joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001dc00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c88], 0
lea rbx, [rcx + 0x5c90]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001dca7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001dc5a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1400202d0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140004100
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c88]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c98]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1403d7420]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001dcaf
mov rcx, rbx
call fcn.140004100
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001e070
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x1403d7428]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x14001e0d4
lea r10, [0x1400e95d0]
cmp r8b, 0x23
jne 0x14001e0b7
cmp byte [rdx], r8b
jne 0x14001e0b7
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14001e0a4
mov eax, dword [r14 + 0x5c00]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x14001e135
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x14001e0fa
cmp edi, eax
jl 0x14001e114
mov r8d, 0x715
lea rdx, str.D:ProyectosD_o_w_n_l_o_a_d_simgui_facturaimgui_facturaimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rdx, qword [r14 + 0x5c08]
cmp dword [rdx + rbp + 8], ebx
je 0x14001e152
mov eax, dword [r14 + 0x5c00]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x14001e0f1
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x14001e15f
cmp edi, dword [r14 + 0x5c00]
jl 0x14001e180
mov r8d, 0x715
lea rdx, str.D:ProyectosD_o_w_n_l_o_a_d_simgui_facturaimgui_facturaimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rdx, qword [r14 + 0x5c08]
movsxd rax, edi
lea rcx, [rax + rax*8]
lea rax, [rdx + rcx*8]
jmp 0x14001e137
Function at 0x1400b9360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x250
mov rax, qword [0x140102018]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, dword [rcx + 0x58]
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov ebp, r9d
mov eax, dword [rcx + 0x5c]
mov rsi, rcx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], r8d
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x278], rdi
nop dword [rax]
mov r10d, dword [rbx + 0x14]
mov eax, r10d
mov r14d, dword [rbx + 4]
cmp r10d, r14d
mov r9d, dword [rbx + 0xc]
cmovg eax, r14d
cmp r9d, eax
jl 0x1400b94fc
cmp r10d, r14d
mov eax, r14d
cmovg eax, r10d
cmp r9d, eax
jg 0x1400b94fc
cmp r10d, r14d
jne 0x1400b9400
sub rbx, 0x10
jmp 0x1400b9544
mov edx, dword [rsi + 0x88]
xor r9d, r9d
cmp r10d, r14d
setge r9b
inc r9d
cmp edx, r9d
je 0x1400b9472
mov eax, dword [rsi + 4]
mov ecx, eax
mov r8d, dword [rsi + 8]
neg ecx
cmp r10d, r14d
jge 0x1400b9434
dec eax
add eax, r10d
and eax, ecx
sub eax, r10d
jmp 0x1400b943c
and ecx, r10d
mov eax, r10d
sub eax, ecx
cmp eax, r8d
setge r11b
test edx, edx
je 0x1400b945b
movzx edx, r11b
mov rcx, rsi
call fcn.1400ba510
test al, al
jne 0x1400b9555
movzx r8d, r11b
mov edx, r9d
mov rcx, rsi
call fcn.1400bab80
test al, al
jne 0x1400b9555
mov edx, dword [rsi + 0x64]
lea r9, [0x1400baee0]
mov ecx, dword [rsi + 0x60]
mov r8, rbx
cmp r10d, r14d
jge 0x1400b949e
mov dword [rsp + 0x28], edx
mov edx, 2
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.1400b91e0
jmp 0x1400b94f2
mov eax, dword [rbx + 4]
neg ecx
movzx edi, byte [rsi + 0x6a]
neg eax
mov dword [rbx + 4], eax
neg edx
mov eax, dword [rbx + 0xc]
neg eax
mov dword [rsp + 0x28], ecx
mov dword [rbx + 0xc], eax
mov rcx, rsi
mov eax, dword [rbx + 0x14]
neg eax
mov dword [rsp + 0x20], edx
mov edx, 2
mov dword [rbx + 0x14], eax
call fcn.1400b91e0
test dil, dil
je 0x1400b94ea
cmp byte [rsi + 0x6a], 0
jne 0x1400b94ea
mov rdx, qword [rsi + 0x70]
mov ecx, dword [rdx + 0x20]
neg ecx
mov dword [rdx + 0x20], ecx
mov ecx, dword [rbx + 4]
neg ecx
mov dword [rbx + 4], ecx
test al, al
jne 0x1400b9555
sub rbx, 0x10
jmp 0x1400b9544
mov eax, dword [rbx + 8]
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x20], ecx
add ecx, eax
mov dword [rbx + 0x24], r10d
lea edx, [rax + rbp]
mov eax, ecx
sar eax, 1
mov dword [rbx + 0x18], eax
lea eax, [rcx + rdx]
sar eax, 2
lea ecx, [r10 + r9]
mov dword [rbx + 0x10], eax
mov eax, ecx
sar edx, 1
sar eax, 1
mov dword [rbx + 8], edx
lea edx, [r14 + r9]
mov dword [rbx + 0x1c], eax
lea eax, [rcx + rdx]
sar eax, 2
sar edx, 1
mov dword [rbx + 0x14], eax
mov dword [rbx + 0xc], edx
add rbx, 0x10
lea rax, [rsp + 0x30]
cmp rbx, rax
jb 0x1400b9559
mov ebp, dword [rbx]
jmp 0x1400b93c0
mov al, 1
jmp 0x1400b9562
mov dword [rsi + 0x58], ebp
xor al, al
mov dword [rsi + 0x5c], r14d
mov rdi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400c50b0
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rsi
pop rbp
ret
Function at 0x1400bf8b0
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
jne 0x1400bf8cc
lea eax, [rcx + 0x28]
add rsp, 0x48
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor r9d, r9d
mov qword [rsp + 0x40], r14
mov edx, 0x80000000
xor r14d, r14d
mov rcx, rbp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400bf920
mov r14, qword [rsp + 0x40]
lea eax, [rsi + 2]
mov rsi, qword [rsp + 0x68]
add rsp, 0x48
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400bfa45
mov rax, qword [rsp + 0x70]
cmp rax, 0x7fffffff
jg 0x1400bfa45
test rax, rax
je 0x1400bfa45
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x1400bfa45
mov ecx, dword [rsp + 0x70]
xor r9d, r9d
mov dword [rbx + 8], ecx
xor r8d, r8d
mov rcx, rax
mov dword [rbx + 0xc], r14d
mov qword [rsp + 0x20], r14
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], r14
je 0x1400bf9ba
lea rax, [0x1400bfaa0]
jmp 0x1400bfa13
mov rcx, qword [rbx + 0x30]
xor edx, edx
movsxd r8, dword [rbx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x1400bfa45
mov edi, r14d
nop dword [rax + rax]
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x60]
mov edx, edi
sub r8d, edi
add rdx, qword [rbx]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400bfa33
add edi, dword [rsp + 0x60]
cmp edi, dword [rbx + 8]
jne 0x1400bf9e0
lea rax, [0x1400bfa70]
mov rcx, rsi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov qword [rbx + 0x10], rax
xor eax, eax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r14
jmp 0x1400bfa5a
mov rcx, qword [rbx + 0x30]
xor edx, edx
mov r8, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x51
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret
Function at 0x1400c07a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x1400c07ab
xor eax, eax
ret
lea r11, [0x1400e2f30]
not ecx
cmp r8d, 8
jb 0x1400c0881
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1400c07d0
test r8d, r8d
je 0x1400c08ad
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x1400c0890
not ecx
mov eax, ecx
ret
Function at 0x1800047f0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180004825
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1800049a0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180004966
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800048e0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180004955
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18000491d
mov r10, qword [rdx]
cmp r10, rax
je 0x180004917
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180004955
cmp r9, rdx
je 0x180004931
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180004977
cmp r9, rdx
jne 0x180004922
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x180004890
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180004955
Function at 0x18000ca60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x18000ca94
cmp ecx, r10d
jge 0x18000ca82
mov rcx, rbx
call fcn.18000c250
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x18000cace
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x18000cab0
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x18000cafd
mov edx, dword [0x1802e5e34]
mov rax, qword gs:[0x58]
mov ecx, Ordinal_41
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x18000cb2f
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
nop dword [rax]
cmp rax, r8
jb 0x18000cb19
xor dl, dl
jmp 0x18000cb22
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x18000cb10
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x18000cad2
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x18000cba4
mov edx, dword [0x1802e5e34]
mov rax, qword gs:[0x58]
mov ecx, Ordinal_41
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x18000cbbe
mov rcx, rbx
call fcn.18000c390
test eax, eax
je 0x18000cb97
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x180025ff0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x1802208c0]
xor rax, rsp
mov qword [rsp + 0x2a8], rax
mov qword [rsp + 0x38], rsp
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180026185
lea rdx, [0x1801b4778]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x180026185
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x180026185
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180026185
mov byte [rsp + 0x30], 0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x2a0], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x34], eax
mov r8d, dword [rsp + 0x68]
cmp eax, r8d
jne 0x1800260c0
lea rdx, [0x18002614a]
mov rcx, qword [rsp + 0x38]
call sub.VCRUNTIME140.dll__local_unwind
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1800260eb
lea rdx, [0x18002614a]
mov rcx, qword [rsp + 0x38]
call sub.VCRUNTIME140.dll__local_unwind
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rsp + 0x2a0]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x18002611f
lea rdx, [0x18002614a]
mov rcx, qword [rsp + 0x38]
call sub.VCRUNTIME140.dll__local_unwind
mov eax, dword [rbx]
cmp dword [rsp + 0x2a0], eax
je 0x180026141
mov byte [rsp + 0x30], 1
lea rdx, [0x18002616e]
mov rcx, qword [rsp + 0x38]
call sub.VCRUNTIME140.dll__local_unwind
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x18002616e
xor esi, esi
mov rbx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x34]
jmp 0x1800260a5
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x18002617e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x30]
jmp 0x180026187
xor al, al
mov rcx, qword [rsp + 0x2a8]
xor rcx, rsp
call fcn.180173e20
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1800261b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
call fcn.180025ff0
test al, al
je 0x18002622d
movdqa xmm0, xmmword [0x1801e1010]
xor eax, eax
movdqa xmm1, xmmword [0x1801e1000]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x40], 0xb898f6b3
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x44], 0x8687aabc
mov dword [rsp + 0x48], 0x1009187
nop dword [rax]
nop word [rax + rax]
lea edx, [rax - 0x46]
xor byte [rsp + rax + 0x20], dl
inc rax
cmp rax, 0x2a
jb 0x180026200
mov rcx, qword [0x180261b58]
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x4b], 0
call fcn.180083dd0
mov ecx, 0x1a4
int 0x29
add rsp, 0x58
ret
Function at 0x1800263e0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.180026540
mov rdi, rax
movabs r8, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov rcx, rbx
shr rcx, 8
movzx edx, cl
movzx ecx, bl
xor rcx, rax
mov rax, rbx
shr rax, 0x10
imul rcx, r8
xor rdx, rcx
movzx ecx, al
imul rdx, r8
mov rax, rbx
xor rdx, rcx
shr rax, 0x18
imul rdx, r8
movzx ecx, al
mov rax, rbx
xor rdx, rcx
shr rax, 0x20
imul rdx, r8
movzx ecx, al
mov rax, rbx
xor rdx, rcx
shr rax, 0x28
imul rdx, r8
movzx ecx, al
mov rax, rbx
xor rdx, rcx
shr rax, 0x30
imul rdx, r8
movzx ecx, al
mov rax, rbx
xor rdx, rcx
shr rax, 0x38
mov rcx, qword [rdi + 0x480]
imul rdx, r8
xor rdx, rax
imul rdx, r8
and rcx, rdx
mov rdx, qword [rdi + 0x458]
shl rcx, 4
add rcx, qword [rdi + 0x468]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1800264c6
mov rcx, qword [rcx]
cmp rbx, qword [rax + 0x10]
je 0x1800264c8
cmp rax, rcx
je 0x1800264c6
mov rax, qword [rax + 8]
cmp rbx, qword [rax + 0x10]
jne 0x1800264b5
jmp 0x1800264c8
xor eax, eax
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x180026514
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x18002650b
mov r8, qword [0x1802e5e68]
mov rcx, rdi
mov r8, qword [r8 + 0x48]
call fcn.18011b130
mov rax, qword [0x1802e5e68]
mov rcx, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x118]
lea rdx, str.Failed_to_find_handler_for_native__p
jmp 0x18002651b
lea rdx, str.Failed_to_find_current_hash_for_native__p
mov rcx, qword [0x180261b58]
mov r8, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180083dd0
Function at 0x18002e3d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1802208c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r12d, r12d
lea rbx, str.shop_controller
mov r15d, edx
mov r11d, r12d
mov ebp, r9d
lea rdx, [0x1801bb3a7]
mov r14d, r8d
movzx r10d, byte [rbx]
movzx eax, r10b
or al, 0x20
movzx ecx, al
lea r9d, [r10 - 0x41]
cmp r9b, 0x19
cmova ecx, r10d
inc rbx
movsx eax, cl
add eax, r11d
imul r11d, eax, 0x401
mov eax, r11d
shr eax, 6
xor r11d, eax
cmp rbx, rdx
jne 0x18002e410
lea eax, [r11 + r11*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov rax, qword [0x1802e5e68]
imul r9d, ecx, 0x8001
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx]
movzx eax, word [rcx + 8]
lea r8, [rdx + rax*8]
cmp rdx, r8
je 0x18002e590
mov rcx, qword [rdx]
test rcx, rcx
je 0x18002e48c
cmp dword [rcx + 8], r12d
je 0x18002e48c
cmp dword [rcx + 0xc], r9d
je 0x18002e49a
add rdx, 8
cmp rdx, r8
jne 0x18002e478
jmp 0x18002e590
mov rax, qword gs:[0x58]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov rdi, qword [rax]
mov rsi, qword [rdi + 0x848]
mov qword [rdi + 0x848], rcx
mov byte [rdi + 0x850], 1
call fcn.180026540
movabs rcx, 0xa65568121df2ea26
mov dword [rax + 8], r12d
mov dword [rax + 0x18], r12d
call fcn.1800263e0
call fcn.180026540
mov rcx, qword [rax]
cmp dword [rcx], r12d
je 0x18002e50f
call fcn.180026540
movabs rcx, 0xfa336e7f40c0a0d0
mov dword [rax + 8], r12d
mov dword [rax + 0x18], r12d
call fcn.1800263e0
call fcn.180026540
mov dword [rsp + 0x28], 1
lea rcx, [rsp + 0x30]
mov r9d, r14d
mov dword [rsp + 0x20], ebp
mov r8d, r15d
mov dword [rsp + 0x30], 0xffffffff
mov edx, 0x57de404e
call fcn.18002e1c0
test eax, eax
je 0x18002e573
mov ebx, dword [rsp + 0x30]
call fcn.180026540
mov dword [rax + 8], r12d
mov dword [rax + 0x18], r12d
call fcn.180026540
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], ebx
movabs rcx, 0x39be7cea8d9cc8e6
inc dword [rax + 8]
call fcn.1800263e0
call fcn.180026540
test rsi, rsi
mov qword [rdi + 0x848], rsi
mov rsi, qword [rsp + 0x60]
setne al
mov byte [rdi + 0x850], al
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180173e20
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x180038020
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x48
test dl, dl
je 0x18003823b
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x40], rdi
movaps xmmword [rsp + 0x30], xmm6
call fcn.180026540
xor edi, edi
movabs rsi, 0xd80958fc74e988a6
mov rcx, rsi
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.1800263e0
call fcn.180026540
mov rcx, qword [rax]
mov ebx, dword [rcx]
call fcn.180026540
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180026540
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], ebx
inc dword [rax + 8]
call fcn.180026540
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 0xa
inc dword [rax + 8]
call fcn.180026540
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 0xa
inc dword [rax + 8]
call fcn.180026540
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], edi
inc dword [rax + 8]
call fcn.180026540
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
inc dword [rax + 8]
call fcn.180026540
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
inc dword [rax + 8]
call fcn.180026540
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
movabs rcx, 0xae99fb955581844a
inc dword [rax + 8]
call fcn.1800263e0
call fcn.180026540
lea ecx, [rdi + 0x57]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rbx, qword [rsp + 0x50]
xorps xmm6, xmm6
test ax, ax
je 0x180038163
call fcn.180026540
mov rcx, rsi
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.1800263e0
call fcn.180026540
movss xmm3, dword [0x1801e0a9c]
xorps xmm2, xmm2
movss dword [rsp + 0x20], xmm6
mov rcx, qword [rax]
mov edx, dword [rcx]
call fcn.180033600
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1800381a6
call fcn.180026540
mov rcx, rsi
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.1800263e0
call fcn.180026540
movss xmm3, dword [0x1801e0c70]
xorps xmm2, xmm2
movss dword [rsp + 0x20], xmm6
mov rcx, qword [rax]
mov edx, dword [rcx]
call fcn.180033600
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1800381e9
call fcn.180026540
mov rcx, rsi
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.1800263e0
call fcn.180026540
movss xmm2, dword [0x1801e0a9c]
xorps xmm3, xmm3
movss dword [rsp + 0x20], xmm6
mov rcx, qword [rax]
mov edx, dword [rcx]
call fcn.180033600
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18003822c
call fcn.180026540
mov rcx, rsi
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.1800263e0
call fcn.180026540
movss xmm2, dword [0x1801e0c70]
xorps xmm3, xmm3
movss dword [rsp + 0x20], xmm6
mov rcx, qword [rax]
mov edx, dword [rcx]
call fcn.180033600
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret