzx eax, byte [rbx + 9]
mov byte [rdi + 2], al
movzx eax, byte [rbx + 8]
mov byte [rdi + 3], al
movzx eax, byte [rbx + 0xf]
mov byte [rdi + 4], al
movzx eax, byte [rbx + 0xe]
mov byte [rdi + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rdi + 6], al
movzx eax, byte [rbx + 0xc]
mov byte [rdi + 7], al
movzx eax, byte [rbx + 0x13]
mov byte [rdi + 8], al
movzx eax, byte [rbx + 0x12]
mov byte [rdi + 9], al
movzx eax, byte [rbx + 0x11]
mov byte [rdi + 0xa], al
movzx eax, byte [rbx + 0x10]
mov byte [rdi + 0xb], al
movzx eax, byte [rbx + 0x17]
mov byte [rdi + 0xc], al
movzx eax, byte [rbx + 0x16]
mov byte [rdi + 0xd], al
movzx eax, byte [rbx + 0x15]
mov byte [rdi + 0xe], al
movzx eax, byte [rbx + 0x14]
mov byte [rdi + 0xf], al
movzx eax, byte [rbx + 0x1b]
mov byte [rdi + 0x10], al
movzx eax, byte [rbx + 0x1a]
mov byte [rdi + 0x11], al
movzx eax, byte [rbx + 0x19]
mov byte [rdi + 0x12], al
movzx eax, byte [rbx + 0x18]
mov byte [rdi + 0x13], al
movzx eax, byte [rbx + 0x1f]
mov byte [rdi + 0x14], al
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 0x15], al
movzx eax, byte [rbx + 0x1d]
mov byte [rdi + 0x16], al
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 0x17], al
movzx eax, byte [rbx + 0x23]
mov byte [rdi + 0x18], al
movzx eax, byte [rbx + 0x22]
mov byte [rdi + 0x19], al
movzx eax, byte [rbx + 0x21]
mov byte [rdi + 0x1a], al
movzx eax, byte [rbx + 0x20]
mov byte [rdi + 0x1b], al
movzx eax, byte [rbx + 0x27]
mov byte [rdi + 0x1c], al
movzx eax, byte [rbx + 0x26]
mov byte [rdi + 0x1d], al
movzx eax, byte [rbx + 0x25]
mov byte [rdi + 0x1e], al
movzx eax, byte [rbx + 0x24]
mov rsi, qword [rsp + 0x30]
mov byte [rdi + 0x1f], al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14006f430
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov qword [rcx + 0x24], 0x5be0cd19
mov qword [rcx], rax
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
ret
Function at 0x140089450
Capabilities:
Check http status code

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
lea eax, [rdx - 0xc8]
mov rdi, rcx
mov rcx, qword [rcx]
mov esi, r8d
cmp eax, 0x64
jb 0x140089485
lea rdx, str.Couldnt_set_desired_mode
call fcn.14006b790
lea eax, [rbx + 0x11]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
cmp edx, 0xc8
je 0x14008949c
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.14006b910
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r14
cmp esi, 0x13
jne 0x1400894b8
mov rcx, rdi
call fcn.140089390
jmp 0x1400895ef
cmp esi, 0x14
jne 0x1400895d1
mov rsi, qword [rdi]
mov rbp, rbx
cmp dword [rsi + 0xba0], 2
jne 0x140089539
mov rax, qword [rsi + 0x1e0]
mov rdx, qword [rax]
test rdx, rdx
je 0x140089539
mov byte [rsp + 0x28], 1
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov qword [rsp + 0x50], rbx
call fcn.140055030
test eax, eax
jne 0x1400895ef
mov rcx, qword [rsp + 0x50]
lea edx, [rax + 0x2f]
call fcn.1400a58f6
test rax, rax
je 0x14008952e
mov rbp, qword [rsp + 0x50]
mov ecx, 1
sub rax, rbp
cmovne rcx, rax
mov byte [rcx + rbp], bl
jmp 0x140089539
mov rcx, qword [rsp + 0x50]
call qword [fcn.1400a5914]
mov rdx, qword [rsi + 0xc08]
test rdx, rdx
jne 0x14008955d
cmp byte [rsi + 0xf0d], bl
lea rax, str.NLST
lea rdx, str.LIST
cmovne rdx, rax
lea r8, [0x1400a9d94]
test rbp, rbp
mov r9, r8
lea rax, [0x1400aaddc]
cmovne r9, rbp
lea rcx, [0x1400bcd20]
cmovne r8, rax
call fcn.14005a120
mov rcx, rbp
mov r14, rax
call qword [fcn.1400a5914]
test r14, r14
jne 0x14008959c
lea ebx, [r14 + 0x1b]
jmp 0x1400895f1
lea rcx, [rdi + 0xa00]
mov r8, r14
lea rdx, [0x1400aab08]
call fcn.14009f5b0
mov rcx, r14
mov esi, eax
call qword [fcn.1400a5914]
test esi, esi
je 0x1400895c5
mov ebx, esi
jmp 0x1400895f1
mov dword [rdi + 0xab8], 0x1f
jmp 0x1400895f1
cmp esi, 0x15
jne 0x1400895dc
lea r8d, [rsi - 8]
jmp 0x1400895e5
cmp esi, 0x16
jne 0x1400895f1
lea r8d, [rsi - 8]
mov dl, 1
mov rcx, rdi
call fcn.140088ec0
mov ebx, eax
mov r14, qword [rsp + 0x60]
mov eax, ebx
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400a3e30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [fcn.1400a591a]
mov rdi, rax
test rax, rax
jne 0x1400a3e72
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400a3eb9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + 8]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + 0x10]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400a3f12
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + 8]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + 8]
sub rbp, 1
jne 0x1400a3ed0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400a3f53
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400c6c12]
mov r8d, 1
call qword [rbx + 8]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400c6c13]
mov r8d, 1
call qword [rbx + 8]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400a3f20
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x140001c14
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c5e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c5e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c5e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c5e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c5e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c60
xor al, al
add rsp, 0x28
ret
Function at 0x140001ca0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001cea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001cea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001cea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001cea
cmp dword [rcx + 0x84], 0xe
jbe 0x140001cea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001cec
xor al, al
add rsp, 0x28
ret
Function at 0x140001190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r13
sub rsp, 0x148
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r13d, edx
mov rdi, rcx
xor esi, esi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1400011db
mov rdx, rdi
lea rcx, str.Failed_to_load_library:__s_n
call fcn.140001130
xor eax, eax
jmp 0x140001323
mov qword [rsp + 0x180], r12
mov edi, esi
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x140], r15
movsxd r15, dword [rax + 0x3c]
mov r14d, dword [r15 + rax + 0x88]
mov eax, dword [r14 + rax + 0x1c]
mov r12d, dword [r14 + rbx + 0x20]
add rax, rbx
mov qword [rsp + 0x28], rax
add r12, rbx
mov eax, dword [r14 + rbx + 0x24]
add rax, rbx
mov qword [rsp + 0x20], rax
cmp dword [r14 + rbx + 0x14], esi
jbe 0x1400012ff
mov qword [rsp + 0x178], rbp
nop word [rax + rax]
mov ebp, edi
mov ecx, dword [r12 + rbp*4]
lea r8, [rcx + rbx]
cmp rcx, r14
jb 0x1400012d4
mov eax, dword [r14 + rbx + 0x20]
add rax, r14
cmp rcx, rax
jae 0x1400012d4
cmp r8, rbx
jb 0x1400012d4
mov eax, dword [r15 + rbx + 0x50]
add rax, rbx
cmp r8, rax
jae 0x1400012d4
mov edx, 0x100
lea rcx, [rsp + 0x30]
mov r9d, edx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov edx, 0x32
mov byte [rsp + 0x12f], sil
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
mov r9, rax
mov r8d, 0x92
mov rax, rsi
test r9, r9
je 0x1400012cf
nop
movsx edx, byte [rsp + rax + 0x30]
inc rax
imul ecx, r8d, 0x77c19a
add edx, ecx
and edx, 0xffffff
add r8d, edx
cmp rax, r9
jb 0x1400012b0
cmp r8d, r13d
je 0x1400012e3
inc edi
cmp edi, dword [r14 + rbx + 0x14]
jb 0x140001240
jmp 0x1400012f7
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rbp*2]
mov esi, dword [rcx + rax*4]
add rsi, rbx
mov rbp, qword [rsp + 0x178]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r15, qword [rsp + 0x140]
mov rax, rsi
mov r14, qword [rsp + 0x188]
mov r12, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400019d0
add rsp, 0x148
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400022a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400022ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400022ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400022ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400022ee
cmp dword [rcx + 0x84], 0xe
jbe 0x1400022ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400022f0
xor al, al
add rsp, 0x28
ret
Function at 0x1800184b4
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
sub rsp, 0x118
mov rax, qword [0x1800d0070]
xor rax, rsp
mov qword [rsp + 0x100], rax
or r9d, 0xffffffff
mov dword [rsp + 0x28], 0x64
lea rax, [rsp + 0x30]
mov r8, rcx
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea edx, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
jmp 0x18001852e
mov rcx, qword [rax + 0x60]
lea r8, [rsp + 0x30]
sub r8, rcx
movzx edx, word [rcx]
movzx r9d, word [rcx + r8]
sub edx, r9d
jne 0x180018527
add rcx, 2
test r9d, r9d
jne 0x180018511
test edx, edx
je 0x18001854f
mov rax, qword [rax]
cmp qword [rax + 0x30], 0
jne 0x180018505
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1800706c0
add rsp, 0x118
ret
mov rax, qword [rax + 0x30]
jmp 0x180018537

Function at 0x180018558
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800d0070]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov dword [rbp - 0x30], 0x64616f4c
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x2c], 0x7262694c
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x28], 0x41797261
mov byte [rbp - 0x24], 0
mov dword [rbp - 0x20], 0x4e52454b
mov dword [rbp - 0x1c], 0x41424c45
mov dword [rbp - 0x18], 0x642e4553
mov word [rbp - 0x14], 0x6c6c
mov byte [rbp - 0x12], 0
call fcn.1800185d8
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800706c0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x180018618
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x1800d0070]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor r12d, r12d
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x180018790
movsxd rax, dword [rcx + 0x3c]
mov r9d, dword [rax + rcx + 0x88]
mov r11d, dword [rax + rcx + 0x8c]
lea r8, [rcx + r9]
test r11d, r11d
je 0x180018790
lea r13d, [r12 + 1]
cmp rdx, 0xffff
ja 0x18001873f
mov ecx, dword [r8 + 0x1c]
movzx eax, bp
sub ax, word [r8 + 0x10]
add rcx, rbx
add ax, r13w
movzx edx, ax
mov edi, dword [rcx + rdx*4]
cmp edi, r9d
jb 0x18001873f
lea eax, [r9 + r11]
cmp edi, eax
jae 0x18001873f
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800734e0
lea rdx, [rbx + rdi]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r12b
jne 0x1800186ce
test r8, r8
je 0x180018790
lea rcx, [rsp + 0x20]
call fcn.180072e30
mov edx, 0x2e
lea rcx, [rsp + 0x20]
call fcn.180072d74
lea rdi, [rax + r13]
mov byte [rax], r12b
cmp byte [rdi], 0x23
jne 0x180018711
lea rcx, [rdi + 1]
call fcn.18007e12c
movzx edi, ax
lea rcx, [rsp + 0x20]
call fcn.180018558
mov rsi, rax
cmp rax, rbx
jne 0x180018732
mov rdx, rbp
mov rcx, rdi
call fcn.18007d1c0
test eax, eax
je 0x180018790
mov rdx, rdi
mov rcx, rsi
call fcn.180018618
jmp 0x180018792
mov ecx, dword [r8 + 0x18]
mov edi, r12d
mov r15d, dword [r8 + 0x20]
sub ecx, r13d
lea r10d, [rdi + rcx]
mov rsi, rbp
shr r10d, 1
lea rax, [r15 + r10*4]
mov edx, dword [rax + rbx]
add rdx, rbx
sub rsi, rdx
mov al, byte [rdx]
cmp al, byte [rdx + rsi]
jne 0x180018777
add rdx, r13
test al, al
jne 0x180018764
mov eax, r12d
jmp 0x18001877c
sbb eax, eax
or eax, r13d
test eax, eax
jns 0x180018786
lea edi, [r10 + 1]
jmp 0x18001878c
jle 0x1800187bd
lea ecx, [r10 - 1]
cmp edi, ecx
jbe 0x18001874d
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1800706c0
mov rbx, qword [rsp + 0x190]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [r8 + 0x24]
add rcx, rbx
cmp word [rcx + r10*2], r12w
je 0x180018790
movzx edx, word [rcx + r10*2]
mov ecx, dword [r8 + 0x1c]
add rcx, rbx
mov edi, dword [rcx + rdx*4]
cmp edi, r9d
jb 0x18001880f
lea eax, [r9 + r11]
cmp edi, eax
jae 0x18001880f
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800734e0
lea rdx, [rbx + rdi]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r12b
jne 0x180018801
jmp 0x1800186d7
lea rax, [rbx + rdi]
jmp 0x180018792
Function at 0x18001ac5c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800d0070]
xor rax, rsp
mov qword [rbp - 8], rax
mov rcx, qword [0x1800eb798]
lea rdx, [rbp - 0x28]
mov rdi, qword [0x1800eb140]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp - 0x20]
lea rcx, [rbp - 0x10]
sub eax, dword [rbp - 0x28]
movd xmm1, eax
mov eax, dword [rbp - 0x1c]
sub eax, dword [rbp - 0x24]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x10], xmm1
movss dword [rdi + 0x14], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp - 0x10]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [0x1800eb7a0]
cvtsi2ss xmm0, qword [0x1800eb7a8]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x18], xmm1
mov qword [0x1800eb7a0], rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov ecx, 0x10
mov byte [rdi + 0x148], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, bl
mov byte [rdi + 0x149], al
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, qword [0x1800eb140]
shr eax, 0xf
and al, bl
mov byte [rdi + 0x14b], 0
mov byte [rdi + 0x14a], al
cmp byte [rcx + 0x3a3], 0
lea rbx, [rcx + 0x130]
je 0x18001ad85
cvttss2si eax, dword [rbx]
lea rdx, [rbp - 0x18]
mov dword [rbp - 0x18], eax
cvttss2si eax, dword [rcx + 0x134]
mov rcx, qword [0x1800eb798]
mov dword [rbp - 0x14], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x14]
mov ecx, dword [rbp - 0x18]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, 0xff7fffff
mov dword [rbx], eax
mov dword [rbx + 4], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x18001adef
mov rdx, qword [0x1800eb798]
cmp rax, rdx
je 0x18001adb3
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x18001adef
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x18001adef
mov rcx, qword [0x1800eb798]
lea rdx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x18001adef
movd xmm0, dword [rbp - 0x30]
movd xmm1, dword [rbp - 0x2c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x18001adfd
or eax, 0xffffffff
jmp 0x18001ae0a
mov rax, qword [0x1800eb140]
mov eax, dword [rax + 0x1fb8]
cmp dword [0x1800e8598], eax
je 0x18001ae1d
mov dword [0x1800e8598], eax
call fcn.18001ac00
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800706c0
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret