joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800243d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800b2f74]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x1800b3b80], r9d
jle 0x1800244a6
lea rcx, [0x1800b3b80]
call fcn.180076fb8
cmp dword [0x1800b3b80], 0xffffffff
jne 0x1800244a6
xor ebx, ebx
mov qword [0x1800b3a70], rbx
xorps xmm0, xmm0
movdqa xmmword [0x1800b3a90], xmm0
xorps xmm1, xmm1
movdqa xmmword [0x1800b3aa0], xmm1
mov qword [0x1800b3a78], rbx
mov qword [0x1800b3a80], rbx
movups xmmword [0x1800b3a88], xmm0
movups xmmword [0x1800b3a98], xmm0
movups xmmword [0x1800b3aa8], xmm0
mov qword [0x1800b3ab8], rbx
lea edx, [rbx + 2]
lea rsi, [0x1800b3a70]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x18007abc0]
call fcn.180076ef8
lea rcx, [0x1800b3b80]
call fcn.180076f4c
jmp 0x1800244af
xor ebx, ebx
lea rsi, [0x1800b3a70]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x1800244cd
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800b3abc], 0x7fffffff
jne 0x1800244ef
mov dword [0x1800b3abc], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov rdx, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180024500
mov rcx, qword [rdi]
movabs r9, 0xcbf29ce484222325
test rdx, rdx
je 0x180024533
movabs r8, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x180024520
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.1800188f0
cmp qword [rax + 8], 0
je 0x18002455e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18002458f
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x18002456b
mov rdx, qword [rdi]
mov rcx, qword [0x1800b3958]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x1800245db
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x1800245e4
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180024600
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
mov r8d, dword [0x1800b2f74]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov r8d, dword [rcx + rax]
cmp dword [0x1800b3ac4], r8d
jle 0x1800246cd
lea rcx, [0x1800b3ac4]
call fcn.180076fb8
cmp dword [0x1800b3ac4], 0xffffffff
jne 0x1800246cd
xor ebx, ebx
mov qword [0x1800b3c50], rbx
xorps xmm0, xmm0
movdqa xmmword [0x1800b3c70], xmm0
xorps xmm1, xmm1
movdqa xmmword [0x1800b3c80], xmm1
mov qword [0x1800b3c58], rbx
mov qword [0x1800b3c60], rbx
movups xmmword [0x1800b3c68], xmm0
movups xmmword [0x1800b3c78], xmm0
movups xmmword [0x1800b3c88], xmm0
mov qword [0x1800b3c98], rbx
lea edx, [rbx + 2]
lea rsi, [0x1800b3c50]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x18007abb0]
call fcn.180076ef8
lea rcx, [0x1800b3ac4]
call fcn.180076f4c
jmp 0x1800246d6
xor ebx, ebx
lea rsi, [0x1800b3c50]
mov qword [rsp + 0x70], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x1800246f4
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800b3c9c], 0x7fffffff
jne 0x180024716
mov dword [0x1800b3c9c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov rdx, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180024727
mov rcx, qword [rdi]
movabs r9, 0xcbf29ce484222325
test rdx, rdx
je 0x180024753
movabs r8, 0x100000001b3
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x180024740
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.1800188f0
cmp qword [rax + 8], 0
je 0x18002477e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x1800247af
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x18002478b
mov rdx, qword [rdi]
mov rcx, qword [0x1800b3958]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x1800247f5
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
mov rcx, r14
call rdx
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, ebx
jmp 0x1800247fe
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x180024810
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800b2f74]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x1800b3a10], r9d
jle 0x1800248e6
lea rcx, [0x1800b3a10]
call fcn.180076fb8
cmp dword [0x1800b3a10], 0xffffffff
jne 0x1800248e6
xor ebx, ebx
mov qword [0x1800b3d50], rbx
xorps xmm0, xmm0
movdqa xmmword [0x1800b3d70], xmm0
xorps xmm1, xmm1
movdqa xmmword [0x1800b3d80], xmm1
mov qword [0x1800b3d58], rbx
mov qword [0x1800b3d60], rbx
movups xmmword [0x1800b3d68], xmm0
movups xmmword [0x1800b3d78], xmm0
movups xmmword [0x1800b3d88], xmm0
mov qword [0x1800b3d98], rbx
lea edx, [rbx + 2]
lea rsi, [0x1800b3d50]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x18007aba0]
call fcn.180076ef8
lea rcx, [0x1800b3a10]
call fcn.180076f4c
jmp 0x1800248ef
xor ebx, ebx
lea rsi, [0x1800b3d50]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18002490d
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800b3d9c], 0x7fffffff
jne 0x18002492f
mov dword [0x1800b3d9c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov rdx, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180024940
mov rcx, qword [rdi]
movabs r9, 0xcbf29ce484222325
test rdx, rdx
je 0x180024973
movabs r8, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x180024960
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.1800188f0
cmp qword [rax + 8], 0
je 0x18002499e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x1800249cf
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1800249ab
mov rdx, qword [rdi]
mov rcx, qword [0x1800b3958]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x180024a19
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, ebx
jmp 0x180024a22
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180024a40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800b2f74]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x1800b3acc], r9d
jle 0x180024b16
lea rcx, [0x1800b3acc]
call fcn.180076fb8
cmp dword [0x1800b3acc], 0xffffffff
jne 0x180024b16
xor ebx, ebx
mov qword [0x1800b3c00], rbx
xorps xmm0, xmm0
movdqa xmmword [0x1800b3c20], xmm0
xorps xmm1, xmm1
movdqa xmmword [0x1800b3c30], xmm1
mov qword [0x1800b3c08], rbx
mov qword [0x1800b3c10], rbx
movups xmmword [0x1800b3c18], xmm0
movups xmmword [0x1800b3c28], xmm0
movups xmmword [0x1800b3c38], xmm0
mov qword [0x1800b3c48], rbx
lea edx, [rbx + 2]
lea rsi, [0x1800b3c00]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x18007ab90]
call fcn.180076ef8
lea rcx, [0x1800b3acc]
call fcn.180076f4c
jmp 0x180024b1f
xor ebx, ebx
lea rsi, [0x1800b3c00]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x180024b3d
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800b3c4c], 0x7fffffff
jne 0x180024b5f
mov dword [0x1800b3c4c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov rdx, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180024b70
mov rcx, qword [rdi]
movabs r9, 0xcbf29ce484222325
test rdx, rdx
je 0x180024ba3
movabs r8, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x180024b90
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.1800188f0
cmp qword [rax + 8], 0
je 0x180024bce
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x180024bff
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180024bdb
mov rdx, qword [rdi]
mov rcx, qword [0x1800b3958]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x180024c4b
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov edx, r14d
mov rcx, r15
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x180024c54
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180024c70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800b2f74]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x1800b3b20], r9d
jle 0x180024d46
lea rcx, [0x1800b3b20]
call fcn.180076fb8
cmp dword [0x1800b3b20], 0xffffffff
jne 0x180024d46
xor ebx, ebx
mov qword [0x1800b39c0], rbx
xorps xmm0, xmm0
movdqa xmmword [0x1800b39e0], xmm0
xorps xmm1, xmm1
movdqa xmmword [0x1800b39f0], xmm1
mov qword [0x1800b39c8], rbx
mov qword [0x1800b39d0], rbx
movups xmmword [0x1800b39d8], xmm0
movups xmmword [0x1800b39e8], xmm0
movups xmmword [0x1800b39f8], xmm0
mov qword [0x1800b3a08], rbx
lea edx, [rbx + 2]
lea rsi, [0x1800b39c0]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x18007ab80]
call fcn.180076ef8
lea rcx, [0x1800b3b20]
call fcn.180076f4c
jmp 0x180024d4f
xor ebx, ebx
lea rsi, [0x1800b39c0]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x180024d6d
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800b3a0c], 0x7fffffff
jne 0x180024d8f
mov dword [0x1800b3a0c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov rdx, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180024da0
mov rcx, qword [rdi]
movabs r9, 0xcbf29ce484222325
test rdx, rdx
je 0x180024dd3
movabs r8, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x180024dc0
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.1800188f0
cmp qword [rax + 8], 0
je 0x180024dfe
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x180024e2f
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180024e0b
mov rdx, qword [rdi]
mov rcx, qword [0x1800b3958]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x180024e76
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1800182d0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
nop
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
jmp 0x180024e7f
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180028a10
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x1800b2f74]
mov rax, qword gs:[0x58]
mov rdi, qword [rdx]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1800b3e70], ecx
jle 0x180028a72
lea rcx, [0x1800b3e70]
call fcn.180076fb8
cmp dword [0x1800b3e70], 0xffffffff
jne 0x180028a72
lea rcx, [0x18007ac40]
call fcn.180076ef8
lea rcx, [0x1800b3e70]
call fcn.180076f4c
mov rax, qword [0x1800b3070]
xor esi, esi
test rax, rax
je 0x180028a89
mov rcx, qword [rax + 0xa0]
jmp 0x180028a8c
mov rcx, rsi
cmp qword [rcx + 0x48], rsi
jne 0x180028a97
call fcn.18002a170
call fcn.18002bb10
call fcn.1800340f0
call fcn.180028130
cmp byte [0x1800b11a8], sil
je 0x180028abb
lea rcx, [0x1800b1190]
call fcn.180026290
xor edx, edx
lea rcx, str.UnityWndClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rbx
jne 0x180028af5
mov ecx, 0x77
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x180028af5
cmp byte [0x1800b11a8], sil
sete byte [0x1800b11a8]
call fcn.180036430
call fcn.180036840
mov rax, qword [rdi]
lea r8, [0x1800b3068]
xor r9d, r9d
mov rcx, rdi
lea edx, [r9 + 1]
call qword [rax + pe_nt_image_headers64]
mov rax, qword [0x1800b3070]
mov rcx, qword [rax + 0x4210]
mov rcx, qword [rcx]
add rcx, 0xa8
cmp byte [rcx], sil
cmove rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.180029710
Function at 0x18002bb10
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [0x1800b1040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x58], rsi
mov rsi, qword [0x1800b3070]
test rsi, rsi
je 0x18002bb3f
mov rdi, qword [rsi + 0x98]
jmp 0x18002bb41
xor edi, edi
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
movdqu xmmword [rsp + 0x20], xmm0
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x28]
sub eax, dword [rsp + 0x20]
movd xmm1, eax
mov eax, dword [rsp + 0x2c]
sub eax, dword [rsp + 0x24]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rsi + 0x10], xmm1
movss dword [rsi + 0x14], xmm0
cmp byte [rdi + 0x2e], 0
je 0x18002bb8b
call fcn.18002baa0
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x30]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [rdi + 0x18]
cvtsi2ss xmm0, qword [rdi + 0x20]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rsi + 0x18], xmm1
mov qword [rdi + 0x18], rcx
call fcn.18002b0a0
mov rax, qword [0x1800b3070]
cmp byte [rax + 0x2f10], 0
je 0x18002bc24
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x18002bc24
mov rbx, qword [0x1800b3070]
xorps xmm3, xmm3
xor r8d, r8d
mov edx, 0x210
lea rcx, [rbx + 8]
call fcn.18002ef90
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov rax, qword [0x1800b3070]
cmp byte [rax + 0x2f50], 0
je 0x18002bc75
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x18002bc75
mov rbx, qword [0x1800b3070]
xorps xmm3, xmm3
xor r8d, r8d
mov edx, 0x214
lea rcx, [rbx + 8]
call fcn.18002ef90
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov rax, qword [0x1800b3070]
cmp byte [rax + 0x2f30], 0
je 0x18002bcc6
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x18002bcc6
mov rbx, qword [0x1800b3070]
xorps xmm3, xmm3
xor r8d, r8d
mov edx, 0x212
lea rcx, [rbx + 8]
call fcn.18002ef90
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov rax, qword [0x1800b3070]
cmp byte [rax + 0x2f70], 0
je 0x18002bd17
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x18002bd17
mov rbx, qword [0x1800b3070]
xorps xmm3, xmm3
xor r8d, r8d
mov edx, 0x216
lea rcx, [rbx + 8]
call fcn.18002ef90
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
cmp byte [rsi + 0x78], 0
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
je 0x18002bd2e
mov eax, 0xffffffff
jmp 0x18002bd3b
mov rax, qword [0x1800b3070]
mov eax, dword [rax + 0x43f8]
cmp dword [rdi + 0x28], eax
je 0x18002bd48
mov dword [rdi + 0x28], eax
call fcn.18002af30
call fcn.18002b310
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180076b00
add rsp, 0x40
pop rdi
ret
Function at 0x18002f120
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18002f17d
lea rbx, [0x18009bc90]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18002f164
cmp r10, 2
jb 0x18002f164
cmp byte [r9], r8b
jne 0x18002f164
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18002f140
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18002f1bf
lea rbx, [0x18009bc90]
cmp r8b, 0x23
jne 0x18002f1a3
cmp byte [r9], r8b
jne 0x18002f1a3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18002f190
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x18002f300
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18002f31a
mov qword [r8], 0
lea rdx, [0x1800a0fbc]
call fcn.18002f1d0
mov rbx, rax
test rax, rax
jne 0x18002f33a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x18002f411
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18002f411
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18002f411
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18002f411
cmp rdi, 0xffffffffffffffff
je 0x18002f411
mov rax, qword [0x1800b3070]
test rax, rax
je 0x18002f3ae
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x18002f411
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x18002f3fe
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1800b3070]
test rax, rax
je 0x18002f3f3
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18002f41a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x18002f40c
mov qword [r14], rdi
mov rax, rsi
jmp 0x18002f41c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1800321f0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x108]
mov rax, qword [rcx + 0x110]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x18009bc90]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x1800b3070]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x401c], ebx
jne 0x180032286
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.180050ad0
mov eax, ebx
add rsp, 0x20
pop rbx
ret