joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d17cc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d184a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d1841
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d1841
mov rax, qword [rbp - 8]
jmp 0x2fc4d185f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d1814
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x18000240c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x1800f6110]
mov rdx, qword [rax]
test rdx, rdx
je 0x18000264b
mov r13, qword [rdx + 0x48]
test r13, r13
je 0x18000264b
mov rax, qword [rdx + 0x70]
mov qword [rbp - 0x28], rax
test rax, rax
je 0x18000264b
mov rcx, qword [rdx + 0xd0]
test rcx, rcx
je 0x18000264b
mov r15, qword [rdx + 0xe0]
test r15, r15
je 0x18000264b
mov rax, qword [rcx]
mov rdx, qword [rax + 0x68]
call rdx
mov rbx, rax
test rax, rax
je 0x18000264b
mov rcx, qword [rax]
mov rdx, qword [rcx + 0xc8]
mov rcx, rax
call rdx
mov qword [rbp + 0x58], rax
mov rsi, rax
test rax, rax
je 0x18000264b
and qword [rbp + 0x60], 0
lea rdx, [rbp + 0x60]
mov rcx, qword [rbx]
mov r8, qword [rcx + 0x470]
mov rcx, rbx
call r8
test al, al
je 0x18000264b
mov rcx, qword [rbp + 0x60]
xor edx, edx
mov rax, qword [rcx]
mov r8, qword [rax + 0x1d8]
call r8
mov rbx, rax
test rax, rax
je 0x18000264b
lea rdi, [rax + 0x28]
test rdi, rdi
je 0x18000264b
mov r12, qword [rdi + 8]
test r12, r12
je 0x18000264b
mov rax, qword [rdi]
lea rdx, [rbp - 0x18]
and dword [rbp - 0x18], 0
mov rcx, rdi
and dword [rbp - 0x14], 0
and dword [rbp - 0x10], 0
call qword [rax + 0x2f0]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x18000264b
xor eax, eax
mov word [rbp + 0x50], 0x2f2b
mov byte [rbp + 0x52], al
xor r8d, r8d
movsxd rdx, r8d
lea eax, [r8 + 0x40]
inc r8d
xor byte [rbp + rdx + 0x50], al
cmp r8d, 2
jb 0x18000253a
mov rax, qword [rcx]
mov byte [rbp + 0x52], 0
mov rdx, qword [rax + 0x60]
call rdx
lea rdx, [rbp + 0x50]
mov rcx, rax
call fcn.180070c68
test rax, rax
jne 0x18000264b
mov rax, qword [r15]
mov rcx, r15
mov rdx, qword [rax + 0xa8]
call rdx
mov r14, rax
test rax, rax
je 0x18000264b
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x30]
jmp 0x18000263f
mov rcx, qword [rbx]
mov rdx, qword [rcx + 0x178]
mov rcx, rbx
call rdx
test al, al
jne 0x180002636
mov rcx, qword [rbx]
mov rax, qword [rcx + 8]
mov rcx, rbx
call rax
mov rcx, qword [rsi]
mov edx, eax
mov r8, qword [rcx + 0x78]
mov rcx, rsi
call r8
mov rsi, rax
test rax, rax
je 0x180002632
mov rax, qword [rbp + 0x60]
cmp rsi, rax
je 0x180002632
mov ecx, dword [rsi + 0x3e0]
cmp dword [rax + 0x3e0], ecx
jne 0x1800025ee
test ecx, ecx
jne 0x180002632
mov rax, qword [rsi]
mov rcx, rsi
mov rdx, qword [rax + 0xe0]
call rdx
cmp eax, 1
jl 0x180002632
mov rax, qword [rbp - 0x28]
mov r9, r12
mov rdx, qword [rbp + 0x60]
mov r8, rsi
mov rcx, qword [rbp + 0x48]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r13
call fcn.180001680
mov rsi, qword [rbp + 0x58]
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x30]
mov rbx, rax
test rax, rax
jne 0x180002599
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18000265c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0xf]
sub rsp, 0xb0
movdqa xmm0, xmmword [0x18009d600]
xor eax, eax
mov r11, rdx
mov byte [rbp + 9], al
movdqu xmmword [rbp - 0x11], xmm0
xor edx, edx
mov dword [rbp - 1], 0x3d3d3824
mov rbx, rcx
mov dword [rbp + 3], 0x3a37127c
mov word [rbp + 7], 0x703d
movsxd rcx, edx
lea eax, [rdx + 0x40]
inc edx
xor byte [rbp + rcx - 0x11], al
cmp edx, 0x1a
jb 0x18000269c
mov rax, qword [rbx]
lea rdx, [rbp - 0x21]
movsd xmm0, qword [r8]
mov rcx, rbx
mov byte [rbp + 9], 0
movsd qword [rbp - 0x31], xmm0
mov r10, qword [rax + 0x310]
mov eax, dword [r8 + 8]
lea r8, [rbp - 0x31]
movsd xmm0, qword [r11]
mov dword [rbp - 0x29], eax
mov eax, dword [r11 + 8]
mov dword [rbp - 0x19], eax
mov eax, dword [rbp + 0x7f]
mov dword [rsp + 0x68], eax
mov rax, qword [rbp + 0x77]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x58], rax
mov eax, dword [rbp + 0x6f]
mov dword [rsp + 0x50], eax
mov rax, qword [rbp + 0x67]
mov qword [rsp + 0x48], rax
mov eax, dword [rbp + 0x5f]
mov dword [rsp + 0x40], eax
mov rax, qword [rbp + 0x57]
mov qword [rsp + 0x38], rax
mov eax, dword [rbp + 0x4f]
mov dword [rsp + 0x30], eax
mov rax, qword [rbp + 0x47]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x3f]
mov dword [rsp + 0x20], eax
movsd qword [rbp - 0x21], xmm0
call r10
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rbp
ret
Function at 0x18000a608
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov rbx, r8
cmp byte [0x1800f616b], sil
mov rdi, r9
mov r8, rdx
je 0x18000a6fc
mov rax, qword [rdx]
mov rcx, r8
xor edx, edx
mov r10, qword [rax + 0x1d8]
call r10
test rax, rax
je 0x18000a6fc
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x18000a6fc
xor eax, eax
mov word [rsp + 0x20], 0x3530
mov byte [rsp + 0x22], al
mov r8d, esi
movsxd rdx, r8d
lea eax, [r8 + 0x40]
inc r8d
xor byte [rsp + rdx + 0x20], al
cmp r8d, 2
jb 0x18000a667
mov rax, qword [rcx]
mov byte [rsp + 0x22], sil
mov rdx, qword [rax + 0x60]
call rdx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.180070c68
test rax, rax
je 0x18000a6fc
cmp byte [0x1800f616c], sil
jne 0x18000a6fc
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000a6fc
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x30]
cmp eax, 0x32
ja 0x18000a6d2
movabs rcx, 0x600000003e068
bt rcx, rax
jb 0x18000a6fc
cmp byte [0x1800f6130], sil
jne 0x18000a6fc
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp qword [0x1800f5f60], rax
jne 0x18000a6fc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x58]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x60]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18000a70c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp byte [0x1800f616e], 0
mov r14, r9
mov rbx, r8
mov rdi, rdx
jne 0x18000a746
cmp byte [0x1800f616a], 0
je 0x18000a93e
mov rax, qword [rdx]
mov rcx, rdi
xor edx, edx
mov r9, qword [rax + 0x1d8]
call r9
test rax, rax
je 0x18000a93e
mov rsi, qword [rax + 0x10]
test rsi, rsi
je 0x18000a93e
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x198]
call rdx
test rax, rax
je 0x18000a93e
mov edx, dword [rax + 0x170]
test edx, edx
je 0x18000a93e
mov rax, qword [rbx]
mov rcx, rbx
mov r8, qword [rax + 0x78]
call r8
mov rbx, rax
test rax, rax
je 0x18000a93e
cmp rax, rdi
je 0x18000a93e
mov eax, dword [rax + 0x3e0]
cmp dword [rdi + 0x3e0], eax
jne 0x18000a7cd
test eax, eax
jne 0x18000a93e
mov rax, qword [rbx]
mov rcx, rbx
mov rdx, qword [rax + 0xe0]
call rdx
cmp eax, 1
jl 0x18000a93e
cmp byte [0x1800f616e], 0
je 0x18000a8a6
xor eax, eax
mov word [rbp - 0x30], 0x2f2b
mov byte [rbp - 0x2e], al
xor r8d, r8d
movsxd rdx, r8d
lea eax, [r8 + 0x40]
inc r8d
xor byte [rbp + rdx - 0x30], al
cmp r8d, 2
jb 0x18000a800
mov rax, qword [rsi]
mov rcx, rsi
mov byte [rbp - 0x2e], 0
mov rdx, qword [rax + 0x60]
call rdx
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.180070c68
test rax, rax
jne 0x18000a8a6
cmp byte [0x1800f616f], al
je 0x18000a85d
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x30]
cmp eax, 0x17
ja 0x18000a93e
mov ecx, 0xc38004
bt ecx, eax
jae 0x18000a93e
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x1800f5fa8]
movsxd rdx, dword [0x1800f6170]
cmp rax, rdx
ja 0x18000a87e
test edx, edx
jne 0x18000a93e
mov rbx, qword [rbp + 0x30]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + 0x58]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x1800f5fa8], rax
jmp 0x18000a93e
cmp byte [0x1800f616a], 0
je 0x18000a93e
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx]
mov rdx, qword [rax + 0xe0]
call rdx
mov rcx, qword [rdi + 0x10]
movsd xmm0, qword [rax]
mov ebx, dword [rax + 8]
mov rax, qword [rcx]
movsd qword [rbp - 0x10], xmm0
mov rdx, qword [rax + 0xe0]
call rdx
movd xmm1, ebx
movsd xmm0, qword [rax]
movss xmm2, dword [rax + 8]
movsd qword [rbp - 0x20], xmm0
subss xmm2, xmm1
movss xmm3, dword [rbp - 0x20]
movss xmm0, dword [rbp - 0x1c]
subss xmm0, dword [rbp - 0xc]
subss xmm3, dword [rbp - 0x10]
mulss xmm2, xmm2
mulss xmm0, xmm0
mulss xmm3, xmm3
addss xmm0, xmm3
addss xmm0, xmm2
call fcn.1800768ec
movss xmm1, dword [0x18009da60]
comiss xmm1, xmm0
jb 0x18000a93e
mov rcx, qword [rbp + 0x30]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x148]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x18000b8b8
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp byte [0x1800f616c], 0
mov rdi, r9
mov rbx, r8
je 0x18000b986
mov rax, qword [rsp + 0x60]
mov r8d, 0x52
mov rdx, qword [rax + 0x70]
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x18000b900
cmp word [rax + 0x1c], r8w
jge 0x18000b8fa
mov rax, qword [rax + 0x10]
jmp 0x18000b900
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x18000b8ed
cmp byte [rcx + 0x19], 0
jne 0x18000b92e
cmp r8w, word [rcx + 0x1c]
jl 0x18000b92e
cmp rcx, rdx
je 0x18000b92e
mov eax, dword [rsp + 0x24]
xor eax, 0x453b7000
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x20]
mov qword [rcx + 0x20], rax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000b986
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x30]
cmp eax, 0x32
ja 0x18000b95c
movabs rcx, 0x600000003e068
bt rcx, rax
jb 0x18000b986
cmp byte [0x1800f6130], 0
jne 0x18000b986
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp qword [0x1800f5f60], rax
jne 0x18000b986
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x58]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x60]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18000bc54
Capabilities:
Access peb ldr_data
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov byte [rcx + 0x48], 0
mov rbp, rdx
mov rsi, qword gs:[0x60]
mov rbx, rcx
test rsi, rsi
je 0x18000bd1b
mov rsi, qword [rsi + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
jmp 0x18000bcb5
mov rcx, qword [rdi + 0x50]
xor r8d, r8d
mov rdx, rbp
call fcn.18000bbf0
test rax, rax
je 0x18000bcb2
mov eax, dword [rdi + 0x30]
mov dword [rbx + 8], eax
mov rax, qword [rdi + 0x20]
mov qword [rbx], rax
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x18000bc91
mov r8, qword [rbx]
mov eax, 0x5a4d
mov qword [rbx + 0x10], r8
cmp word [r8], ax
jne 0x18000bd1b
movsxd rax, dword [r8 + 0x3c]
add rax, r8
mov qword [rbx + 0x18], rax
cmp dword [rax], 0x4550
jne 0x18000bd1b
mov ecx, dword [rax + 0x88]
mov dword [rbx + 0x20], ecx
mov eax, dword [rax + 0x8c]
mov dword [rbx + 0x24], eax
lea rdx, [r8 + rcx]
mov qword [rbx + 0x28], rdx
mov eax, dword [rdx + 0x1c]
add rax, r8
mov qword [rbx + 0x30], rax
mov eax, dword [rdx + 0x24]
add rax, r8
mov qword [rbx + 0x38], rax
mov eax, dword [rdx + 0x20]
add rax, r8
mov byte [rbx + 0x48], 1
mov qword [rbx + 0x40], rax
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18001f96c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x18001f99a
xor eax, eax
jmp 0x18001fa80
cmp qword [rcx + 0x68], 0
je 0x18001f9ab
call fcn.18001fa9c
jmp 0x18001fa80
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18001f9c2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18001f9c4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18001f9f6
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.180070ff0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x18001fa7a
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x18001fa2d
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x18001fa56
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.18007c170
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x18001fa7a
cmp rsi, rbx
ja 0x18001fa34
test rsi, rsi
je 0x18001fa7a
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.18007c170
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180027658
Capabilities:
Hash data with crc32

Disassembly:
mov rdx, rcx
xor r8d, r8d
mov rcx, qword [0x1800f6270]
mov rcx, qword [rcx + 0x3ed8]
jmp fcn.1800276a4

Function at 0x1800276a4
Capabilities:
Hash data with crc32

Disassembly:
movsxd r9, dword [rcx + 0xe8]
mov r10, r8
mov r8, qword [rcx + 0xf0]
mov r11, rdx
mov rax, r10
mov rcx, r11
sub rax, rdx
neg r10
mov r8d, dword [r8 + r9*4 - 4]
sbb rdx, rdx
and rdx, rax
jmp fcn.180028e3c

Function at 0x180028e04
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
not r8d
test rdx, rdx
je 0x180028e32
movzx eax, byte [r9]
inc r9
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x18009e7e0]
xor r8d, dword [rax + rcx*4]
sub rdx, 1
jne 0x180028e0f
not r8d
mov eax, r8d
ret

Function at 0x180028e3c
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x180028e96
mov r11b, 0x23
lea rdi, [0x18009e7e0]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x180028e80
cmp rdx, 2
jb 0x180028e80
cmp byte [r10], r11b
jne 0x180028e80
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x180028e5e
jmp 0x180028ed7
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x180028ed7
mov r11b, 0x23
lea rdi, [0x18009e7e0]
cmp dl, r11b
jne 0x180028ebb
cmp byte [r10], r11b
jne 0x180028ebb
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x180028ea9
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x18003e31c
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
mov r10, rdx
movzx r9d, cx
mov eax, 0x5e6ea9af
shr ecx, 0x10
mul r8d
mov r11d, r8d
mov ebx, r8d
shr edx, 0xb
imul eax, edx, 0x15b0
sub r11d, eax
test r8d, r8d
je 0x18003e415
xor edx, edx
cmp r11d, 7
jbe 0x18003e3c1
lea r8d, [rdx + 7]
movzx eax, byte [r10]
add edx, 8
add r9d, eax
add r8d, 8
movzx eax, byte [r10 + 1]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 7]
add ecx, r9d
add r9d, eax
add r10, 8
add ecx, r9d
cmp r8d, r11d
jb 0x18003e35a
cmp edx, r11d
jae 0x18003e3e0
mov eax, r11d
sub eax, edx
mov edx, eax
movzx eax, byte [r10]
inc r10
add r9d, eax
add ecx, r9d
sub rdx, 1
jne 0x18003e3cd
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
sub ebx, r11d
mov r11d, 0x15b0
jne 0x18003e34e
mov rbx, qword [rsp + 8]
shl ecx, 0x10
lea eax, [r9 + rcx]
ret
Function at 0x1800467f8
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret

Function at 0x180052fa0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, edx
lea r8, str.SCROLLX
test eax, eax
lea rdx, str.SCROLLY
cmove rdx, r8
xor r8d, r8d
jmp fcn.1800276a4
Function at 0x18005ace0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x1800f618c], 0
mov rbx, r8
je 0x18005ad90
mov rax, qword [rdx]
mov rcx, rdx
mov r9, qword [rax + 0x18]
call r9
mov r9, rax
test rax, rax
je 0x18005ad90
movdqa xmm0, xmmword [str._t_41_51]
xor r8d, r8d
movdqu xmmword [rsp + 0x30], xmm0
movsxd rdx, r8d
lea ecx, [r8 + 0x40]
inc r8d
xor byte [rsp + rdx + 0x30], cl
cmp r8d, 0xf
jb 0x18005ad20
mov rax, qword [rax]
mov rcx, r9
mov byte [rsp + 0x3f], 0
mov rdx, qword [rax + 0x10]
call rdx
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180070c68
test rax, rax
je 0x18005ad90
or dword [rbx + 0x24], 0x80018
mov rcx, rbx
movss xmm0, dword [0x1800ba2f4]
mov rax, qword [rbx]
movss xmm3, dword [0x1800ba2f0]
movss xmm2, dword [0x1800ba2ec]
movss xmm1, dword [0x1800ba2e8]
movss dword [rsp + 0x20], xmm0
call qword [rax + 0x160]
add rsp, 0x40
pop rbx
ret
Function at 0x1800677d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
cmp byte [0x1800f61a0], 0
mov r14, r9
mov rdi, r8
mov rbx, rdx
je 0x180067928
mov rax, qword [rdx]
mov rcx, rdx
mov r10, qword [rax + 0xe0]
call r10
cmp eax, 1
jl 0x180067928
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
mov r8, qword [rax + 0x1d8]
call r8
mov rbx, rax
test rax, rax
je 0x180067928
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x180067928
xor eax, eax
mov word [rsp + 0x20], 0xcdce
mov byte [rsp + 0x22], al
xor r8d, r8d
movsxd rdx, r8d
lea eax, [r8 - 0x56]
inc r8d
xor byte [rsp + rdx + 0x20], al
cmp r8d, 2
jb 0x180067853
mov rax, qword [rcx]
mov byte [rsp + 0x22], 0
mov rdx, qword [rax + 0x60]
call rdx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.180070c68
test rax, rax
jne 0x180067928
lea rax, [rbx + 0x28]
test rax, rax
je 0x180067928
mov rsi, qword [rax + 8]
test rsi, rsi
je 0x180067928
mov rax, qword [rdi]
mov rcx, rdi
mov rdx, qword [rax + 0xa8]
call rdx
mov rdi, rax
test rax, rax
je 0x180067928
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x30]
jmp 0x180067920
mov rcx, qword [rbx]
mov rdx, qword [rcx + 0x178]
mov rcx, rbx
call rdx
test al, al
jne 0x180067917
mov rcx, qword [rbx]
mov rax, qword [rcx + 8]
mov rcx, rbx
call rax
mov rcx, qword [r14]
mov edx, eax
mov r8, qword [rcx + 0x78]
mov rcx, r14
call r8
mov rbp, rax
test rax, rax
je 0x180067917
mov ebx, 0x1a
mov edx, dword [rbp + 0x20]
xor r8d, r8d
mov rcx, rsi
call qword [0x1800f6128]
sub rbx, 1
jne 0x180067902
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x30]
mov rbx, rax
test rax, rax
jne 0x1800678c7
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x180067944
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r8, qword [0x1800f62e8]
mov rbx, rdx
mov rsi, rcx
test r8, r8
jne 0x180067b1d
mov rax, qword gs:[0x60]
xor ebp, ebp
mov r12d, 0x23ba233e
mov r8, qword [rax + 0x18]
mov rax, qword [r8 + 0x10]
mov rax, qword [rax]
mov qword [rsp + 0x70], rax
mov r8, rax
mov eax, dword [r8 + 0x58]
sub ax, 8
test ebp, ebp
je 0x1800679e7
mov r9, qword [r8 + 0x60]
mov r10d, 0xa3d244d6
movzx eax, ax
shr rax, 1
lea r11, [r9 + rax*2]
jmp 0x1800679d9
movsx eax, byte [r9]
mov ecx, eax
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
add r9, 2
cmp r9, r11
jne 0x1800679b9
cmp r10d, ebp
jne 0x180067af6
mov r9, qword [r8 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rax, qword [rax + r9 + 0x88]
mov r10d, eax
add r10, r9
shr rax, 0x20
cmp r10, r9
je 0x180067af6
mov ebx, dword [r10 + 0x18]
test ebx, ebx
je 0x180067af6
mov r13d, dword [r10 + 0x20]
dec ebx
mov r14d, 0xa3d244d6
lea rcx, [rbx*4]
add rcx, r13
mov r11d, dword [rcx + r9]
add r11, r9
jmp 0x180067a54
movsx ecx, dil
sub dil, 0x41
mov edx, ecx
or edx, 0x20
cmp dil, 0x19
cmova edx, ecx
xor edx, r14d
imul r14d, edx, 0x1000193
mov dil, byte [r11]
inc r11
test dil, dil
jne 0x180067a36
cmp r14d, r12d
je 0x180067a6d
test ebx, ebx
jne 0x180067a1a
jmp 0x180067af6
mov edx, dword [r10 + 0x24]
add rdx, r9
movzx r8d, word [rdx + rbx*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov r8d, dword [rdx + r8*4]
add r8, r9
cmp r8, r10
jbe 0x180067b11
lea rcx, [rax + r10]
cmp r8, rcx
jae 0x180067b11
mov ebp, 0xa3d244d6
mov r12d, ebp
jmp 0x180067abf
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, ebp
imul ebp, ecx, 0x1000193
inc r8
mov dl, byte [r8]
cmp dl, 0x2e
jne 0x180067aa3
jmp 0x180067ae4
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r12d
imul r12d, ecx, 0x1000193
inc r8
mov dl, byte [r8]
test dl, dl
jne 0x180067ac9
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
mov rax, qword [r8]
mov r8, rax
cmp rax, qword [rsp + 0x70]
je 0x180067b0e
cmp qword [rax + 0x30], 0
jne 0x180067997
xor r8d, r8d
mov rbx, qword [rsp + 0x68]
mov qword [0x1800f62e8], r8
mov ecx, dword [0x1800f61b8]
call r8
test al, 1
je 0x180067b3c
cmp byte [0x1800f61b4], 0
sete al
mov byte [0x1800f61b4], al
jmp 0x180067b42
mov al, byte [0x1800f61b4]
test al, al
je 0x180067b6a
cmp byte [0x1800f61af], 0
je 0x180067b56
mov byte [0x1800f61af], 0
mov rax, qword [rbx + 0xd88]
mov dword [rax + 8], 0xc13a147b
mov byte [rsi + 0xc], 0
jmp 0x180067b82
cmp byte [rsi + 0xc], 0
jne 0x180067b82
mov rax, qword [rbx + 0xd88]
mov dword [rax + 8], 0x3fd0a3d7
mov byte [rsi + 0xc], 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret