joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140049270
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x78
add rcx, qword [0x14019a910]
call fcn.1400ee7e0
cmp dword [0x14019f0f8], 0
mov edx, eax
je 0x140049322
test eax, eax
je 0x140049322
cmp byte [0x14019e189], 0
lea r8, [rsp + 0x30]
mov rcx, qword [0x14019e1e0]
mov r9d, 0x32
mov qword [rsp + 0x20], 0
mov rcx, qword [rcx]
je 0x1400492c5
call fcn.14011f0f0
jmp 0x1400492cb
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
setns al
test al, al
je 0x140049322
lea r10, [rsp + 0x30]
movabs r9, 0xcbf29ce484222325
movabs r11, 0x100000001b3
nop dword [rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
lea eax, [r8 + 0x20]
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
movsx rax, cl
xor r9, rax
imul r9, r11
test r8b, r8b
jne 0x1400492f0
mov rax, r9
add rsp, 0x78
ret
xor eax, eax
add rsp, 0x78
ret

Function at 0x1400495b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
xor ebx, ebx
lea rdi, [rcx + 0x54]
cmp dword [0x14019f0f8], ebx
je 0x14004978a
test rdi, rdi
je 0x14004978a
cmp byte [0x14019e189], bl
lea r9d, [rbx + 0x2f]
mov rcx, qword [0x14019e1e0]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
mov rdx, rdi
mov rcx, qword [rcx]
je 0x1400495ff
call fcn.14011f0f0
jmp 0x140049605
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
setns al
test al, al
je 0x14004978a
lea rdx, [0x1401765cc]
lea rcx, [rsp + 0x30]
call fcn.1401232fc
test rax, rax
je 0x1400496f8
xor eax, eax
xorps xmm0, xmm0
mov rcx, rdi
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x58], eax
movups xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x5c], ax
mov byte [rsp + 0x5e], al
call fcn.1400ee7e0
cmp dword [0x14019f0f8], ebx
mov edx, eax
je 0x14004978a
test eax, eax
je 0x14004978a
cmp byte [0x14019e189], bl
lea r8, [rsp + 0x30]
mov rcx, qword [0x14019e1e0]
mov r9d, 0x2f
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
je 0x140049694
call fcn.14011f0f0
jmp 0x14004969a
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
setns al
test al, al
je 0x14004978a
lea r9, [rsp + 0x30]
movabs rbx, 0xcbf29ce484222325
movabs r10, 0x100000001b3
movzx r8d, byte [r9]
lea r9, [r9 + 1]
lea eax, [r8 + 0x20]
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
movsx rax, cl
xor rbx, rax
imul rbx, r10
test r8b, r8b
jne 0x1400496c0
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
cmp dword [0x14019f0f8], ebx
je 0x14004978a
cmp byte [0x14019e189], bl
lea r8, [rsp + 0x30]
mov rcx, qword [0x14019e1e0]
mov r9d, 0x2f
mov qword [rsp + 0x20], rbx
mov rdx, rdi
mov rcx, qword [rcx]
je 0x140049730
call fcn.14011f0f0
jmp 0x140049736
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
setns al
test al, al
je 0x14004978a
lea r9, [rsp + 0x30]
movabs rbx, 0xcbf29ce484222325
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
lea eax, [r8 + 0x20]
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
movsx rax, cl
xor rbx, rax
imul rbx, r10
test r8b, r8b
jne 0x140049760
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140049f60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
lea eax, [rcx + 0x218]
cmp dword [0x14019f0f8], ebx
mov edx, eax
je 0x140049faf
test eax, eax
je 0x140049faf
cmp byte [0x14019e189], bl
lea r9d, [rbx + 9]
mov rcx, qword [0x14019e1e0]
lea r8, [rbp - 0x20]
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
je 0x140049fa9
call fcn.14011f0f0
jmp 0x140049faf
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp - 0x20]
movsd xmm0, qword [rbp - 0x20]
movzx eax, byte [rbp - 0x18]
movsd qword [rbp - 0x10], xmm0
mov byte [rbp - 8], al
test dl, dl
je 0x14004a113
mov rax, rdx
shr rax, 0x10
cmp al, 2
jae 0x14004a113
mov r8, rdx
shr r8, 8
cmp r8b, 2
jae 0x14004a113
mov rax, rdx
shr rdx, 0x18
shr rax, 0x20
movzx eax, al
mov byte [rbp + 0x18], dl
movzx ecx, byte [rbp + rax - 0xb]
mov byte [rbp + 0x10], cl
test r8b, r8b
je 0x14004a0d2
mov ecx, ebx
cmp r8b, 0x10
jb 0x14004a0ab
movdqa xmm2, xmmword [0x14017da00]
mov eax, 0xfffffff0
movzx edx, r8b
and rdx, rax
mov eax, reloc.WS2_32.dll_recv
movdqu xmm0, xmmword [rbp + rax]
add ecx, 0x10
add rbx, 0x10
movdqu xmm1, xmmword [rbp + rax + 8]
lea rax, [rax + 0x40]
pandn xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + rax - 0x40], xmm1
movdqu xmm0, xmmword [rbp + rax - 0x30]
movdqu xmm1, xmmword [rbp + rax - 0x28]
pandn xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + rax - 0x30], xmm1
movdqu xmm0, xmmword [rbp + rax - 0x20]
movdqu xmm1, xmmword [rbp + rax - 0x18]
pandn xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + rax - 0x20], xmm1
movdqu xmm0, xmmword [rbp + rax - 0x10]
movdqu xmm1, xmmword [rbp + rax - 8]
pandn xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + rax - 0x10], xmm1
cmp rbx, rdx
jl 0x14004a033
movsxd rcx, ecx
movzx edx, r8b
cmp rcx, rdx
jge 0x14004a0d2
nop word [rax + rax]
mov eax, dword [rbp + rcx*4 + 0x18]
not eax
xor dword [rbp + rcx*4 + 0x10], eax
inc rcx
cmp rcx, rdx
jl 0x14004a0c0
movzx eax, byte [rbp - 0x1e]
test al, al
je 0x14004a104
mov ecx, eax
mov eax, 1
sub rax, rcx
cmp rax, 1
jae 0x14004a104
nop word [rax + rax]
movzx ecx, byte [rbp + rax + 0x18]
not cl
xor byte [rbp + rax + 0x10], cl
inc rax
cmp rax, 1
jb 0x14004a0f0
movzx eax, byte [rbp + 0x10]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
mov rbx, qword [rsp + 0x70]
xor al, al
add rsp, 0x50
pop rbp
ret
Function at 0x14004c010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov eax, dword [rdx]
mov dword [rcx], eax
movzx eax, byte [rdx + 4]
mov byte [rcx + 4], al
movsd xmm0, qword [rdx + 8]
movsd qword [rcx + 8], xmm0
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x18], eax
movsd xmm0, qword [rdx + 0x1c]
movsd qword [rcx + 0x1c], xmm0
mov eax, dword [rdx + 0x24]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x28]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x2c]
mov dword [rcx + 0x2c], eax
mov eax, dword [rdx + 0x30]
mov dword [rcx + 0x30], eax
mov eax, dword [rdx + 0x34]
mov dword [rcx + 0x34], eax
mov eax, dword [rdx + 0x38]
mov dword [rcx + 0x38], eax
mov eax, dword [rdx + 0x3c]
mov dword [rcx + 0x3c], eax
mov eax, dword [rdx + 0x40]
mov dword [rcx + 0x40], eax
mov rax, qword [rdx + 0x48]
mov qword [rcx + 0x48], rax
mov rax, qword [rdx + 0x50]
mov qword [rcx + 0x50], rax
mov rax, qword [rdx + 0x58]
mov qword [rcx + 0x58], rax
mov rax, qword [rdx + 0x60]
mov qword [rcx + 0x60], rax
mov rax, qword [rdx + 0x68]
mov qword [rcx + 0x68], rax
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, byte [rdx + 0x7c]
mov byte [rcx + 0x7c], al
mov eax, dword [rdx + 0x80]
mov dword [rcx + 0x80], eax
movzx eax, byte [rdx + 0x84]
mov byte [rcx + 0x84], al
mov eax, dword [rdx + 0x88]
mov dword [rcx + 0x88], eax
movups xmm0, xmmword [rdx + 0x8c]
movups xmmword [rcx + 0x8c], xmm0
mov eax, dword [rdx + 0x9c]
mov dword [rcx + 0x9c], eax
add rcx, 0xa0
add rdx, 0xa0
call fcn.1400ebcd0
nop
mov rax, qword [rbx + 0xb8]
mov qword [rdi + 0xb8], rax
mov rax, qword [rbx + 0xc0]
mov qword [rdi + 0xc0], rax
lea rcx, [rdi + 0xc8]
lea rdx, [rbx + 0xc8]
call fcn.140009150
nop
mov rax, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400647f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x14019e18a], 0
mov rdi, rdx
je 0x1400648a5
xor ecx, ecx
mov edx, 0x1000
mov r8d, edx
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x140064831
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movups xmm0, xmmword [0x14019eaf8]
mov r8d, 0x28
mov rdx, rdi
movups xmmword [rax], xmm0
movsd xmm1, qword [0x14019eb08]
lea ecx, [r8 - 0x27]
movsd qword [rax + 0x10], xmm1
mov eax, dword [0x14019eb10]
mov dword [rbx + 0x18], eax
movzx eax, word [0x14019eb14]
mov word [rbx + 0x1c], ax
mov rax, rbx
call qword [case.0x14011a6f9.0]
xor edx, edx
mov r8d, 0x1000
mov rcx, rbx
mov edi, eax
call fcn.140123f60
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test edi, edi
setg al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, 1
lea r8d, [rcx + 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov rbx, qword [rsp + 0x30]
test eax, eax
mov edi, eax
setg al
add rsp, 0x20
pop rdi
ret

Function at 0x140064c80
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, qword [0x14019efb0]
movzx edi, cx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor esi, esi
cmp rax, rbx
mov edx, esi
cmove rdx, rax
test rdx, rdx
jne 0x140064cc1
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov ecx, edi
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
mov qword [rsp + 0x20], 1
mov ebx, eax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x28], si
lea ecx, [rdx + 0x10]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x2c], 8
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea rdx, [rsp + 0x20]
mov word [rsp + 0x2a], ax
call fcn.1400647f0
lea rdx, [rsp + 0x20]
mov word [rsp + 0x2a], bx
call fcn.1400647f0
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x68], 8
call fcn.1400eea30
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2c], 0xa
mov word [rsp + 0x2a], bx
call fcn.1400647f0
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea rdx, [rsp + 0x20]
mov word [rsp + 0x2a], ax
call fcn.1400647f0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
movzx eax, al
add rsp, 0x50
pop rdi
ret
Function at 0x140064d80
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, qword [0x14019efb0]
movzx edi, cx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor esi, esi
cmp rax, rbx
mov edx, esi
cmove rdx, rax
test rdx, rdx
jne 0x140064dc1
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov ecx, edi
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 1
mov word [rsp + 0x2a], ax
mov qword [rsp + 0x2c], 8
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x28], si
call fcn.1400647f0
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x68], 8
call fcn.1400eea30
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2c], 0xa
call fcn.1400647f0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
movzx eax, al
add rsp, 0x50
pop rdi
ret

Function at 0x140064e30
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rbx, qword [0x14019efb0]
movzx edi, cx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor esi, esi
cmp rax, rbx
mov edx, esi
cmove rdx, rax
test rdx, rdx
jne 0x140064e71
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov ecx, edi
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], 1
mov word [rsp + 0x2a], ax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x28], si
mov dword [rsp + 0x2c], 8
call fcn.1400647f0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
movzx eax, al
add rsp, 0x50
pop rdi
ret

Function at 0x140064ed0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rbx, qword [0x14019efb0]
movzx edi, cx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor esi, esi
cmp rax, rbx
mov edx, esi
cmove rdx, rax
test rdx, rdx
jne 0x140064f11
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov ecx, edi
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], 1
mov word [rsp + 0x2a], ax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x28], si
mov dword [rsp + 0x2c], 0xa
call fcn.1400647f0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
movzx eax, al
add rsp, 0x50
pop rdi
ret
Function at 0x14006ff10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
cmp qword [rdx + 0x10], 0
je 0x1400700ac
xor ebx, ebx
mov r14, qword [0x14019f5a0]
mov rbp, qword [0x14019f5a8]
mov rcx, rbp
sub rcx, r14
movabs rax, 0x6bca1af286bca1b
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1400700ac
mov r15, qword [rsi + 0x18]
mov edi, ebx
movabs r13, 0xcbf29ce484222325
movabs r12, 0x100000001b3
nop dword [rax + rax]
lea rax, [r14 + 0xc8]
add rax, rdi
cmp qword [rax + 0x18], 0x10
jb 0x14006ffa4
mov rax, qword [rax]
mov r11, r13
nop word [rax + rax]
movzx r9d, byte [rax]
lea rax, [rax + 1]
lea r8d, [r9 - 0x41]
lea ecx, [r9 + 0x20]
movzx edx, cl
cmp r8b, 0x19
cmova edx, r9d
movsx rcx, dl
xor r11, rcx
imul r11, r12
test r9b, r9b
jne 0x14006ffb0
mov r10, rsi
cmp r15, 0x10
jb 0x14006ffe7
mov r10, qword [rsi]
mov r9, r13
nop word [rax + rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
lea edx, [r8 - 0x41]
lea eax, [r8 + 0x20]
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx rax, cl
xor r9, rax
imul r9, r12
test r8b, r8b
jne 0x14006fff0
cmp r11, r9
je 0x140070055
inc rbx
add rdi, 0x130
mov rcx, rbp
sub rcx, r14
movabs rax, 0x6bca1af286bca1b
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rbx, rdx
jb 0x14006ff90
jmp 0x1400700ac
imul rdi, rbx, 0x130
add rdi, r14
lea rbx, [rdi + 0x130]
cmp rbx, rbp
je 0x140070095
nop dword [rax + rax]
mov rdx, rbx
mov rcx, rdi
call fcn.1400f2c40
add rdi, 0x130
add rbx, 0x130
cmp rbx, rbp
jne 0x140070070
mov rbp, qword [0x14019f5a8]
lea rcx, [rbp - 0x130]
call fcn.140043c20
sub qword [0x14019f5a8], 0x130
mov rcx, rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.140009900
Function at 0x140081480
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
lea rbp, [rdx + 0xb4]
mov rsi, rcx
xor edi, edi
mov rcx, rbp
mov rbx, rdx
mov dword [rsp + 0x50], edi
call fcn.1400ee7e0
mov r9d, eax
movabs r10, 0x100000001b3
movzx r8d, al
mov ecx, r9d
sar ecx, 8
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx edx, cl
imul r8, r10
mov eax, r9d
xor r8, rdx
sar eax, 0x10
imul r8, r10
movzx ecx, al
mov eax, r9d
xor r8, rcx
sar eax, 0x18
imul r8, r10
movzx ecx, al
xor r8, rcx
mov rcx, qword [rsi + 0x38]
imul r8, r10
and rcx, r8
shl rcx, 4
add rcx, qword [rsi + 0x20]
mov rax, qword [rcx + 8]
cmp rax, qword [rsi + 0x10]
je 0x14008156f
mov rcx, qword [rcx]
cmp r9d, dword [rax + 0x10]
je 0x140081532
cmp rax, rcx
je 0x14008156f
mov rax, qword [rax + 8]
cmp r9d, dword [rax + 0x10]
jne 0x140081523
test rax, rax
je 0x14008156f
mov edx, ebx
mov ecx, 0x1e
call fcn.140044540
test al, al
jne 0x14008156f
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140047c80
mov edi, 1
mov rcx, qword [rax + 8]
sub rcx, qword [rax]
test rcx, 0xfffffffffffffff8
je 0x14008156f
movzx ebx, dil
jmp 0x140081571
xor bl, bl
test dil, 1
je 0x1400815b3
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400815b3
mov rdx, qword [rsp + 0x30]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1400815ae
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400815f9
call fcn.140120ef8
test bl, bl
je 0x1400815e2
mov rcx, rbp
call fcn.1400ee7e0
lea rcx, [rsi + 8]
mov dword [rsp + 0x50], eax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x20]
call fcn.1400f0340
mov rcx, qword [rax]
cmp dword [rcx + 0x24], 0
setne al
jmp 0x1400815e4
xor al, al
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
call fcn.140127e7c
int3
Function at 0x1400ba8c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x50
mov ebx, edx
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.140049330
mov r9, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400ba8e1
mov r9, qword [rax]
movabs r10, 0xcbf29ce484222325
movabs r11, 0x100000001b3
nop word [rax + rax]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
lea eax, [r8 + 0x20]
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
movsx rax, cl
xor r10, rax
imul r10, r11
test r8b, r8b
jne 0x1400ba900
movabs rax, 0x5af179301b4a8ac4
cmp r10, rax
jne 0x1400ba9af
mov rdx, qword [0x14019a9a0]
add rdx, rbx
je 0x1400ba985
cmp byte [0x14019e189], 0
lea r8, [rsp + 0x68]
mov rcx, qword [0x14019e1e0]
mov r9d, 4
mov qword [rsp + 0x20], 0
mov rcx, qword [rcx]
je 0x1400ba973
call fcn.14011f0f0
jmp 0x1400ba979
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
js 0x1400ba985
movss xmm0, dword [rsp + 0x68]
jmp 0x1400ba988
xorps xmm0, xmm0
call fcn.140134e78
movss xmm1, dword [0x14017b374]
comiss xmm1, xmm0
jae 0x1400ba9af
xor bl, bl
lea rcx, [rsp + 0x30]
call fcn.140009900
movzx eax, bl
add rsp, 0x50
pop rbx
ret
lea rcx, [rsp + 0x30]
mov bl, 1
call fcn.140009900
movzx eax, bl
add rsp, 0x50
pop rbx
ret
Function at 0x1400c32e0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xb0
cmp byte [rcx + 0xf0], 1
mov rbx, rcx
jne 0x1400c333f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
btr eax, 0x1f
sub eax, dword [rbx + 0xf4]
imul edx, eax, 0x1f4
mov eax, 0x10624dd3
imul edx
mov eax, 0x5b9
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, 0x2ee
add ecx, edx
cmp ecx, eax
cmovg ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x100], xmm0
mov r8d, dword [0x14019f0cc]
lea rcx, [rsp + 0x70]
movabs rdx, 0x84acaa2fdb19027f
call fcn.140044250
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movzx eax, byte [rbx + 0xf0]
movups xmmword [rsp + 0x30], xmm0
mov edi, dword [rsp + 0x38]
movups xmmword [rsp + 0x40], xmm1
test al, al
jne 0x1400c3397
test edi, edi
jle 0x1400c33e6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
btr eax, 0x1f
mov byte [rbx + 0xf0], 1
mov dword [rbx + 0xf4], eax
jmp 0x1400c339b
cmp al, 1
jne 0x1400c33e4
test edi, edi
jne 0x1400c3439
mov rax, qword [0x14019eb48]
mov byte [rbx + 0xf0], dil
mov dword [rbx + 0x100], 0x443b8000
movzx ecx, byte [rax + 0xd8]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x1400c33e8
mov rax, qword [0x14019eb48]
movzx ecx, byte [rax + 0xd8]
call fcn.140064ed0
jmp 0x1400c33e8
test edi, edi
jne 0x1400c3439
mov rax, qword [0x14019eb48]
movzx ecx, byte [rax + 0xd8]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x1400c3439
cmp byte [rbx + 0xf0], 0
jne 0x1400c3439
movss xmm1, dword [0x14017b4a0]
lea rax, [0x140174cb0]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x68], rax
call fcn.140042190
mov rax, qword [0x14019eb48]
movzx ecx, byte [rax + 0xd8]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x1400c3514
mov rdx, qword [0x14019a8e8]
mov ecx, dword [0x14019f0cc]
add rdx, 0x38
add rdx, rcx
je 0x1400c34d6
mov rcx, qword [0x14019e1e0]
lea r8, [rsp + 0xc0]
xor eax, eax
xor edi, edi
cmp byte [0x14019e189], al
mov dword [rsp + 0xc0], eax
mov rcx, qword [rcx]
lea r9d, [rax + 4]
mov qword [rsp + 0x20], rdi
je 0x1400c34a3
call fcn.14011f0f0
jmp 0x1400c34a9
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
cmovns edi, dword [rsp + 0xc0]
test dil, 1
je 0x1400c34d6
mov ecx, dword [0x14019f0cc]
add rcx, 0x488
add rcx, qword [0x14019a8e8]
call fcn.1400457c0
test al, al
jne 0x1400c3514
cmp byte [rbx + 0xf0], 0
jne 0x1400c3514
movss xmm1, dword [0x14017b348]
lea rax, [0x140175468]
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x70]
lea rax, [rsp + 0x70]
mov dword [rbx + 0x100], 0x443b8000
mov qword [rsp + 0xa8], rax
call fcn.140042190
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rdi
ret
Function at 0x1400c3530
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edx, dword [0x14019f0cc]
xor ebx, ebx
add rdx, 0x38
mov rdi, rcx
add rdx, qword [0x14019a8e8]
je 0x1400c3585
mov rcx, qword [0x14019e1e0]
lea r9d, [rbx + 4]
xor eax, eax
mov qword [rsp + 0x20], rbx
cmp byte [0x14019e189], al
lea r8, [rsp + 0x48]
mov dword [rsp + 0x48], eax
mov rcx, qword [rcx]
je 0x1400c357f
call fcn.14011f0f0
jmp 0x1400c3585
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [0x14019eb48]
movzx ecx, byte [rax + 0xd8]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1400c36bc
mov rdx, qword [0x14019a8e8]
mov ecx, dword [0x14019f0cc]
add rdx, 0x38
add rdx, rcx
je 0x1400c36bc
mov rcx, qword [0x14019e1e0]
lea r8, [rsp + 0x48]
xor eax, eax
mov qword [rsp + 0x20], rbx
cmp byte [0x14019e189], al
mov dword [rsp + 0x48], eax
mov rcx, qword [rcx]
lea r9d, [rax + 4]
je 0x1400c35eb
call fcn.14011f0f0
jmp 0x1400c35f1
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
cmovns ebx, dword [rsp + 0x48]
test bl, 1
je 0x1400c36bc
mov ecx, dword [0x14019f0cc]
add rcx, 0x488
add rcx, qword [0x14019a8e8]
call fcn.1400457c0
test al, al
je 0x1400c36bc
cmp byte [rdi + 0xf0], 0
jne 0x1400c36bc
cmp byte [rdi + 0xf1], 0
je 0x1400c36bc
call qword [sym.imp.KERNEL32.dll_GetTickCount]
btr eax, 0x1f
sub eax, dword [rdi + 0xf8]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
comiss xmm0, dword [0x14017b554]
jbe 0x1400c36bc
mov ebx, dword [0x14019f0cc]
mov ecx, ebx
call fcn.140047500
test al, al
jne 0x1400c36bc
mov rcx, qword [0x14019a8e8]
add rcx, 0x20
add rcx, rbx
call fcn.1400ee7e0
test eax, eax
je 0x1400c36a9
mov rcx, qword [0x14019a8e8]
add rcx, 0x20
add rcx, rbx
call fcn.1400ee7e0
mov ecx, eax
add rcx, 0xe8
call fcn.1400ee850
test al, al
jne 0x1400c36bc
mov rax, qword [0x14019eb48]
movzx ecx, byte [rax + 0xd8]
call fcn.140064e30
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret