joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401d7df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x20
mov edi, dword [rcx + 0x2c]
mov rbx, rcx
mov qword [rsp + 0x30], r14
mov esi, dword [rbx + 0x40]
lea r8, [rbx + 0x38]
mov edx, dword [rbx + 0x88]
sub esi, edx
mov eax, dword [rbx + 0x90]
sub esi, eax
jne 0x1401d7e3c
test edx, edx
jne 0x1401d7e4b
lea r8, [rbx + 0x38]
test eax, eax
jne 0x1401d7e4b
mov esi, edi
jmp 0x1401d7ee3
cmp esi, 0xffffffff
jne 0x1401d7e4b
mov esi, 0xfffffffe
jmp 0x1401d7ee3
lea ecx, [rdi - 0x106]
add ecx, dword [rbx + 0x2c]
cmp edx, ecx
jb 0x1401d7ee3
mov rcx, qword [r8]
mov r8, rdi
lea rdx, [rdi + rcx]
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rbx + 0x68]
mov rax, qword [rbx + 0x58]
sub dword [rbx + 0x8c], edi
sub dword [rbx + 0x88], edi
sub dword [rbx + 0x78], edi
lea rdx, [rax + r8*2]
nop word [rax + rax]
movzx ecx, word [rdx - 2]
lea rdx, [rdx - 2]
sub cx, di
movzx eax, cx
not ax
sar ax, 0xf
and ax, cx
mov word [rdx], ax
add r8d, 0xffffffff
jne 0x1401d7e90
mov rax, qword [rbx + 0x48]
mov r8d, edi
lea rax, [rax + rdi*2]
nop dword [rax]
movzx edx, word [rax - 2]
lea rax, [rax - 2]
sub dx, di
movzx ecx, dx
not cx
sar cx, 0xf
and cx, dx
mov word [rax], cx
add r8d, 0xffffffff
jne 0x1401d7ec0
add esi, edi
mov rcx, qword [rbx + 8]
call fcn.140069520
test eax, eax
je 0x1401d7f6a
mov edx, dword [rbx + 0x90]
mov r8d, esi
mov eax, dword [rbx + 0x88]
mov rcx, qword [rbx + 8]
add rdx, rax
add rdx, qword [rbx + 0x38]
call fcn.1401d6620
mov r9d, dword [rbx + 0x90]
add r9d, eax
mov dword [rbx + 0x90], r9d
cmp r9d, 3
jb 0x1401d7f50
mov eax, dword [rbx + 0x88]
mov rdx, qword [rbx + 0x38]
mov ecx, dword [rbx + 0x74]
movzx r8d, byte [rax + rdx]
mov dword [rbx + 0x64], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rbx + 0x70]
mov dword [rbx + 0x64], r8d
cmp r9d, 0x106
jae 0x1401d7f6a
mov rcx, qword [rbx + 8]
call fcn.140069520
test eax, eax
jne 0x1401d7e10
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x1401db6ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401db6f6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401db6f6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401db6f6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401db6f6
cmp dword [rcx + 0x84], 0xe
jbe 0x1401db6f6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401db6f8
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rsi
push rdi
sub rsp, 0x458
lea rcx, [0x140002230]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.CreateThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x50], rax
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.VirtualAlloc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
lea rcx, [0x140002298]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.WaitForSingleObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlMoveMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
lea rcx, [0x1400022f0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x3e7
rep movsb byte [rdi], byte [rsi]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x3e7
xor ecx, ecx
call qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov r8d, 0x3e7
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
call qword [rsp + 0x48]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x30]
xor edx, edx
xor ecx, ecx
call qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x38]
call qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x458
pop rdi
pop rsi
ret

Function at 0x140001854
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000189e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000189e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000189e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000189e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000189e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400018a0
xor al, al
add rsp, 0x28
ret
Function at 0x18000ed40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x18000ed63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x70]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x18000ed50
mov byte [rcx + 7], 0
mov rax, rcx
ret

Function at 0x18000ed90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x18000edb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x70]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x18000eda0
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x18000edc0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, rdx
call fcn.18003ed80
mov rcx, rdi
mov rbx, rax
call fcn.18003ed80
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x3df
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x18000ee90
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, Ordinal_301
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0x130
cmp rdi, 0xffffffffffffffff
je 0x18000ef52
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x18000ef52
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x18000ef49
cmp qword [rbx + 0x18], 0x10
mov r8, rbx
jb 0x18000ef11
mov r8, qword [rbx]
lea rax, [rsp + 0x4c]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x18000ef33
inc rax
test ecx, ecx
jne 0x18000ef20
mov rcx, rdi
test edx, edx
je 0x18000ef7d
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x18000ef04
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.180040a10
xor al, al
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180112970
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x28], 0
je 0x18000ef52
mov rcx, rbx
call fcn.180040a10
mov al, 1
jmp 0x18000ef5c
Function at 0x180010320
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
je 0x180010343
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x70]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1d
jb 0x180010330
mov byte [rcx + 0x1e], 0
mov rax, rcx
ret

Function at 0x180010350
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x180010373
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x70]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x180010360
mov byte [rcx + 6], 0
mov rax, rcx
ret

Function at 0x1800126d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rsi, qword [0x1801847c8]
mov r15, qword [0x1801847d0]
cmp rsi, r15
je 0x1800128a1
xor r13d, r13d
movzx ebx, byte [rbp + 0x67]
movss xmm7, dword [0x180137c00]
movzx edi, byte [rbp + 0x67]
nop
movsd xmm6, qword [rsi + 0x50]
movss xmm0, dword [0x180180804]
cvtps2pd xmm0, xmm0
comisd xmm6, xmm0
jae 0x180012894
lea rcx, [0x1801805a0]
call fcn.180063310
mov r12d, eax
mov dword [rbp + 0x6f], 0xcffcb0
mov byte [rbp + 0x73], 1
mov rdx, r13
nop word [rax + rax]
lea ecx, [rdx - 0x70]
xor byte [rbp + rdx + 0x6f], cl
inc rdx
cmp rdx, 3
jb 0x180012760
mov byte [rbp + 0x73], 0
cvttsd2si edx, xmm6
lea rcx, [rbp - 0x19]
call fcn.18000eac0
mov r14, rax
mov dword [rbp + 0x67], 0x100cab0
mov rdx, r13
nop
lea ecx, [rdx - 0x70]
xor byte [rbp + rdx + 0x67], cl
inc rdx
cmp rdx, 2
jb 0x180012790
mov byte [rbp + 0x6a], 0
mov rdx, qword [rsi + 0x10]
lea rax, [rbp + 0x67]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x1800127b3
movabs rax, 0x7fffffffffffffff
sub rax, rdx
cmp rax, rcx
jb 0x1800128c6
mov r9, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x1800127df
mov r9, qword [rsi]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov r8, rsi
movzx edx, bl
lea rcx, [rbp - 0x39]
call fcn.180051e30
nop
mov r9, r14
lea r8, [rbp - 0x39]
movzx edx, dil
lea rcx, [rbp - 0x59]
call fcn.180051c40
nop
lea rax, [rbp + 0x6f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180012822
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x59]
call fcn.18003ed90
mov qword [rbp - 0x79], r13
mov qword [rbp - 0x69], r13
mov qword [rbp - 0x61], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x79], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x69], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rsi + 0x48]
mov r9d, r12d
movaps xmm2, xmm7
lea rcx, [rbp - 0x79]
call fcn.180010fa0
nop
lea rcx, [rbp - 0x59]
call fcn.180040a10
nop
lea rcx, [rbp - 0x39]
call fcn.180040a10
nop
lea rcx, [rbp - 0x19]
call fcn.180040a10
add rsi, 0x58
cmp rsi, r15
jne 0x180012720
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x58]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18000c960
nop
int3
Function at 0x1800128d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x1800128f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x70]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x1800128e0
mov byte [rcx + 3], 0
mov rax, rcx
ret

Function at 0x180012900
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x180012923
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x70]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x180012910
mov byte [rcx + 4], 0
mov rax, rcx
ret
Function at 0x180013f00
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0xe8
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp byte [0x180180830], 0
je 0x1800140ff
mov edx, dword [0x18018085c]
lea rcx, [rsp + 0x50]
mov qword [r11 - 8], rdi
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x38], xmm8
movaps xmmword [r11 - 0x48], xmm9
call fcn.1800136f0
movups xmm8, xmmword [rax]
movsd xmm9, qword [rax + 0x20]
movups xmm6, xmmword [rax + 0x10]
movdqa xmm0, xmm8
movsd qword [rsp + 0x40], xmm9
psrldq xmm0, 8
movq rdi, xmm0
test rdi, rdi
je 0x1800140dd
movss xmm0, dword [0x18018083c]
comiss xmm0, dword [rsp + 0x40]
jb 0x1800140dd
movss xmm1, dword [0x180180854]
movaps xmm0, xmm6
cvtps2pd xmm1, xmm1
unpckhpd xmm0, xmm6
comisd xmm1, xmm0
jb 0x1800140dd
mov ecx, dword [reloc.WS2_32.dll_bind]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x1800140dd
mov qword [rsp + 0xf8], rsi
movd esi, xmm6
test esi, esi
je 0x1800140d5
mov qword [rsp + 0xf0], rbx
lea rdx, [rsp + 0x80]
movd ebx, xmm8
mov rcx, rdi
movaps xmmword [rsp + 0xc0], xmm7
mov r8d, ebx
call qword [0x180184720]
movaps xmm1, xmmword [rsp + 0x80]
movss dword [rsp + 0x80], xmm1
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x55
shufps xmm1, xmm1, 0xaa
movss dword [rsp + 0x88], xmm1
movss dword [rsp + 0x84], xmm0
cmp ebx, 0x1233
jne 0x180014042
movsd xmm7, qword [rdi + 0x90]
mov ebx, dword [rdi + 0x98]
jmp 0x180014052
mov ebx, dword [rsp + 0x88]
movsd xmm7, qword [rsp + 0x80]
cmp byte [0x180184595], 0
je 0x18001407c
lea rcx, [rsp + 0x80]
movsd qword [rsp + 0x80], xmm7
mov dword [rsp + 0x88], ebx
call fcn.180010a20
test al, al
jne 0x1800140c5
mov edx, esi
movabs rcx, 0x7239b21a38f536ba
call fcn.180043d50
test eax, eax
je 0x1800140c5
lea rdx, [rsp + 0x80]
movsd qword [rsp + 0x80], xmm7
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x88], ebx
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x30], xmm6
movsd qword [rsp + 0x40], xmm9
call fcn.180013980
movaps xmm7, xmmword [rsp + 0xc0]
mov rbx, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0xf8]
mov rdi, qword [rsp + 0xe0]
movaps xmm6, xmmword [rsp + 0xd0]
movaps xmm8, xmmword [rsp + 0xb0]
movaps xmm9, xmmword [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180112970
add rsp, 0xe8
ret
Function at 0x180014120
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rbp - 9], rax
cmp byte [0x180180af0], 0
mov rsi, rdx
mov r14, rcx
je 0x180014368
mov rax, qword [0x180184728]
movss xmm0, dword [rcx + 8]
movss xmm1, dword [rcx]
movss xmm2, dword [rcx + 4]
subss xmm2, dword [rax + 0x94]
subss xmm0, dword [rax + 0x98]
subss xmm1, dword [rax + 0x90]
mulss xmm2, xmm2
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm2, xmm1
addss xmm2, xmm0
xorps xmm0, xmm0
ucomiss xmm0, xmm2
ja 0x1800141a4
xorps xmm0, xmm0
sqrtss xmm0, xmm2
jmp 0x1800141ac
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movss xmm1, dword [0x180137b70]
comiss xmm1, xmm0
jbe 0x180014368
mov edx, dword [0x180180b00]
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x108], rdi
call fcn.1800136f0
movups xmm2, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movsd xmm1, qword [rax + 0x20]
movups xmmword [rbp - 0x69], xmm2
psrldq xmm2, 8
movq rdi, xmm2
movsd qword [rbp - 0x49], xmm1
movups xmmword [rbp - 0x59], xmm0
test rdi, rdi
je 0x180014360
movss xmm0, dword [0x180180af4]
comiss xmm0, dword [rbp - 0x49]
jb 0x180014360
movss xmm0, dword [0x180180afc]
cvtps2pd xmm0, xmm0
comisd xmm0, xmmword [rbp - 0x51]
jb 0x180014360
mov ecx, dword [reloc.WS2_32.dll_bind]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x180014360
mov r8d, dword [rbp - 0x69]
lea rdx, [rbp - 0x19]
mov qword [rsp + 0x100], rbx
mov rcx, rdi
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm7
movaps xmmword [rsp + 0xa0], xmm8
movaps xmmword [rsp + 0x90], xmm9
call qword [0x180184720]
cmp dword [rbp - 0x69], 0x1233
movaps xmm8, xmmword [rbp - 0x19]
movaps xmm9, xmm8
movss dword [rbp - 0x19], xmm8
movaps xmm7, xmm8
shufps xmm9, xmm8, 0x55
shufps xmm7, xmm8, 0xaa
movss dword [rbp - 0x15], xmm9
movss dword [rbp - 0x11], xmm7
jne 0x1800142d9
movsd xmm6, qword [rdi + 0x90]
mov ebx, dword [rdi + 0x98]
movaps xmm0, xmm6
shufps xmm0, xmm0, 0x55
mov dword [rbp - 0x11], ebx
movaps xmm9, xmm0
movss xmm7, dword [rbp - 0x11]
movsd qword [rbp - 0x19], xmm6
movss xmm8, dword [rbp - 0x19]
jmp 0x1800142e1
mov ebx, dword [rbp - 0x11]
movsd xmm6, qword [rbp - 0x19]
cmp byte [0x180184595], 0
je 0x180014305
cmp byte [rbp - 0x45], 0
jne 0x180014305
lea rcx, [rbp - 0x19]
movsd qword [rbp - 0x19], xmm6
mov dword [rbp - 0x11], ebx
call fcn.180010a20
test al, al
jne 0x180014336
cmp byte [0x180180af8], 0
je 0x18001432f
addss xmm7, dword [0x180137abc]
movaps xmm0, xmm8
unpcklps xmm0, xmm9
movsd qword [r14], xmm0
movss dword [rbp - 0x11], xmm7
mov eax, dword [rbp - 0x11]
mov dword [r14 + 8], eax
movsd qword [rsi], xmm6
mov dword [rsi + 8], ebx
movaps xmm8, xmmword [rsp + 0xa0]
movaps xmm7, xmmword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0xc0]
mov rbx, qword [rsp + 0x100]
movaps xmm9, xmmword [rsp + 0x90]
mov rdi, qword [rsp + 0x108]
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.180112970
add rsp, 0xd0
pop r14
pop rsi
pop rbp
ret
Function at 0x180014380
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp byte [0x180180868], 0
je 0x18001459b
mov edx, dword [0x180180878]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0xa0], rbx
call fcn.1800136f0
movups xmm2, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movsd xmm1, qword [rax + 0x20]
movups xmmword [rsp + 0x30], xmm2
psrldq xmm2, 8
movq rbx, xmm2
movsd qword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x40], xmm0
test rbx, rbx
je 0x180014593
movss xmm0, dword [0x180180870]
cvtps2pd xmm0, xmm0
comisd xmm0, xmmword [rsp + 0x48]
jb 0x180014593
cmp qword [0x180185e10], rbx
je 0x18001441e
mov qword [0x180185e10], rbx
mov dword [0x180185e24], 0
mov ecx, dword [0x180184574]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x180185fb4], ecx
jle 0x18001446f
lea rcx, [0x180185fb4]
call fcn.180112b18
cmp dword [0x180185fb4], 0xffffffff
jne 0x18001446f
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea rcx, [0x180185fb4]
mov qword [0x180185f90], rax
call fcn.180112ab8
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x180185f90]
movsxd rcx, dword [0x180185e24]
cmp rax, rcx
jb 0x180014593
mov ecx, dword [reloc.WS2_32.dll_bind]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x180014586
cmp byte [0x180184595], 0
je 0x18001450a
cmp byte [rsp + 0x54], 0
jne 0x18001450a
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [0x180184720]
movaps xmm1, xmmword [rsp + 0x80]
lea rcx, [rsp + 0x20]
movaps xmm2, xmm1
movaps xmm0, xmm1
shufps xmm0, xmm1, 0xaa
shufps xmm2, xmm1, 0x55
movss dword [rsp + 0x88], xmm0
mov eax, dword [rsp + 0x88]
unpcklps xmm1, xmm2
movsd qword [rsp + 0x20], xmm1
mov dword [rsp + 0x28], eax
call fcn.180010a20
test al, al
jne 0x180014586
cmp byte [0x18018086a], 0
jne 0x180014544
movss xmm0, dword [0x18018086c]
comiss xmm0, dword [rsp + 0x50]
jb 0x180014586
movss xmm3, dword [0x180137b14]
call fcn.180045270
cmp byte [0x18018086a], 0
mov eax, dword [0x180180874]
mov dword [0x180185e24], eax
je 0x180014586
movabs rcx, 0x4f8644af03d0e0d6
call fcn.180043b30
mov r8d, dword [rsp + 0x40]
mov edx, eax
movabs rcx, 0x3c06b5c839b38f7b
call fcn.180043a30
test eax, eax
je 0x180014586
movss xmm3, dword [0x180137b14]
call fcn.180045270
mov eax, dword [0x180180874]
mov dword [0x180185e24], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x180185f90], rax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180112970
add rsp, 0xa8
ret
Function at 0x1800182e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
mov rdi, rdx
mov ecx, 3
call fcn.1800bd620
call fcn.1800bd350
xor ebx, ebx
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsi], rbx
mov rbp, rax
mov qword [rsi + 0x10], rbx
mov r8, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180018322
mov r8, qword [rdi]
mov edx, 0x2712
mov rcx, rbp
call fcn.1800c01f0
xor r8d, r8d
mov rcx, rbp
lea edx, [r8 + 0x40]
call fcn.1800c01f0
movdqa xmm0, xmmword [0x180139c80]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x100
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx - 0x70]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x10
jb 0x180018360
lea r8, [rsp + 0x20]
mov byte [rsp + 0x31], 0
mov edx, 0x2722
mov rcx, rbp
call fcn.1800c01f0
lea r8, [0x1800182b0]
mov edx, 0x4e2b
mov rcx, rbp
call fcn.1800c01f0
mov r8, rsi
mov edx, 0x2711
mov rcx, rbp
call fcn.1800c01f0
mov rcx, rbp
call fcn.1800bd430
mov rcx, rbp
call fcn.1800bd330
call fcn.1800bd5c0
mov rcx, rdi
call fcn.180040a10
mov rbx, qword [rsp + 0x70]
mov rax, rsi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800183e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x180018403
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x70]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x1800183f0
mov byte [rcx + 0x11], 0
mov rax, rcx
ret
Function at 0x18001a820
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r15, rdx
mov rsi, rcx
mov qword [rbp + 0x17], rcx
xor ebx, ebx
mov dword [rbp - 0x49], ebx
mov qword [rcx], rbx
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], bl
mov dword [rbp - 0x49], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1f], xmm0
mov qword [rbp + 0x2f], rbx
mov edx, 0x100
call fcn.180051a30
mov qword [rbp + 0x1f], rax
lea rdi, [rax + 0x400]
mov qword [rbp + 0x2f], rdi
movdqa xmm0, xmmword [0x18013a6a0]
lea ecx, [rbx + 8]
nop word [rax + rax]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmmword [rax - 0x10], xmm0
sub rcx, 1
jne 0x18001a8b0
mov qword [rbp + 0x27], rdi
mov edx, ebx
lea r8, [rbp - 0x39]
nop word [rax + rax]
movdqa xmm0, xmmword [0x1801393c0]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x1801390e0]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x1801390d0]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x180139a80]
movdqa xmmword [rbp - 9], xmm1
mov word [rbp + 7], 0x100
mov rax, rbx
nop dword [rax]
lea ecx, [rax - 0x70]
xor byte [rbp + rax - 0x39], cl
inc rax
cmp rax, 0x40
jb 0x18001a930
mov byte [rbp + 8], 0
movsx rcx, byte [r8]
mov rax, qword [rbp + 0x1f]
mov dword [rax + rcx*4], edx
inc edx
inc r8
cmp edx, 0x40
jl 0x18001a8f0
mov edi, 0xfffffff8
mov rcx, r15
cmp qword [r15 + 0x18], 0x10
jb 0x18001a970
mov rcx, qword [r15]
mov rdx, rcx
jmp 0x18001a973
mov rdx, r15
mov r14, rcx
mov r15, qword [r15 + 0x10]
add r15, rdx
cmp rcx, r15
mov rcx, qword [rbp + 0x1f]
je 0x18001a9f9
nop word [rax + rax]
movzx eax, byte [r14]
mov edx, dword [rcx + rax*4]
cmp edx, 0xffffffff
je 0x18001a9f9
shl ebx, 6
add ebx, edx
add edi, 6
js 0x18001a9f1
mov edx, ebx
mov ecx, edi
sar edx, cl
mov rcx, qword [rsi + 0x10]
mov r8, qword [rsi + 0x18]
cmp rcx, r8
jae 0x18001a9d7
lea rax, [rcx + 1]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp r8, 0x10
jb 0x18001a9cd
mov rax, qword [rsi]
mov byte [rax + rcx], dl
mov byte [rax + rcx + 1], 0
jmp 0x18001a9ea
movzx r9d, dl
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rsi
call fcn.18004d950
sub edi, 8
mov rcx, qword [rbp + 0x1f]
inc r14
cmp r14, r15
jne 0x18001a990
test rcx, rcx
je 0x18001aa36
mov rdx, qword [rbp + 0x2f]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001aa31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001aa31
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1801130d0
mov rax, rsi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.180112970
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18001cf70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x18001cf93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x70]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x18001cf80
mov byte [rcx + 0xb], 0
mov rax, rcx
ret

Function at 0x18001cfa0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x18001cfc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x70]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x18001cfb0
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x18001cfd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x18001cff3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x70]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x18001cfe0
mov byte [rcx + 0x10], 0
mov rax, rcx
ret

Function at 0x18001d000
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x18001d023
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x70]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x18001d010
mov byte [rcx + 9], 0
mov rax, rcx
ret