joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ea6dc
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x1400ea7a6
test rbx, rbx
je 0x1400ea7a6
test r9, r9
je 0x1400ea7a6
and qword [r8], 0
xor r8d, r8d
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
lea r9, [rax + 0x10]
and qword [rax - 0x18], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400ea7a2
cmp dword [rsp + 0x48], 3
jne 0x1400ea7a2
cmp dword [rdi], eax
je 0x1400ea7a2
mov ecx, dword [rdi]
call fcn.140017598
mov qword [rbx], rax
lea r9, [rsp + 0x48]
mov rcx, qword [rbp + 8]
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400ea796
cmp dword [rsp + 0x48], 3
jne 0x1400ea796
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx]
call fcn.140017590
and qword [rbx], 0
xor eax, eax
jmp 0x1400ea781
call fcn.140018914
int3

Function at 0x1400eaa64
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1400eaa75
xor eax, eax
jmp 0x1400eaaa3
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1400eaaac
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1400eaabd
xor eax, eax
jmp 0x1400eaae1
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov r9d, 3
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x14013b634
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and dword [rax - 0x18], 0
mov rbp, r9
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.1401b14f8
test eax, eax
jne 0x14013b698
mov eax, dword [rsp + 0x30]
lea r8, str._s_s_X.tmp
mov dword [rsp + 0x28], eax
mov r9, rsi
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.140004570
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14013b6aa
jmp 0x14013b658
mov r9, rbx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14019a74c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x140267660]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x14019a790
movzx eax, r14w
jmp 0x14019a8c6
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14019a7cc
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x14019a7cc
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x14019a8c6
cmp qword [rcx + 0x80], r14
je 0x14019a8c3
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14019a80a
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14019a833
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.1401b5fc4
cmp ax, di
je 0x14019a8c3
movzx edi, si
jmp 0x14019a8c3
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [case.0x14004010e.0]
test eax, eax
je 0x14019a888
sub eax, 1
je 0x14019a888
cmp eax, 2
jne 0x14019a8c3
movzx ecx, word [rbp + 7]
jmp 0x14019a816
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x14019a8b2
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.1401a4f58
cmp r14, rax
jne 0x14019a8c3
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
movzx eax, si
jne 0x14019a8c6
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140197d80
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x1401a4600
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401a4620
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401a4094
or eax, 0xffffffff
jmp 0x1401a4622
xor eax, eax
add rsp, 0x28
ret

Function at 0x1401a6328
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1401a6154
Function at 0x1401bd354
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1401bd07a
call fcn.1401a4104
mov dword [rax], 0x16
call fcn.1401a16dc
jmp 0x1401bd1c5
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1401bd1c5
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1401bd1c5
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1401bd0a9
lock or dword [rcx + 0x14], 0x10
jmp 0x1401bd1c5
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1401bd0bd
call fcn.1401bd35c
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x1401bd0cd
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x1401bd0d0
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.1401a6fe8
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.1401a689c
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x1401bd1b3
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1401bd161
mov rcx, rbx
call fcn.1401a6fe8
cmp eax, 0xffffffff
je 0x1401bd14c
mov rcx, rbx
call fcn.1401a6fe8
cmp eax, 0xfffffffe
je 0x1401bd14c
mov rcx, rbx
call fcn.1401a6fe8
movsxd rdi, eax
lea r14, [0x140274790]
mov rcx, rbx
sar rdi, 6
call fcn.1401a6fe8
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1401bd153
lea rdx, [0x140267a00]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401bd161
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x1401bd185
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x1401bd185
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x1401bd185
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x1401bd1a3
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x1401bd1ae
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x1401bd1ca
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x1401bd044
Function at 0x18001ff60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18001ffbd
lea rbx, [0x1800b6a40]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18001ffa4
cmp r10, 2
jb 0x18001ffa4
cmp byte [r9], r8b
jne 0x18001ffa4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18001ff80
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18001ffff
lea rbx, [0x1800b6a40]
cmp r8b, 0x23
jne 0x18001ffe3
cmp byte [r9], r8b
jne 0x18001ffe3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18001ffd0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1800201c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x1800201de
mov qword [r8], r14
lea rdx, [0x1800b6120]
call fcn.180020010
mov rbx, rax
test rax, rax
jne 0x180020203
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x18002032d
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18002032d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18002032d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18002032d
cmp rdi, 0xffffffffffffffff
je 0x18002032d
mov rcx, rdi
call fcn.180025090
mov rbp, rax
test rax, rax
je 0x18002032d
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x18002031a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x1802014e0]
test r8, r8
je 0x18002030f
movsx rdx, word [r8 + 0x6130]
lea rcx, [r8 + 0x6134]
mov r9d, dword [r8 + 0x3f88]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x180020304
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6130], cx
movsx rax, cx
lea rcx, [r8 + 0x6134]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x612c]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180020336
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x180020328
mov qword [rsi], rdi
mov rax, rbp
jmp 0x180020338
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180028840
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x180028890
lea r11, [0x1800b6a40]
nop dword [rax]
cmp r9b, 0x23
jne 0x180028873
cmp byte [r8], r9b
jne 0x180028873
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180028860
mov rcx, qword [0x1802014e0]
not eax
movsxd rdx, dword [rcx + 0x4020]
mov r9, qword [rcx + 0x4028]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x1800288f1
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x1800288e9
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x1800288ec
mov rdx, r8
test rdx, rdx
jne 0x1800288c0
cmp r9, r10
je 0x180028900
cmp dword [r9], eax
jne 0x180028900
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x18002ebd0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x110]
lea r10, [0x1800b6a40]
mov r8, rdx
mov r9, rcx
movsxd rdx, dword [rcx + 0x108]
mov ebx, dword [rax + rdx*4 - 4]
not ebx
movzx eax, r8b
movzx edx, bl
xor rdx, rax
shr ebx, 8
mov rax, r8
shr rax, 8
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x10
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x18
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x20
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x28
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x30
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x38
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r10 + rcx*4]
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x4094], ebx
jne 0x18002ecbf
mov edx, 0xc
mov ecx, ebx
call fcn.18003b420
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x18002ecd0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x108]
lea r11, [0x1800b6a40]
mov rax, qword [rcx + 0x110]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x4094], ebx
jne 0x18002ed66
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.18003b420
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x18002ed70
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0x110]
lea r9, [0x1800b6a40]
movss xmm2, dword [rcx + 0x128]
movss xmm3, dword [rcx + 0x12c]
movsxd rcx, dword [rcx + 0x108]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x180038ee0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x6050], 0
lea rbx, [rcx + 0x6058]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180038f87
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x180038f3a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18003c580
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.180020e50
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x6050]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x6060]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1802014d8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x180038f8f
mov rcx, rbx
call fcn.180020e50
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1800393c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x1802014e0]
xor ebp, ebp
cmp byte [rbx + 0x5fa8], bpl
jne 0x18003949f
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x180039498
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.1800201c0
mov rsi, rax
test rax, rax
je 0x180039498
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x180039424
mov rcx, rax
call fcn.1800395f0
mov r8, qword [0x1802014e0]
test r8, r8
je 0x18003948f
movsx rdx, word [r8 + 0x6130]
lea rcx, [r8 + 0x6134]
mov r9d, dword [r8 + 0x3f88]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x180039484
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6130], cx
movsx rax, cx
lea rcx, [r8 + 0x6134]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x612c]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x5fa8], 1
movss xmm0, dword [rbx + 0x5fac]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x18003952e
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5fac], xmm0
jb 0x18003952e
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x180039521
mov rax, qword [0x1802014e0]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5fac], ebp
call fcn.180039850
lea rdx, [0x1800b6124]
mov rcx, rdi
mov rsi, rax
call fcn.180020010
mov rdi, rax
test rax, rax
je 0x180039528
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x180039528
mov byte [rbx + 0xce], 1
mov dword [rbx + 0x5fac], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x180039550
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1802014e0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x1800395b3
mov qword [rsp], rbx
lea rbx, [0x1800b6a40]
nop dword [rax]
cmp r9b, 0x23
jne 0x180039593
cmp byte [r8], r9b
jne 0x180039593
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x180039580
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5fc0]
not eax
mov r8, qword [r10 + 0x5fc8]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x1800395df
cmp dword [r8 + 8], eax
je 0x1800395e6
add r8, 0x48
cmp r8, rcx
jne 0x1800395d0
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x1800535f0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x1800d3040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x1802014e0]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x18005380f
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x18005380f
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x1802014e0]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x1800536c4
movsx rdx, word [r8 + 0x6130]
lea rax, [r8 + 0x6134]
mov r9d, dword [r8 + 0x3f88]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x1800536b9
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6130], cx
movsx rax, cx
lea rax, [rax*8 + 0x6134]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x6128]
test rdi, rdi
je 0x1800536e1
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x1800536e4
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, [0x1800bcda8]
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x180053727
mov rsi, qword [r8 + 0x90]
jmp 0x18005372a
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x180053755
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x1802014e0]
mov rcx, qword [rax + 0x4b60]
mov rax, qword [rdi]
mov rdx, qword [rcx]
mov qword [rdx + 0x30], rax
mov qword [rdx + 0x28], rax
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x1800537cf
inc rbx
cmp rbx, 5
jl 0x1800537b1
jmp 0x1800537fb
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x180053811
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800aba60
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x18006cff0
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x20
test dword [rcx + 0x10], 0x100000
mov rdi, rdx
je 0x18006d07c
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18006d050
lea r11, [0x1800b6a40]
nop
cmp r9b, 0x23
jne 0x18006d033
cmp byte [r8], r9b
jne 0x18006d033
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18006d020
mov rcx, qword [0x1802014e0]
not eax
cmp dword [rcx + 0x40ac], eax
jne 0x18006d067
mov dword [rcx + 0x40b0], eax
cmp dword [rcx + 0x40dc], eax
jne 0x18006d0d9
mov byte [rcx + 0x40e0], 1
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x1802014e0]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov rcx, rdi
mov qword [rsp + 0x38], rsi
mov rbx, qword [rax + 0x4040]
movsxd rax, dword [rbx + 0x108]
mov r8, qword [rbx + 0x110]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.18001ff60
mov rcx, qword [rbx]
mov esi, eax
mov rbx, qword [rsp + 0x30]
cmp dword [rcx + 0x4094], eax
jne 0x18006d0d2
mov r8, rdi
mov edx, 0xb
mov ecx, eax
call fcn.18003b420
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret