joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180027e30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
lea rsi, [0x1800bf2a0]
mov qword [rsp + 0x70], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x180027e6d
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800bf2ec], 0x7fffffff
jne 0x180027e8f
mov dword [0x1800bf2ec], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180027ea0
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180027ed3
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180027ec0
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.18001b710
cmp qword [rax + 8], 0
je 0x180027efe
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x180027f2f
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180027f0b
mov rdx, qword [rdi]
mov rcx, qword [0x1800c3308]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x180027f75
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
mov rcx, r14
call rdx
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, ebx
jmp 0x180027f7e
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x180027f90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
lea rsi, [0x1800bf1e0]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x180027fd6
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800bf22c], 0x7fffffff
jne 0x180027ff8
mov dword [0x1800bf22c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180028009
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180028043
movabs r10, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180028030
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.18001b710
cmp qword [rax + 8], 0
je 0x18002806e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18002809f
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x18002807b
mov rdx, qword [rdi]
mov rcx, qword [0x1800c3308]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x1800280eb
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov edx, r14d
mov rcx, r15
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x1800280f4
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180028110
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
lea rsi, [0x1800bf190]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x180028156
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800bf1dc], 0x7fffffff
jne 0x180028178
mov dword [0x1800bf1dc], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180028189
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x1800281c3
movabs r10, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1800281b0
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.18001b710
cmp qword [rax + 8], 0
je 0x1800281ee
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18002821f
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1800281fb
mov rdx, qword [rdi]
mov rcx, qword [0x1800c3308]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18002826b
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x180028274
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180028290
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
lea rsi, [0x1800bf2f0]
mov qword [rsp + 0x70], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x1800282cd
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800bf33c], 0x7fffffff
jne 0x1800282ef
mov dword [0x1800bf33c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180028300
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180028333
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180028320
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.18001b710
cmp qword [rax + 8], 0
je 0x18002835e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18002838f
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x18002836b
mov rdx, qword [rdi]
mov rcx, qword [0x1800c3308]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x1800283d5
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
mov rcx, r14
call rdx
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, ebx
jmp 0x1800283de
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1800283f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
lea rsi, [0x1800bf430]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x180028436
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800bf47c], 0x7fffffff
jne 0x180028458
mov dword [0x1800bf47c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180028469
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x1800284a3
movabs r10, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180028490
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.18001b710
cmp qword [rax + 8], 0
je 0x1800284ce
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x1800284ff
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1800284db
mov rdx, qword [rdi]
mov rcx, qword [0x1800c3308]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x180028549
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, ebx
jmp 0x180028552
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180028570
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
lea rsi, [0x1800bf340]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x1800285b6
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800bf38c], 0x7fffffff
jne 0x1800285d8
mov dword [0x1800bf38c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1800285e9
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180028623
movabs r10, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180028610
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.18001b710
cmp qword [rax + 8], 0
je 0x18002864e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18002867f
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x18002865b
mov rdx, qword [rdi]
mov rcx, qword [0x1800c3308]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x1800286cb
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov edx, r14d
mov rcx, r15
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x1800286d4
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1800286f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
lea rsi, [0x1800bf0f0]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x180028736
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800bf13c], 0x7fffffff
jne 0x180028758
mov dword [0x1800bf13c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180028769
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x1800287a3
movabs r10, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180028790
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.18001b710
cmp qword [rax + 8], 0
je 0x1800287ce
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x1800287ff
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1800287db
mov rdx, qword [rdi]
mov rcx, qword [0x1800c3308]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x180028846
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001b0f0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
nop
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
jmp 0x18002884f
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18002f990
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x1800c2024]
mov rax, qword gs:[0x58]
mov rdi, qword [rdx]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1800c3620], ecx
jle 0x18002f9f2
lea rcx, [0x1800c3620]
call fcn.180080ef8
cmp dword [0x1800c3620], 0xffffffff
jne 0x18002f9f2
lea rcx, [0x180085040]
call fcn.180080e38
lea rcx, [0x1800c3620]
call fcn.180080e8c
mov rax, qword [0x1800c2180]
xor esi, esi
test rax, rax
je 0x18002fa09
mov rcx, qword [rax + 0xa0]
jmp 0x18002fa0c
mov rcx, rsi
cmp qword [rcx + 0x48], rsi
jne 0x18002fa17
call fcn.1800316a0
call fcn.180033050
call fcn.18003b900
call fcn.18002f590
cmp byte [0x1800bf5e8], sil
je 0x18002fa3b
lea rcx, [0x1800bf5d0]
call fcn.180029d90
xor edx, edx
lea rcx, str.UnityWndClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rbx
jne 0x18002fa75
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x18002fa75
cmp byte [0x1800bf5e8], sil
sete byte [0x1800bf5e8]
call fcn.18003dc30
call fcn.18003e040
mov rax, qword [rdi]
lea r8, [0x1800c2178]
xor r9d, r9d
mov edx, 1
mov rcx, rdi
call qword [rax + pe_nt_image_headers64]
mov rax, qword [0x1800c2180]
mov rcx, qword [rax + 0x4210]
mov rcx, qword [rcx]
add rcx, 0xa8
cmp byte [rcx], sil
cmove rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.180030c30
Function at 0x1800302d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1330]
mov eax, 0x1430
call fcn.180081d30
sub rsp, rax
mov rax, qword [0x1800bf040]
xor rax, rsp
mov qword [rbp + 0x1320], rax
mov rdi, rcx
mov qword [rsp + 0x70], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
movdqa xmm1, xmmword [0x1800ad5e0]
movdqu xmmword [rsp + 0x28], xmm1
movdqa xmm0, xmmword [0x1800ad640]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x1800ad6c0]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0x7a797877
mov dword [rsp + 0x5c], 0x33323130
mov dword [rsp + 0x60], 0x37363534
mov word [rsp + 0x64], 0x3938
lea rsi, [rsp + 0x28]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r14
mov ecx, 0x3e
call fcn.180080a68
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
lea rbx, [rax + 0x3e]
mov qword [rbp - 0x78], rbx
mov r8d, 0x3e
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x80], rbx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rbp + 0x1314], 0xffffffff
mov dword [rbp - 0x6c], eax
mov ecx, 1
nop dword [rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rbp + rcx*4 - 0x6c], edx
inc rcx
cmp rcx, 0x270
jb 0x1800303c0
mov dword [rbp - 0x70], 0x270
mov rsi, qword [rbp - 0x80]
sub rsi, qword [rsp + 0x78]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
mov r14d, 0xa
lea rax, [rbp - 0x70]
mov qword [rsp + 0x68], rax
test rsi, rsi
jne 0x18003043f
lea rcx, [rbp - 0x70]
call fcn.180030860
mov ebx, eax
shl rbx, 0x20
lea rcx, [rbp - 0x70]
call fcn.180030860
mov eax, eax
or rbx, rax
jmp 0x18003044f
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.180030670
mov rbx, rax
mov rax, qword [rsp + 0x78]
movzx r9d, byte [rax + rbx]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180030485
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x18003047a
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x18003048d
mov rcx, rdi
call fcn.1800028e0
sub r14, 1
jne 0x180030412
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1800304d5
mov rdx, qword [rbp - 0x78]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800304d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800304d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180080a60
mov rax, rdi
mov rcx, qword [rbp + 0x1320]
xor rcx, rsp
call fcn.180080a40
lea r11, [rsp + 0x1430]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180030860
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1800308c1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x180030880
mov ecx, dword [r9]
jmp 0x1800309ab
cmp ecx, 0x4e0
jb 0x1800309ab
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1800308e0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x180030930
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x180033050
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [0x1800bf040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x58], rsi
mov rsi, qword [0x1800c2180]
test rsi, rsi
je 0x18003307f
mov rdi, qword [rsi + 0x98]
jmp 0x180033081
xor edi, edi
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
movdqu xmmword [rsp + 0x20], xmm0
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x28]
sub eax, dword [rsp + 0x20]
movd xmm1, eax
mov eax, dword [rsp + 0x2c]
sub eax, dword [rsp + 0x24]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rsi + 0x10], xmm1
movss dword [rsi + 0x14], xmm0
cmp byte [rdi + 0x2e], 0
je 0x1800330cb
call fcn.180032fe0
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x30]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [rdi + 0x18]
cvtsi2ss xmm0, qword [rdi + 0x20]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rsi + 0x18], xmm1
mov qword [rdi + 0x18], rcx
call fcn.1800325e0
mov rax, qword [0x1800c2180]
cmp byte [rax + 0x2f10], 0
je 0x180033164
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180033164
mov rbx, qword [0x1800c2180]
xorps xmm3, xmm3
xor r8d, r8d
mov edx, 0x210
lea rcx, [rbx + 8]
call fcn.1800364d0
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov rax, qword [0x1800c2180]
cmp byte [rax + 0x2f50], 0
je 0x1800331b5
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1800331b5
mov rbx, qword [0x1800c2180]
xorps xmm3, xmm3
xor r8d, r8d
mov edx, 0x214
lea rcx, [rbx + 8]
call fcn.1800364d0
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov rax, qword [0x1800c2180]
cmp byte [rax + 0x2f30], 0
je 0x180033206
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180033206
mov rbx, qword [0x1800c2180]
xorps xmm3, xmm3
xor r8d, r8d
mov edx, 0x212
lea rcx, [rbx + 8]
call fcn.1800364d0
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov rax, qword [0x1800c2180]
cmp byte [rax + 0x2f70], 0
je 0x180033257
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180033257
mov rbx, qword [0x1800c2180]
xorps xmm3, xmm3
xor r8d, r8d
mov edx, 0x216
lea rcx, [rbx + 8]
call fcn.1800364d0
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
cmp byte [rsi + 0x78], 0
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
je 0x18003326e
mov eax, 0xffffffff
jmp 0x18003327b
mov rax, qword [0x1800c2180]
mov eax, dword [rax + 0x43f8]
cmp dword [rdi + 0x28], eax
je 0x180033288
mov dword [rdi + 0x28], eax
call fcn.180032470
call fcn.180032850
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180080a40
add rsp, 0x40
pop rdi
ret