joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18009715f
Capabilities:
Encode data using base64
Log keystrokes via polling

Disassembly:
cmp dword [rsp + 0x18], 0x886f9bc
jl 0x180202b61
setae sil
not ebx
je 0x18009266f
or r8d, dword [rsp + 0x24]
not r11
not dword [rsp + 0x18]
mov r11, qword [rsp + 0x38]
neg qword [rsp + 0x18]
sub qword [rsp + 0x18], 0xffffffffcb3f5302
sub r8d, dword [rsp + 0x23]
shl r8b, 0x38
js 0x18026d651
mov byte [rsp + r8 - 0x18d6a0e0], r8b
mov r8, qword [rsp + r8*2 - 0x31ad41f0]
jns 0x18009792c
setb r13b
mov rbp, qword [rsp + 0x30]
jae 0x1802804fc
add qword [rsp + 0x20], 0x6a9a4b9
add qword [rsp], 0x7febcf08
xor qword [rsp + 0x20], 0xffffffff90361005
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x40]
ret
cmp byte [rsp + 0x18], 0x1d
cmovl r10w, word [rsp + 0x19]
and sil, 0xae
test si, 0x5f03
call fcn.1801c44f8
mov qword [rsp + rbx*2 + 0x20], rbp
movabs rdi, 0xde8a4bac728a2386
xor bx, 0x1483
push rdx
movabs rdx, 0x6d9f2ab5c81d41bf
and edi, 0xefb5d4a2
call fcn.1802663ed
bswap edx
not edx
call fcn.18009bbab
push rdi
jle 0x180137ca9
mov rax, qword [rax + r11 - 0x3e338601]
movabs rbp, 0x283f0f30c82f662d
sub ebp, 0xae0385b6
add qword [rsp + r11*2 - 0x7c670bea], 0xfffffffffff3ea8a
shl bpl, 0x90
lea rax, [rax + rbp*4 - 0x67af3f5a]
push qword [rsp + rbp*2 - 0x3457bff0]
popfq
mov rbp, qword [rsp + r11*2 - 0x7c670bfa]
lea rsp, [rsp + r11 - 0x3e3385e9]
ret 8
mov qword [rsp + rdi + 0x6f73870], rbp
not byte [rsp + rdi*2 + 0xdee70a8]
jb 0x1800ad7d6
push rcx
push r12
jbe 0x1802318f8
sub rdi, qword [rsp + rdi + 0x6f73870]
nop
mov rcx, qword [rsp + rdi*2 - 0xba]
xor byte [rsp + rcx*2 + 0xdee719a], 0xf
movabs r12, 0x6e8060012d849339
jo 0x180264fb0
mov rbp, rdi
shr bp, cl
test dil, 0xad
call fcn.18023d2e7
xchg qword [rsp + 0x40], rsi
mov rbx, qword [rsp + 8]
shr qword [rsp + 0x18], 0x2e
or rbp, rbp
mov di, 0xea7
setns dil
add qword [rsp], 0x7fe96124
and dil, 0x33
mov rdi, qword [rsp + 0x30]
and ebp, ebp
or ebp, dword [rsp + 0x1c]
jb 0x1801d1225
call fcn.1801a5a4a
add qword [rsp + 0x28], 0xfffffffffffb9f97
add r13w, 0x9434
push r14
mov rbx, r9
mov r8, r13
not bx
jbe 0x1800311c0
xchg qword [rsp + 0x58], rdi
mov r13, qword [rsp + 0x28]
xor dword [rsp + rcx - 0x16439], 0xa88d4d0e
cmp qword [rsp + 8], 0xffffffffcab3ff26
call fcn.1800a92c4
ret
cmp r8, 0xfffffffffeb6e7b8
setge r8b
add qword [rsp + 0x48], 0xffffffffffe655b7
cmp r8, 0x153b368f
call fcn.180278509
pushfq
movabs r8, 0x3a834aab472f33a2
mov qword [rsp + rdx*2 - 0x1ffac], rbp
lea rdx, [rdx*4 + 0x2f3e8785]
not rdx
shl rdx, 0xc2
jbe 0x18017b1d5
jb 0x1800ad283
mov rdi, qword [rsp + 0x28]
mov r15w, word [rsp + 0x53]
jg 0x1801f2d58
cmp byte [rsp + 0x50], 0x32
movabs r11, 0x68952107e59c872f
jo 0x1801d0b6e
cmp dword [rsp + 0x50], r15d
jno 0x18021725b
jno 0x180231104
mov r15, qword [rsp + 0x10]
add qword [rsp + 0x58], 0x8676
not r11d
lea r11, [r11 + r11 + 0x1fc2afc1]
call fcn.180095dfa
jbe 0x180232227
lea r13, [r13 + r13*2 - 0x659e0de]
jle 0x180094f28
mov r13d, 0xc92a00ac
mov rdx, qword [rsp + 0x20]
mov r13w, 0xc123
xor r13b, 0x31
call fcn.1801377b2
and dword [rsp + 0x40], 0x743ed690
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x58]
ret
Function at 0x180097961
Capabilities:
Log keystrokes via polling

Disassembly:
movabs rax, 0x8f8e9c1e422b07ac
sub ax, 0x4c9f
and al, 0xe
shr al, 0x38
shl rax, 0x2a
jns 0x18026d614
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
call fcn.18024b20b

Function at 0x18009836f
Capabilities:
Log keystrokes via polling

Disassembly:
jo 0x18015e934
jle 0x180205dab
call fcn.1800a7cbf
add edx, ebp
int3

Function at 0x180098680
Capabilities:
Log keystrokes via polling

Disassembly:
cmp bp, 0x403a
jle 0x1801d0c35
push rcx
movabs rcx, 0xeb293487bd939134
xchg qword [rsp + 0x10], rdx
not rcx
push rdx
pushfq
mov rdx, rcx
and edx, 0x7992b388
shl edx, cl
mov rdx, qword [rsp + 8]
mov qword [rsp + 0x18], rdx
and rcx, 0xffffffff83b9c4b2
test ecx, 0x50b3410
jl 0x1800a72ec
test ecx, 0x28b200b0
jle 0x1800934bf
cmp cx, 0x2134
lea rcx, [rcx + rcx*2 - 0x16682cf]
call fcn.18009da42
mov r14, qword [rsp + 0x18]
movzx r14d, byte [rsp + r14 + 0x334afd1a]
jno 0x1801d49f2
or edi, edi
push rbx
and al, cl
xor esi, edx
and ecx, dword [rcx]
xchg esi, eax
mov bl, dl
xor eax, 0xb73b5ad3
in al, dx
sbb dword [rdx], esp
add eax, 0x21993
add byte [rax], al
adc al, 0xbc
invalid
call fcn.18009f5ca
call fcn.180269e9c
Function at 0x18009c7d8
Capabilities:
Log keystrokes via polling

Disassembly:
lea r10, [r10 + r10 + 0x220efa8a]
not r10
add qword [rsp + 0x20], 0x3906d
movabs rdi, 0x119189305919f2be
add qword [rsp + 0x10], 0xe6c65
neg r10b
lea r10, [r10 + rdi + 0x658bc308]

Function at 0x18009d810
Capabilities:
Log keystrokes via polling

Disassembly:
mov rbx, rbp
cmp si, 0x36a2
mov rsi, qword [rsp + 0x18]
mov rsi, qword [rsi]
jns 0x180094f09

Function at 0x18009fbf1
Capabilities:
Packed with generic packer

Disassembly:
mov r9, qword [rsp + 0x18]
not word [rsp + r9 + 0x154c154]
sub r9d, 0xd25a6b2
mov qword [rsp + 0x18], rsi

Function at 0x18009fc11
Capabilities:
Packed with generic packer

Disassembly:
xchg qword [rsp + 0x10], rbp
push r13
movabs r13, 0xde2bb5256a1423a3
push r13
pushfq
shl word [rsp + 8], 0x21
mov qword [rsp + 0x20], rbp
neg byte [rsp + 8]
test word [rsp + 8], 0x9f10
setne r13b
shr r13w, 0xa1
add qword [rsp + 0x18], 0x10aab6
xor r13w, 0x3b1c
mov rbp, r13
push rsi
jle 0x180169eb7
mov rsi, r13
call fcn.180165d6d
shl rdi, 0x5b
add qword [rsp + 8], 0x19e8d
movabs rsi, 0x991b8839e83f4f1e
lea rbp, [rdi*2 - 0x16da627a]
push rbx
call fcn.18009d810

Function at 0x18009fc89
Capabilities:
Log keystrokes via polling

Disassembly:
bswap edx
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx]
test r10, 0x600f8895
not r15
call fcn.180256d02

Function at 0x18009fca2
Capabilities:
Log keystrokes via polling

Disassembly:
jb 0x18020875f
lea rbp, [rbp + 1]
call fcn.180203533
push r14
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
cmovns r14w, word [rsp + 3]
mov qword [rsp + 0x38], r9
sub r9b, 0xa0
js 0x180094f58
mov r14b, 0x2e
jl 0x18015dd68
not r9w
lea rax, [rax + r9 + 0x278ba6ed]
add r14, r9
call fcn.180285637
pop rsi
push rbp
movabs rbp, 0xcd12c094ec1b4211
pushfq
and bpl, bpl
shl bpl, 0x44
mov bpl, 0xa4
call fcn.18014ae18
int3
mov rbx, qword [rbx]
shl r14d, 0x4a
jae 0x1800953db
movabs r11, 0x15a32416a49bb790
test rdi, 0x438ba030
lea rbx, [rbx + 0x11a70fa8]
call fcn.180129ccc
invalid
push rbp
mov rbx, qword [rsp + r13*8 + 0x30]
mov rbx, qword [rbx]
js 0x18013c640
ja 0x180206144
mov qword [rsp + 0x30], r13
call fcn.180241a08
lea rsp, [rsp + 0x20]
ret

Function at 0x1800a0b94
Capabilities:
Packed with generic packer

Disassembly:
lea rbx, [r11*2 + 0x2d0a9913]
shr r11d, 0x9f
sub bx, 0x4e2b
mov rbx, qword [rsp + rbx*2 - 0x6217e9c4]
mov rbx, qword [rbx + r11*8]
sub r11, 0xffffffff913f178e
not byte [rsp + r11 - 0x6ec0e85a]
and word [rsp + r11 - 0x6ec0e85a], r11w
cmp r11w, word [rsp + r11 - 0x6ec0e856]
jge 0x18022159a
neg r11w
neg r11d
shl qword [rsp + 0x18], 0xe3
test dword [rsp + 0x18], 0x7fb78f92
lea rbx, [rbx + 0xfadc329]
js 0x1801fd67e
ja 0x1801e30a7
shr r11b, 0x66
sub word [rsp + 0x18], r11w
xchg qword [rsp + 0x40], rbx
mov r11, qword [rsp + 0x10]
xor qword [rsp + 0x18], 0x158fb808
and word [rsp + 0x18], 0x198a
call fcn.180140c07
test r12w, si
setle sil
mov rbx, rsi

Function at 0x1800a4e91
Capabilities:
Log keystrokes via polling

Disassembly:
push r9
push rsi
pushfq
movabs r9, 0xa6b30a958587c622
mov qword [rsp + 0x20], 0x1932f551
mov r9, qword [rsp + 0x10]
movabs rsi, 0xff104b033a237490
and si, 0x821d
Function at 0x1800a71b5
Capabilities:
Parse pe header

Disassembly:
neg r14b
or r10w, r14w
lea rbx, [rbx - 0x5c6187ef]
movabs rdi, 0x33bba9bb1708bfbb
ja 0x1801b9564
push r14
neg dword [rsp + 0x60]
call fcn.180282262
Function at 0x1800a7ce0
Capabilities:
Authenticate hmac

Disassembly:
lea rdx, [rdx + 1]
bswap esi
push rsi
shr di, 0xa9
mov sil, bpl
jb 0x1800ad722
pop rbx
lea rbx, [rdi + rbx*2 - 0x3f7fcb]
movzx rbx, bx
mov qword [rsp + rsi - 0x35fbb4ef], rdx
shr bp, 0xf6
movabs rsi, 0xde34ac2e5f022220
lea rbp, [rdi*2 - 0x3579b65f]
push rdx
add ebx, 0x208ecda6
movabs rdx, 0xcb26921abc32d924
call 0x18015e8c9
push rdi
mov rdx, qword [rsp + 8]
mov rdx, qword [rdx]
lea rbp, [rbp + rbp*8 - 0x75cf05f3]
mov rdi, r11
pushfq
shl r11, 0x5d
lea rbp, [rbp + rbp*2 + 0x3e32963b]
add ebp, 0x92986d39
lea rdx, [rdx + rbp*2 - 0x7ad5fb70]
setle dil
ja 0x18022bd3d
je 0x180271402
test dil, 0x3c
movzx rdi, bp
xchg qword [rsp + rbp*2 - 0x6889d2e2], rdx
mov r11, qword [rsp + rbp - 0x3444e96d]
bswap rdi
call fcn.180098bff

Function at 0x1800a8540
Capabilities:
Encode data using base64
Log keystrokes via polling

Disassembly:
shr word [rsp + rdx*2 - 0x5497ffd0], 0x3d
and edx, dword [rsp + 0x2c]
xchg qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x40]
neg rbp
js 0x180268906
call fcn.180098670

Function at 0x1800a92c4
Capabilities:
Parse pe header

Disassembly:
setae byte [rsp + 0x38]
jg 0x18026076c
call fcn.180140b77

Function at 0x1800aaea0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rsi
jo 0x18009bc57
sub r15d, 0x2988b2bb
add qword [rsp], 0xfffffffffff9845a
movabs rsi, 0xeb253aa59f88bb17
push rcx
shr si, 0x54
movabs rcx, 0xb1b7f09aab2c432d
not rsi
movzx rcx, si
mov rsi, qword [rsp + 8]
mov rsi, qword [rsi + rcx - 0xffff]
or r15w, 0x4f2d
mov qword [rsp + 8], r15
push rdx
movabs rdx, 0x8d930f0109a4831e
neg cx
sub edx, dword [rsp + rcx*8 + 0xc]
xor word [rsp + 0x10], 0x4f1d
and r15b, r15b
lea rsi, [rsi + rdx - 0x58893376]
jl 0x1801ff93c
sub dword [rsp + 0x10], edx
shl ecx, cl
xor r15d, edx
jno 0x180252e48

Function at 0x1800aaf2f
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x38], 0xd7a9b2a3
jb 0x1800310aa
neg byte [rsp + 0x38]
shl qword [rsp + 0x38], 0xbb
call fcn.18014543d
mov dh, 0x32
mov byte [rcx], dl
invalid

Function at 0x1800ad430
Capabilities:
Log keystrokes via polling
Parse pe header

Disassembly:
push rsi
movabs rsi, 0x5b327721af9db410
not sil
pushfq
add qword [rsp + 0x10], 0xcc408
shr si, 0x4d
jns 0x1800a0cb5
push rdx
call fcn.1800ba160

Function at 0x180138915
Capabilities:
Parse pe header

Disassembly:
xchg qword [rsp + r11*8 - 0x17ffffc0], rdx
mov r12, qword [rsp + r12*2 - 0x5ffffea]
cmp byte [rsp + r11 - 0x2ffffe1], 0x3c
movabs rcx, 0x1fad5d3078b78123
js 0x18012c527
setno r11b
and byte [rsp + r11*2 - 0x5ffffe2], 0xa4
lea rdx, [rdx + r11*4 + 0x59a9eb7e]
mov r12, r11
jo 0x18028ab10
or word [rsp + r11*4 - 0xbffffe4], 0x1be
jne 0x180097dc1
imul esi, dword [rbx - 0xf4d8a7f], 0xb96b4b68
mov ecx, dword [rdi + 0x210a9248]
add dword [rbx + 0x79], ecx
in eax, dx
sub dh, byte [rax + 0x1193b328]
and esi, dword [rdi - 0x50]
mov edx, 0x7b416122
in eax, 0x22
sal byte [rax + 0x5db1940c], 0xae
mov edi, 0xa1dceed6
invalid
call fcn.18028bd0e

Function at 0x18013a283
Capabilities:
Parse pe header

Disassembly:
lea rsp, [rsp + 0x20]
call fcn.1802cbe5c
Function at 0x18013a28d
Capabilities:
Parse pe header

Disassembly:
shl rdi, 0xe5
sub byte [rsp + 0x20], 0xd
cmp dword [rsp + 0x20], 0x1ea3e796
mov rdi, qword [rsp + 0x48]
call fcn.180270c9d
mov eax, 0x155739d1
invalid

Function at 0x18013cf94
Capabilities:
Log keystrokes via polling

Disassembly:
mov rbx, qword [rsp + 0x10]
shl byte [rsp + 0x10], 0xbb

Function at 0x18014063c
Capabilities:
Log keystrokes via polling

Disassembly:
cmp r8d, 0x4403f9b2
not r8
mov rbp, qword [rsp + 0x20]
movsx r8w, r8b
setns r8b
setno r8b
push r11
mov r11, r8
xor r8, r11
cmovb r8, r11
lea rbp, [rbp + 1]
sub r11, 0x3598820d
or r11b, 0x9f
not r8d
add qword [rsp + 8], 0xf454f
mov r8b, 0x14
push 0xffffffffe7b81004
mov qword [rsp + 0x30], rbp
and byte [rsp], r11b
add dword [rsp], 0x64907d1e
push rdx
mov byte [rsp + 8], r11b
test word [rsp + 0xc], r8w
nop
jg 0x18026d606
xor r8w, word [rsp + 8]
call fcn.180097fc5
invalid

Function at 0x180140c57
Capabilities:
Encode data using xor

Disassembly:
add al, byte [rax]
shr qword [rsp + 0x28], 0xe
add qword [rsp + 0x18], 0x7fdf1834
cmp word [rsp + 0x28], 0x6321
call fcn.18021134a
xlatb
xchg edi, eax
cmp byte [0x1cff69221], dl
lodsd eax, dword [rsi]
scasd eax, dword [rdi]
mov eax, 0xa5d5fe5
ja 0x180140c40
mov edi, 0xd5f7e588
jb 0x180140cd9
invalid
invalid
push rsp
wait
jle 0x180140d44
in eax, dx
loop 0x180140ca0
add eax, 0xef3d5007
or eax, 0x2725a7ca
adc byte [0x1f72eca90], bh
mov al, 0x1d
out dx, eax
frstor dword [rdx + 0x4037359f]
sbb eax, 0xf79af5c7
xor eax, 0xc7056807
push r12
ja 0x180140ceb
invalid
add al, 0x4a
mov ecx, 0x6463732a
sbb dword [rbx + 0x71], edx
invalid

Function at 0x180147462
Capabilities:
Parse pe header

Disassembly:
lea rbx, [rbx + r12*8 + 0x1529d97a]
mov rdx, r12
js 0x180158215
call fcn.1801509d4

Function at 0x1801495d3
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x58]
ret
jg 0x18017698c
mov rdx, qword [rsp + r9*2 + 0x20]
mov rdx, qword [rdx]
test ch, cl
not word [rsp + r9*2 + 8]
call fcn.1801b57f1
jne 0x1800ba6ef
xor r15, 0x92bfe1a
jg 0x180263036
mov r15, qword [rsp + 0x20]
call fcn.18024818d

Function at 0x180149613
Capabilities:
Parse pe header

Disassembly:
jg 0x18026074d
push r8
sub bp, 0x59be
mov qword [rsp + 0x48], rcx
jge 0x1801eb1c1

Function at 0x18014fd3c
Capabilities:
Parse pe header

Disassembly:
jb 0x18025a4f4
cmp qword [rsp + 0x10], 0xffffffffeb28a315
sete byte [rsp + 0x10]
Function at 0x180157309
Capabilities:
Log keystrokes via polling

Disassembly:
call 0x1801fff78
movabs rbp, 0x99923838bb9a7b00
shl dl, 0xb3
xchg qword [rsp + 0x28], rax
xor bp, 0x891d
jg 0x1802689a1
push r15
add qword [rsp + 8], 0xfffffffffffef605
push rdx
push rdx
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
push rdx
not dword [rsp + 0x10]
not dword [rsp + 0x10]
and byte [rsp + 8], bpl
mov r15, rbp
mov rdx, qword [rsp + 0x10]
nop
and ebp, ebp
neg edx
lea rbp, [r15*2 - 0x6bc42de0]
push 0xffffffff9bbecd2b
or byte [rsp], 0xc
not edx
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
movzx r15d, bpl
mov qword [rsp + 0x28], rbp
cmp word [rsp + r15 - 0x32], 0x9c0c
lea rax, [rax + 0x10040a6]
setbe byte [rsp + 0x10]
setno dl
add word [rsp + r15*8 - 0x2d0], 0x37bf
add qword [rsp + 0x38], 0x7fed8308
xchg qword [rsp + r15 - 0x12], rax
mov rbp, qword [rsp + r15 - 0x1a]
mov r15b, byte [rsp + 0x1f]
shr qword [rsp], 0x3c
movsx r15d, r15w
call fcn.1800a7da4

Function at 0x18015e8e3
Capabilities:
Log keystrokes via polling

Disassembly:
add qword [rsp + 0x38], 0x1431f6
cmp cl, 0x9c
mov r13w, 0xfd0a
push r10
jno 0x1801a7d00
movabs r10, 0x92093a2a2b240cb8
or r10, rcx
mov rdi, qword [rsp + 0x40]
mov rdi, qword [rdi]
call fcn.1802034f8

Function at 0x18015e918
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [rsp], r11d
not dword [rsp]
push r14
movabs r14, 0x7dae282c06a94cb0
call fcn.1801c9a49
sub eax, 0xcccccce0
int3
pop rbp
push r13
movabs r13, 0x263b2bb2e68fda9c
push r11
pushfq
and r13d, 0xb7019f35
mov r11, r13
push r13
xchg qword [rsp + 0x20], rbp
cmp r11d, dword [rsp + 1]
bswap r13
not qword [rsp]
mov r13, qword [rsp + 0x18]
mov qword [rsp + 0x18], rbp
ja 0x1800ba900
pop rdi
call fcn.1802480a2
call fcn.18017ab97

Function at 0x18015e986
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push r13
movabs r13, 0x9d8ca7bda8bbb204

Function at 0x18015e9ce
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsi, rsi
lea rsi, [rsi + rsi*4 + 0x2214a4ad]
jns 0x18015e9f7
add qword [rsp], 0xffffffffffefdd38
movabs rax, 0xde21b725fe19b69e
cmp r13, rax
push r14
setae r13b
mov rax, qword [rsp + 8]
mov rax, qword [rax]
call fcn.18022bcf3
jb 0x1800a4ebc
lea rsi, [rsi + rsi*8 + 0x1886c98]
mov rsi, qword [rsp + 8]
jle 0x1801f7c07
movabs r12, 0xa0bc6299ce2d002b
neg r12
mov rcx, qword [rsp + rsi*2 - 0xae6c0c]
mov rcx, qword [rcx + rsi*8 - 0x2b9b070]
call fcn.180093665
push qword [rsp]
popfq
lea rsp, [rsp + 0x20]
call fcn.1802cfa6d

Function at 0x1801611f0
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
xor dword [rax - 0x6bb8affc], edi
int3
xchg qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x30]
and al, 0x30
and r9d, 0x2a2e798c
je 0x180239fcc
sub r9b, 0x8a
call fcn.18017cd67
neg r10d
shr r15d, 0x22
setb byte [rsp + r10 - 0x63e452e0]
mov r10, qword [rsp + r10 - 0x63e452d0]
jne 0x1801f393d
movabs byte [0xe111c82c23dd8383], al
mov bh, 0x59
pop rsi
stosb byte [rdi], al
jnp 0x1801611f8
xor eax, 0xd16084cb
sal dword [rdi], 1
stc
jle 0x1801611d1
movabs dword [0xbf897980b4837db3], eax
xchg ecx, eax
invalid
setne r15b
lea r15, [r15 + r15*8 - 0x207fe174]
or qword [rsp + 0x10], 0x3a80cf0e
neg byte [rsp + 0x10]
Function at 0x180161585
Capabilities:
Parse pe header

Disassembly:
xor r11w, 0x4a0
bswap r11
test r11b, 0x39
mov r11, qword [rsp + 0x40]
js 0x1800a7191
add qword [rsp], 0x7fdc5bdf
call fcn.18013e3d3
xchg ecx, eax
invalid
jae 0x18013a2b0

Function at 0x180163b42
Capabilities:
Log keystrokes via polling

Disassembly:
bswap rsi
pushfq
and sil, 0xb6
xchg qword [rsp + 0x28], rbp
lea rsi, [rsi + rsi*8 - 0x576334e0]
call fcn.1801d6b5d

Function at 0x180163b5c
Capabilities:
Log keystrokes via polling

Disassembly:
push r13
and r14b, r14b
cmp r14b, 0x97
add qword [rsp + 0x28], 0x1761b
movabs rbp, 0x19934fa62f856e34
shr rbp, 0xdf
add qword [rsp + 8], 0x7ff593a8
neg r14d
Function at 0x180165696
Capabilities:
Log keystrokes via polling

Disassembly:
mov ebp, esi
call 0x181d7359d
mov ah, 0xd2
cdq
invalid
lea rax, [rax - 0x74e50e4b]
jae 0x1801d6ae6
invalid
mov qword [rsp], 0x35709dc6
call fcn.180295e89
insb byte [rdi], dx
ja 0x1801656a1
jrcxz 0x18016563e
invalid
push rdx
seto r9b
or r9, 0xffffffffcab3ff3b
not byte [rsp + r9 + 0x344c00e5]
setle byte [rsp + r14 - 0xb5dffe0]
xchg qword [rsp + r14 - 0xb5dffc8], rax
mov r9, qword [rsp + r9*2 + 0x689801a2]
xor byte [rsp + r14*2 - 0x16bbffe0], 0xa7
test qword [rsp + r14*8 - 0x5aefffe0], 0x472270b9
jle 0x18015e99f
jg 0x18011f677

Function at 0x180169edc
Capabilities:
Packed with generic packer

Disassembly:
jl 0x18017696a
jo fcn.180165e71
jge 0x1801e540d
pop rdx
push r11
pushfq
movabs r11, 0x3a236a334f3a9d80
push r12
mov r12, r11
push r11
mov word [rsp], 0x2881
xchg qword [rsp + 0x20], rdx
mov r11d, 0x1a907609
mov r12d, r11d
call fcn.18014e01c
cld
rol dh, 0xfd
mov edi, edi
invalid

Function at 0x18016b058
Capabilities:
Log keystrokes via polling
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rdi
movabs rdi, 0x1c0ef62476131724
mov qword [rsp + 0x48], rbp
push rbx
jb 0x180279a19
push rdx
cmovae r8, qword [rsp]
setge byte [rsp]
add qword [rsp + 0x18], 0x1b8ee1
mov r11b, 0x35
movabs rbp, 0xbf8e91395d0197a4
call fcn.18015a178

Function at 0x18017b200
Capabilities:
Log keystrokes via polling

Disassembly:
jg 0x180132a4a
je 0x180262ff0
push qword [rsp + 0x78]
popfq
lea rsp, [rsp + 0x88]
ret
push r11
test r13d, r13d
not r8b
mov rbp, qword [rsp + 0x38]
mov rbp, qword [rbp + riz]
lea r8, [rsi*2 - 0x494b775a]
jae 0x180098358

Function at 0x18017c3f7
Capabilities:
Log keystrokes via polling
Parse pe header

Disassembly:
mov qword [rsp + 0x28], rbx
push rbp
movabs rsi, 0x9c21dc945ca1ae05
cmp r14w, 0x3399
not r13
add qword [rsp + 8], 0xfffffffffff66c12
movabs rbp, 0x312e8fa47880d1b1
neg r13b
or bp, 0x3a23
add r13, 0xfffffffff7359d3a
mov rbp, rsi
push rbp
mov rbx, qword [rsp + 0x10]
mov rbx, qword [rbx]
add r14d, dword [rsp + 4]
or r13b, byte [rsp + r14 - 0x2d3dd27]
js 0x180211842
je fcn.180249ff2
push rsi
xchg qword [rsp + 0x70], rbp
mov rdx, qword [rsp + 0x30]
cmp esi, 0x47aed691
movsxd r8, dword [rsp + 0x48]
lea rsi, [rsi + r11*8 - 0x20f6cee2]
movzx r11, r8b
cmovb r11, r13
add r8w, word [rsp + 4]
mov r13b, 0xb5
mov rsi, qword [rsp + 0x20]
or word [rsp + r8*4 + 0x3bfc2fcc], 0x9725
movsx r8, r13b
shr r11b, 1
shl word [rsp + r8 + 0x93], 0x41
jg 0x180271c29
feni8087_nop
adc dword [rbx], ebp
or eax, 0x1e642b00
add byte [rdi], ah
push rsp
sbb eax, 0x1c342300
add byte [rbx], dl
add dword [rsi], edx
add byte [rax + rsi*8], cl
or ah, al
or al, dl
invalid
neg esi

Function at 0x180184ecd
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + rbp*2 - 0x240037c8], r13
jae 0x18022c861

Function at 0x180185a00
Capabilities:
Encode data using base64

Disassembly:
ja 0x180201742
mov esi, ds
xchg ecx, eax
in eax, 0x7c
cmp al, 0xa8
invalid

Function at 0x18019e230
Capabilities:
Log keystrokes via polling

Disassembly:
jb 0x1801ca4e1
shr word [rsp + 0x30], 0x27
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x38]
Function at 0x18019fa16
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
setno r14b
mov r14, qword [rsp + r14 - 0x7efffeb1]
xor qword [rsp + 0x48], 0x13a52623
jbe fcn.1801cd0b1
call fcn.180234db2

Function at 0x1801abc15
Capabilities:
Log keystrokes via polling

Disassembly:
neg qword [rsp + 0x68]
jne 0x18017b206
xchg edi, eax
invalid

Function at 0x1801b3be3
Capabilities:
Log keystrokes via polling

Disassembly:
push r13
or r14, r14
add qword [rsp + 0x10], 0x11c453
movabs rsi, 0x2d9291ae89bbd484
shl si, 0x93

Function at 0x1801b950e
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
test r12, 0xffffffffb60dec9c
jl 0x180241a29
movabs rax, 0x549ea237d0beec8b
push r14
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
bswap r12d

Function at 0x1801b9542
Capabilities:
Parse pe header

Disassembly:
add qword [rsp], 0x7fdc6295
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
call fcn.180297e8b

Function at 0x1801b955a
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rdi
call fcn.1800a6910

Function at 0x1801c5074
Capabilities:
Log keystrokes via polling
Packed with generic packer
Parse pe header

Disassembly:
push r10
movabs r10, 0xf498e79667389e09
xchg qword [rsp + 0x68], rcx
mov r8, qword [rsp + 0x38]
setae r10b
jbe 0x180163b99
mov edx, 0x7a3e5b3e
xchg qword [rsp + rdx - 0x7a3e5b26], rax
mov rdx, qword [rsp + rdx - 0x7a3e5b36]
call fcn.180254626

Function at 0x1801ca4ca
Capabilities:
Log keystrokes via polling

Disassembly:
adc eax, 0x6ae8d9
xchg ebx, eax
shl r14d, 0x15
jbe 0x1801ca4c5
add qword [rsp + 0x10], 0xdd579
movabs rdi, 0x6580a605e0bfe5b0
call fcn.1801eeecb
int 0x94
jo 0x1801b3bfe
add byte [rcx + 0x38], bh
fxtract
sub al, 0xdc
cmc
push rsp
cmc
mov al, 0x58
sbb byte [rcx + 0x78], dl
leave
xchg esp, eax
insb byte [rdi], dx
adc al, 0x2d
invalid
call fcn.1802419d5
mov r9, qword [rsp + 0x20]
setbe sil
mov r8, r11
add dword [rsp + rsi - 0x34c737c9], 0x32259b0c
setae byte [rsp + 0x40]
shl rsi, 0x12
mov r8, qword [rsp + 0x28]
and word [rsp + 0x40], 0x6c1e
test dword [rsp + 0x48], esi
jb fcn.18015f282
shr r11b, 0xfe
js 0x18002bf8a
call fcn.180098297
xchg edx, eax
sbb byte [rsi - 0x5b344975], ch
invalid

Function at 0x1801d3c80
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1801f64ed
movabs r8, 0x85ad4a324ba1ab29
call fcn.180263579
test word [rsp + 0x70], 0x9523
jg 0x1800a9c13
shl qword [rsp + 0x58], 0xde
call fcn.1801ef9b1