joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180049970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180353180]
mov rcx, qword [rax + 0x5000]
mov r9, qword [rax + 0x4140]
movups xmm0, xmmword [r9 + 0x278]
movups xmmword [rcx + 0x170], xmm0
mov rax, qword [r9 + 0x2e0]
movups xmm0, xmmword [rcx + 0x150]
movss xmm4, dword [rcx + 0x150]
movss xmm3, dword [rcx + 0x154]
movss xmm2, dword [rcx + 0x158]
movss xmm1, dword [rcx + 0x15c]
movups xmmword [r9 + 0x278], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2e0]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [rcx + 0x232]
mov rcx, qword [rcx + 0x1a0]
mov rdx, qword [r9 + 0x2e0]
add rsp, 0x38
jmp fcn.18003ee30

Function at 0x180049a50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180353180]
mov rcx, qword [rax + 0x5000]
mov r10, qword [rax + 0x4140]
movsxd rax, dword [rcx + 0x74]
movups xmm0, xmmword [rcx + 0x170]
movss xmm4, dword [rcx + 0x170]
movss xmm3, dword [rcx + 0x174]
movss xmm2, dword [rcx + 0x178]
movss xmm1, dword [rcx + 0x17c]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x70
mov rax, qword [r10 + 0x2e0]
add r9, qword [rcx + 0x18]
movups xmmword [r10 + 0x278], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x2e0]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [r9 + 0x5c]
mov rdx, qword [r10 + 0x2e0]
mov rcx, qword [rcx + 0x1a0]
add rsp, 0x38
jmp fcn.18003ee30
Function at 0x18006e900
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180352040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdx, qword [0x180356f98]
mov rcx, qword [0x180356fa0]
mov byte [0x1803570d8], 0
call qword [sym.imp.OPENGL32.dll_wglMakeCurrent]
call fcn.180044ec0
call fcn.1800464a0
call fcn.18000c490
mov r8, qword [0x180356fa8]
mov edx, 0xfffffffc
mov rcx, qword [0x1803570e0]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov rdx, qword [0x180356fd0]
mov rcx, qword [0x180356fa0]
call qword [sym.imp.OPENGL32.dll_wglMakeCurrent]
mov rcx, qword [0x180356f98]
call qword [sym.imp.OPENGL32.dll_wglDeleteContext]
mov rbx, qword [0x180356fb0]
test rbx, rbx
je 0x18006ea13
cmp byte [rbx], 0
jne 0x18006ea06
mov rcx, qword [rbx + 0x10]
mov dword [rsp + 0x20], 0
cmp byte [rcx], 0xe9
jne 0x18006e9e2
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18006e9e2
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
call sub.VCRUNTIME140.dll_memcpy
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbx + 0x20]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, 0x38
mov rcx, rbx
call fcn.1800ae784
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800ae1c0
add rsp, 0x30
pop rbx
ret
Function at 0x18006ea30
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180352040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov word [rcx], 1
lea rax, [0x18006e110]
mov qword [rcx + 8], rax
mov rcx, qword [0x180356fb8]
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov dword [rbx + 0x28], 0x25ff
mov dword [rbx + 0x2c], 0x1010000
mov dword [rbx + 0x30], 0x1010101
mov word [rbx + 0x34], 0x101
call fcn.18006f8c0
mov rcx, qword [rbx + 0x10]
mov edx, 0xe
mov r8d, 0x40
mov byte [rbx + 1], al
call fcn.180070880
mov qword [rbx + 0x20], rax
mov rcx, rax
test rax, rax
jne 0x18006eace
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Hook:_Failed_to_allocate_memory_n
call fcn.180004990
jmp 0x18006ebd0
mov rax, qword [rbx + 8]
mov r9d, 0x40
mov qword [rbx + 0x2e], rax
mov r8d, 0x3000
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + 0xc], ax
xor ecx, ecx
movzx edx, byte [rbx + 1]
add rdx, 0xe
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x18006eab6
mov qword [0x180356fd8], rax
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x48], rdi
call sub.VCRUNTIME140.dll_memcpy
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
mov r8d, 0x40
add rcx, rdx
mov qword [rbx + 0x2e], rcx
mov rcx, qword [rbx + 0x18]
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx + rdx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + rdx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + rdx + 0xc], ax
mov edx, 5
mov edi, dword [rbx + 0x20]
sub edi, dword [rbx + 0x10]
mov rcx, qword [rbx + 0x10]
sub edi, 5
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18006eba1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Hook:_Failed_to_change_target_function_protection_n
call fcn.180004990
jmp 0x18006ebcb
mov rax, qword [rbx + 0x10]
lea r9, [rsp + 0x20]
mov edx, 5
mov byte [rax], 0xe9
mov rax, qword [rbx + 0x10]
mov dword [rax + 1], edi
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx], 0
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800ae1c0
add rsp, 0x30
pop rbx
ret
Function at 0x18006f970
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x180352040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, qword [0x180357008]
mov rdi, qword [0x180357000]
xor ebp, ebp
cmp rdi, rsi
je 0x18006fa3d
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x18006fa30
cmp byte [rbx], bpl
jne 0x18006fa23
mov dword [rsp + 0x20], ebp
mov rcx, qword [rbx + 8]
cmp byte [rcx], 0xe9
jne 0x18006fa11
lea r9, [rsp + 0x20]
mov edx, 5
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18006fa11
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov eax, dword [rcx]
mov dword [rdx], eax
movzx eax, byte [rcx + 4]
mov byte [rdx + 4], al
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov edx, 5
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, 0x18
mov rcx, rbx
call fcn.1800ae784
add rdi, 0x10
cmp rdi, rsi
jne 0x18006f9b0
mov rbx, qword [0x180356fe8]
mov rsi, qword [0x180356ff0]
cmp rbx, rsi
je 0x18006fafc
mov ecx, dword [0x18035313c]
mov rax, qword gs:[0x58]
lea r14, [rax + rcx*8]
mov r15d, 4
nop dword [rax]
xor edx, edx
mov rcx, qword [rbx]
call fcn.180003bd0
mov rdi, qword [rbx]
test rdi, rdi
jne 0x18006fa87
mov rax, rbp
jmp 0x18006fae9
mov rax, qword [r14]
mov ecx, dword [r15 + rax]
cmp dword [0x180357160], ecx
jle 0x18006fad1
lea rcx, [0x180357160]
call fcn.1800ae288
cmp dword [0x180357160], 0xffffffff
jne 0x18006fad1
lea rdx, str._access_flags
lea rcx, str.Method
call fcn.180003900
mov qword [0x1803572c8], rax
lea rcx, [0x180357160]
call fcn.1800ae21c
mov rax, qword [0x1803572c8]
test rax, rax
jne 0x18006fae2
mov rax, rbp
jmp 0x18006fae9
mov rax, qword [rax + 0x20]
add rax, rdi
and dword [rax], 0xf0ffffff
add rbx, 0x10
cmp rbx, rsi
jne 0x18006fa70
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800ae1c0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x180070140
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x180352040]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rdi, rdx
mov qword [rcx + 8], rdx
mov rbx, rcx
mov byte [rcx], 1
mov qword [rcx + 0x10], 0
mov edx, 0x66
mov rcx, rdi
mov dword [rbp - 0x19], 0x41525150
mov r8d, 0x40
mov dword [rbp - 0x15], 0x41514150
mov dword [rbp - 0x11], 0x55534152
mov dword [rbp - 0xd], 0x8948006a
mov dword [rbp - 9], 0xfa894ce9
mov dword [rbp - 5], 0x24048d4c
mov dword [rbp - 1], 0x48e58948
mov dword [rbp + 3], 0x48f0e483
mov dword [rbp + 7], 0xff20ec83
mov dword [rbp + 0xb], 0x2d15
mov dword [rbp + 0xf], 0xec894800
mov dword [rbp + 0x13], 0xf8834858
mov dword [rbp + 0x17], 0x5b415d00
mov dword [rbp + 0x1b], 0x59415a41
mov dword [rbp + 0x1f], 0x595a5841
mov word [rbp + 0x23], 0xf58
mov byte [rbp + 0x25], 0x84
mov dword [rbp + 0x2a], 0x6e0f4866
mov dword [rbp + 0x2e], 0x5d8b48c0
mov dword [rbp + 0x32], 0xec8948f8
mov dword [rbp + 0x36], 0x89485e5d
mov word [rbp + 0x3a], 0xffdc
mov byte [rbp + 0x3c], 0xe6
call fcn.180070880
mov qword [rbx + 0x10], rax
mov rcx, rax
test rax, rax
jne 0x18007024a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_allocate_memory_for_i2i_hook_n
call fcn.180004990
jmp 0x180070308
movaps xmm0, xmmword [rbp - 0x19]
lea r9, [rbp + 0x47]
movaps xmm1, xmmword [rbp - 9]
mov eax, edi
sub eax, ecx
mov edx, 0x66
sub eax, 0x43
mov r8d, 0x20
mov dword [rbp + 0x26], eax
lea rax, [0x180070020]
mov qword [rbp + 0x3d], rax
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbp + 0x3f]
movups xmmword [rcx + 8], xmm0
movaps xmm0, xmmword [rbp + 7]
movups xmmword [rcx + 0x18], xmm1
movaps xmm1, xmmword [rbp + 0x17]
movups xmmword [rcx + 0x28], xmm0
movaps xmm0, xmmword [rbp + 0x27]
movups xmmword [rcx + 0x38], xmm1
movsd xmm1, qword [rbp + 0x37]
movups xmmword [rcx + 0x48], xmm0
movsd qword [rcx + 0x58], xmm1
mov dword [rcx + 0x60], eax
movzx eax, word [rbp + 0x43]
mov word [rcx + 0x64], ax
mov rcx, qword [rbx + 0x10]
mov dword [rbp + 0x47], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r9, [rbp + 0x47]
mov edx, 5
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rbp + 0x47]
lea r9, [rbp + 0x47]
mov byte [rdi], 0xe9
mov edx, 5
mov eax, dword [rbx + 0x10]
mov rcx, rdi
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx], 0
mov rax, rbx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1800ae1c0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180072f70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r12, rdx
mov r14, rcx
mov rcx, rdx
call fcn.180070c80
lea r15, [rax + 8]
mov rsi, qword [r14 + 0x10]
mov rdx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x180072faa
mov rdx, qword [r14]
movabs rbx, 0xcbf29ce484222325
mov r9, rbx
xor edi, edi
mov ecx, edi
movabs r13, 0x100000001b3
test rsi, rsi
je 0x180072fe3
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r13
inc rcx
cmp rcx, rsi
jb 0x180072fd0
mov r8, r14
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.1800750d0
mov rcx, r14
cmp qword [rax + 8], rdi
jne 0x1800730ef
lea rdx, [rsp + 0x20]
call fcn.180073290
nop
mov rdx, r12
mov rcx, rax
call fcn.1800733b0
mov rdx, qword [r12]
mov r8, qword [rdx + 0xa8]
mov rdx, rax
mov rcx, r12
call r8
mov rbx, rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x18007306d
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180073068
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180073068
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800ae784
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.180074260
mov qword [rsp + 0x60], rbx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.1800751a0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1800730d2
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800730cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800730cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800ae784
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp qword [r14 + 0x18], 0xf
jbe 0x1800730f9
mov rcx, qword [r14]
test rsi, rsi
je 0x180073113
nop
movzx eax, byte [rdi + rcx]
xor rbx, rax
imul rbx, r13
inc rdi
cmp rdi, rsi
jb 0x180073100
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.1800750d0
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x180073136
mov rax, qword [rax + 0x30]
jmp 0x1800730d5
lea rcx, str.invalid_unordered_map_K__T__key
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
Function at 0x180073150
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov rbx, rdx
mov rdx, rcx
call fcn.180073bc0
mov r10, rax
mov r8, qword [rbx + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18007317e
mov rdx, qword [rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x1800731b3
movabs r11, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r11
inc rcx
cmp rcx, r8
jb 0x1800731a0
mov r8, rbx
lea rdx, [rsp + 0x28]
mov rcx, r10
call fcn.1800750d0
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1800731d3
mov rax, qword [rax + 0x30]
jmp 0x1800731e3
lea rcx, str.invalid_unordered_map_K__T__key
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
nop
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x1800731f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov rbx, rdx
mov rdx, rcx
call fcn.180073bc0
lea r10, [rax + 0x40]
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18007321f
mov rcx, qword [rbx]
xor edx, edx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180073253
movabs r11, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r11
inc rdx
cmp rdx, r8
jb 0x180073240
mov r8, rbx
lea rdx, [rsp + 0x28]
mov rcx, r10
call fcn.1800750d0
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x180073273
mov rax, qword [rax + 0x30]
jmp 0x180073283
lea rcx, str.invalid_unordered_map_K__T__key
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
nop
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x180073bc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x38
cmp qword [rdx + 0x18], 0xf
mov r8, rdx
mov r10, qword [rdx + 0x10]
jbe 0x180073bd5
mov r8, qword [rdx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x180073c04
movabs r11, 0x100000001b3
movzx eax, byte [r8 + rcx]
inc rcx
xor r9, rax
imul r9, r11
cmp rcx, r10
jb 0x180073bf0
mov r8, rdx
lea rdx, [rsp + 0x20]
call fcn.180074c60
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x180073c24
add rax, 0x30
add rsp, 0x38
ret
lea rcx, str.invalid_unordered_map_K__T__key
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
Function at 0x180076780
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x1800767a5
cvtsi2ss xmm0, rdx
jmp 0x1800767ba
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x18033ffa0]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1800767e8
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800767e8
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18007681a
cmp rbx, 0x200
jae 0x180076817
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18007681a
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800745f0
Function at 0x18008bb10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x18008bb77
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x18008bb32
mov ecx, dword [r10]
jmp 0x18008bc98
cmp ecx, 0x270
jb 0x18008bc98
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
nop word [rax + rax]
mov r9, qword [rbx + 8]
mov r8, rbx
add rbx, 8
mov rdx, r9
xor rdx, rax
and rdx, 0xffffffff80000000
xor rdx, r9
movzx eax, dl
and al, 1
neg al
mov rax, r9
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4e0]
xor rcx, rdx
mov qword [r8 - 0x9c0], rcx
sub rdi, 1
jne 0x18008bbb0
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 8]
mov rdx, rbx
xor r9, r8
add rbx, 8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rdx - 0xea0]
xor rcx, r9
mov r9, r8
mov qword [rdx - 0x9c0], rcx
sub rdi, 1
jne 0x18008bc10
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x180095f60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x38], r12
mov rsi, rcx
mov qword [rsp + 0x30], r13
mov r14, r9
mov qword [rsp + 0x28], r15
mov r13, r8
lea r15, [r8 - 1]
mov rdi, rdx
sar r15, 1
mov rbp, rdx
mov rcx, rdx
cmp rdx, r15
jge 0x180095fd0
nop dword [rax + rax]
lea rbx, [rcx + rcx]
mov r8, qword [rsi + rbx*8 + 8]
mov rdx, qword [rsi + rbx*8 + 0x10]
call fcn.180095250
movzx ecx, al
xor rcx, 1
inc rcx
add rcx, rbx
mov rax, qword [rsi + rcx*8]
mov qword [rsi + rdi*8], rax
mov rdi, rcx
cmp rcx, r15
jl 0x180095fa0
cmp rcx, r15
mov rdi, rcx
mov r15, qword [rsp + 0x28]
jne 0x180095ff0
test r13b, 1
jne 0x180095ff0
mov rax, qword [rsi + r13*8 - 8]
lea rdi, [r13 - 1]
mov qword [rsi + rcx*8], rax
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
cmp rbp, rdi
jge 0x180096039
nop
mov r8, qword [r14]
lea rbx, [rdi - 1]
sar rbx, 1
mov rdx, qword [rsi + rbx*8]
call fcn.180095250
test al, al
je 0x180096039
mov rax, qword [rsi + rbx*8]
mov qword [rsi + rdi*8], rax
mov rdi, rbx
cmp rbp, rbx
jl 0x180096000
mov rax, qword [r14]
mov qword [rsi + rbx*8], rax
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [r14]
mov qword [rsi + rdi*8], rax
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180097660
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1800976c1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x180097680
mov ecx, dword [r9]
jmp 0x1800977ab
cmp ecx, 0x4e0
jb 0x1800977ab
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1800976e0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x180097730
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x18009aa70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Log keystrokes via polling

Disassembly:
mov eax, 0x13d8
call fcn.1800af490
sub rsp, rax
mov rax, qword [0x180352040]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
cmp byte [rcx + 8], 0
je 0x18009abb5
cmp byte [0x18035337b], 0
je 0x18009aac6
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18009aac6
mov ecx, 0x5a
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18009abb5
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13b4], 0xffffffff
mov ecx, 1
mov dword [rsp + 0x34], eax
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
mov dword [rsp + rcx*4 + 0x34], eax
inc rcx
cmp rcx, 0x270
jb 0x18009aae0
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x270
call fcn.180097660
mov ecx, eax
imul rax, rcx, 0x64
cmp eax, 0x5f
ja 0x18009ab35
nop dword [rax]
lea rcx, [rsp + 0x30]
call fcn.180097660
mov ecx, eax
imul rax, rcx, 0x64
cmp eax, 0x60
jb 0x18009ab20
shr rax, 0x20
add eax, 0x80000001
xor eax, 0x80000001
shr eax, 1
cmp eax, dword [0x180353368]
jg 0x18009abb5
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_GetCursorPos]
movzx r9d, word [rsp + 0x24]
mov edx, 0x204
movzx eax, word [rsp + 0x20]
mov r8d, 2
mov rcx, qword [0x1803570e0]
shl r9d, 0x10
or r9, rax
call qword [sym.imp.USER32.dll_PostMessageA]
movzx r9d, word [rsp + 0x24]
mov edx, 0x205
movzx eax, word [rsp + 0x20]
mov r8d, 2
mov rcx, qword [0x1803570e0]
shl r9d, 0x10
or r9, rax
call qword [sym.imp.USER32.dll_PostMessageA]
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.1800ae1c0
add rsp, 0x13d8
ret