joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180013740
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov edx, dword [0x1800a8b44]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x1800a90c0], edx
jle 0x1800137c3
lea rcx, [0x1800a90c0]
call fcn.18006f948
cmp dword [0x1800a90c0], 0xffffffff
jne 0x1800137c3
mov edx, 2
lea rsi, [0x1800a90d0]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180072be0]
call fcn.18006f888
lea rcx, [0x1800a90c0]
call fcn.18006f8dc
jmp 0x1800137ca
lea rsi, [0x1800a90d0]
mov qword [rsp + 0x60], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x1800137e8
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800a911c], 0x7fffffff
jne 0x18001380a
mov dword [0x1800a911c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18001381b
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180013853
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180013840
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180004160
cmp qword [rax + 8], 0
je 0x18001387e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x1800138af
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18001388b
mov rdx, qword [rdi]
mov rcx, qword [0x1800a8d28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x180013903
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
lea rdx, [0x1800a71f0]
lea rcx, [0x180009840]
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x18001390c
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180013920
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
mov r8d, dword [0x1800a8b44]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov r8d, dword [rcx + rax]
cmp dword [0x1800a8e98], r8d
jle 0x1800139a2
lea rcx, [0x1800a8e98]
call fcn.18006f948
cmp dword [0x1800a8e98], 0xffffffff
jne 0x1800139a2
mov edx, 2
lea rsi, [0x1800a8f70]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180072bd0]
call fcn.18006f888
lea rcx, [0x1800a8e98]
call fcn.18006f8dc
jmp 0x1800139a9
lea rsi, [0x1800a8f70]
mov qword [rsp + 0x70], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x1800139c7
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800a8fbc], 0x7fffffff
jne 0x1800139e9
mov dword [0x1800a8fbc], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1800139fa
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180013a33
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180013a20
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180004160
cmp qword [rax + 8], 0
je 0x180013a5e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x180013a8f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180013a6b
mov rdx, qword [rdi]
mov rcx, qword [0x1800a8d28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x180013ad5
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
mov rcx, r14
call rdx
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, ebx
jmp 0x180013ade
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x180013af0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800a8b44]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x1800a8e90], r9d
jle 0x180013b7b
lea rcx, [0x1800a8e90]
call fcn.18006f948
cmp dword [0x1800a8e90], 0xffffffff
jne 0x180013b7b
mov edx, 2
lea rsi, [0x1800a8ea0]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180072bc0]
call fcn.18006f888
lea rcx, [0x1800a8e90]
call fcn.18006f8dc
jmp 0x180013b82
lea rsi, [0x1800a8ea0]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x180013ba0
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800a8eec], 0x7fffffff
jne 0x180013bc2
mov dword [0x1800a8eec], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180013bd3
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180013c03
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180013bf0
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180004160
cmp qword [rax + 8], 0
je 0x180013c2e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x180013c5f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180013c3b
mov rdx, qword [rdi]
mov rcx, qword [0x1800a8d28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x180013cab
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov edx, r14d
mov rcx, r15
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x180013cb4
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180013cd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800a8b44]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x1800a8ef4], r9d
jle 0x180013d5b
lea rcx, [0x1800a8ef4]
call fcn.18006f948
cmp dword [0x1800a8ef4], 0xffffffff
jne 0x180013d5b
mov edx, 2
lea rsi, [0x1800a8e40]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180072bb0]
call fcn.18006f888
lea rcx, [0x1800a8ef4]
call fcn.18006f8dc
jmp 0x180013d62
lea rsi, [0x1800a8e40]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x180013d80
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800a8e8c], 0x7fffffff
jne 0x180013da2
mov dword [0x1800a8e8c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180013db3
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180013de3
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180013dd0
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180004160
cmp qword [rax + 8], 0
je 0x180013e0e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x180013e3f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180013e1b
mov rdx, qword [rdi]
mov rcx, qword [0x1800a8d28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x180013e8b
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x180013e94
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180013eb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
mov r8d, dword [0x1800a8b44]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov r8d, dword [rcx + rax]
cmp dword [0x1800a8e94], r8d
jle 0x180013f32
lea rcx, [0x1800a8e94]
call fcn.18006f948
cmp dword [0x1800a8e94], 0xffffffff
jne 0x180013f32
mov edx, 2
lea rsi, [0x1800a8fd0]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180072ba0]
call fcn.18006f888
lea rcx, [0x1800a8e94]
call fcn.18006f8dc
jmp 0x180013f39
lea rsi, [0x1800a8fd0]
mov qword [rsp + 0x70], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x180013f57
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800a901c], 0x7fffffff
jne 0x180013f79
mov dword [0x1800a901c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180013f8a
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180013fc3
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180013fb0
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180004160
cmp qword [rax + 8], 0
je 0x180013fee
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18001401f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180013ffb
mov rdx, qword [rdi]
mov rcx, qword [0x1800a8d28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x180014065
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
mov rcx, r14
call rdx
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, ebx
jmp 0x18001406e
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x180014080
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800a8b44]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x1800a8de0], r9d
jle 0x18001410b
lea rcx, [0x1800a8de0]
call fcn.18006f948
cmp dword [0x1800a8de0], 0xffffffff
jne 0x18001410b
mov edx, 2
lea rsi, [0x1800a9120]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180072b90]
call fcn.18006f888
lea rcx, [0x1800a8de0]
call fcn.18006f8dc
jmp 0x180014112
lea rsi, [0x1800a9120]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x180014130
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800a916c], 0x7fffffff
jne 0x180014152
mov dword [0x1800a916c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180014163
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180014193
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180014180
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180004160
cmp qword [rax + 8], 0
je 0x1800141be
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x1800141ef
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1800141cb
mov rdx, qword [rdi]
mov rcx, qword [0x1800a8d28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x180014239
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, ebx
jmp 0x180014242
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180014260
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800a8b44]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x1800a8e9c], r9d
jle 0x1800142eb
lea rcx, [0x1800a8e9c]
call fcn.18006f948
cmp dword [0x1800a8e9c], 0xffffffff
jne 0x1800142eb
mov edx, 2
lea rsi, [0x1800a9020]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180072b80]
call fcn.18006f888
lea rcx, [0x1800a8e9c]
call fcn.18006f8dc
jmp 0x1800142f2
lea rsi, [0x1800a9020]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x180014310
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800a906c], 0x7fffffff
jne 0x180014332
mov dword [0x1800a906c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180014343
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180014373
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180014360
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180004160
cmp qword [rax + 8], 0
je 0x18001439e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x1800143cf
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1800143ab
mov rdx, qword [rdi]
mov rcx, qword [0x1800a8d28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18001441b
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov edx, r14d
mov rcx, r15
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x180014424
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180014440
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800a8b44]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x1800a8ef0], r9d
jle 0x1800144cb
lea rcx, [0x1800a8ef0]
call fcn.18006f948
cmp dword [0x1800a8ef0], 0xffffffff
jne 0x1800144cb
mov edx, 2
lea rsi, [0x1800a8d90]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180072b70]
call fcn.18006f888
lea rcx, [0x1800a8ef0]
call fcn.18006f8dc
jmp 0x1800144d2
lea rsi, [0x1800a8d90]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x1800144f0
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800a8ddc], 0x7fffffff
jne 0x180014512
mov dword [0x1800a8ddc], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180014523
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180014553
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180014540
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180004160
cmp qword [rax + 8], 0
je 0x18001457e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x1800145af
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18001458b
mov rdx, qword [rdi]
mov rcx, qword [0x1800a8d28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x1800145f6
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180003b60
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
nop
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
jmp 0x1800145ff
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180021b90
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x1800a8b44]
mov rax, qword gs:[0x58]
mov rdi, qword [rdx]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1800a9304], ecx
jle 0x180021bf2
lea rcx, [0x1800a9304]
call fcn.18006f948
cmp dword [0x1800a9304], 0xffffffff
jne 0x180021bf2
lea rcx, [0x180072c30]
call fcn.18006f888
lea rcx, [0x1800a9304]
call fcn.18006f8dc
mov rax, qword [0x1800a8c40]
xor esi, esi
test rax, rax
je 0x180021c09
mov rcx, qword [rax + 0xa0]
jmp 0x180021c0c
mov rcx, rsi
cmp qword [rcx + 0x48], rsi
jne 0x180021c17
call fcn.180023300
call fcn.180024ca0
call fcn.18002d2d0
call fcn.180021300
cmp byte [0x1800a71a0], sil
je 0x180021c3b
lea rcx, [0x1800a7188]
call fcn.18001e820
xor edx, edx
lea rcx, str.UnityWndClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rbx
jne 0x180021c75
mov ecx, 0x7b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x180021c75
cmp byte [0x1800a71a0], sil
sete byte [0x1800a71a0]
call fcn.18002f5e0
call fcn.18002f9e0
mov rax, qword [rdi]
lea r8, [0x1800a8c38]
xor r9d, r9d
mov rcx, rdi
lea edx, [r9 + 1]
call qword [rax + 0x108]
mov rax, qword [0x1800a8c40]
mov rcx, qword [rax + 0x4210]
mov rcx, qword [rcx]
add rcx, 0xa8
cmp byte [rcx], sil
cmove rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.180022890
Function at 0x180024ca0
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [0x1800a7038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x58], rsi
mov rsi, qword [0x1800a8c40]
test rsi, rsi
je 0x180024ccf
mov rdi, qword [rsi + 0x98]
jmp 0x180024cd1
xor edi, edi
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
movdqu xmmword [rsp + 0x20], xmm0
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x28]
sub eax, dword [rsp + 0x20]
movd xmm1, eax
mov eax, dword [rsp + 0x2c]
sub eax, dword [rsp + 0x24]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rsi + 0x10], xmm1
movss dword [rsi + 0x14], xmm0
cmp byte [rdi + 0x2e], 0
je 0x180024d1b
call fcn.180024c30
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x30]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [rdi + 0x18]
cvtsi2ss xmm0, qword [rdi + 0x20]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rsi + 0x18], xmm1
mov qword [rdi + 0x18], rcx
call fcn.180024230
mov rax, qword [0x1800a8c40]
cmp byte [rax + 0x2f10], 0
je 0x180024db4
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180024db4
mov rbx, qword [0x1800a8c40]
xorps xmm3, xmm3
xor r8d, r8d
mov edx, 0x210
lea rcx, [rbx + 8]
call fcn.1800280e0
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov rax, qword [0x1800a8c40]
cmp byte [rax + 0x2f50], 0
je 0x180024e05
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180024e05
mov rbx, qword [0x1800a8c40]
xorps xmm3, xmm3
xor r8d, r8d
mov edx, 0x214
lea rcx, [rbx + 8]
call fcn.1800280e0
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov rax, qword [0x1800a8c40]
cmp byte [rax + 0x2f30], 0
je 0x180024e56
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180024e56
mov rbx, qword [0x1800a8c40]
xorps xmm3, xmm3
xor r8d, r8d
mov edx, 0x212
lea rcx, [rbx + 8]
call fcn.1800280e0
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov rax, qword [0x1800a8c40]
cmp byte [rax + 0x2f70], 0
je 0x180024ea7
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180024ea7
mov rbx, qword [0x1800a8c40]
xorps xmm3, xmm3
xor r8d, r8d
mov edx, 0x216
lea rcx, [rbx + 8]
call fcn.1800280e0
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
cmp byte [rsi + 0x78], 0
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
je 0x180024ebe
mov eax, 0xffffffff
jmp 0x180024ecb
mov rax, qword [0x1800a8c40]
mov eax, dword [rax + 0x43f8]
cmp dword [rdi + 0x28], eax
je 0x180024ed8
mov dword [rdi + 0x28], eax
call fcn.1800240c0
call fcn.1800244a0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18006f480
add rsp, 0x40
pop rdi
ret