joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f3bb0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1400e75e8
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400f3c51
cmp ebx, dword [rsp + 0x30]
je 0x1400f3c4a
test esi, esi
je 0x1400f3c4a
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1400f3c25
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1400f3c32
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1400f3c0f
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1400f3c36
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400f3c53
mov eax, 1
jmp 0x1400f3c53
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400f7bec
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400e9ca4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400e9ca4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400f7d3c
cmp rax, 0xffffffffffffffff
je 0x1400f7d3c
xor edi, edi
test rbp, rbp
jle 0x1400f7ce7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400e7a20
mov rbx, rax
test rax, rax
jne 0x1400f7c74
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400f7cdd
mov edx, 0x8000
mov ecx, r14d
call fcn.1400e56d0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400ebc8c
cmp eax, 0xffffffff
je 0x1400f7cbd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400f7c84
mov edx, r15d
mov ecx, r14d
call fcn.1400e56d0
jmp 0x1400f7cdd
cmp byte [rsi + 0x38], dil
je 0x1400f7cd4
cmp dword [rsi + 0x34], 5
jne 0x1400f7cd4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400f7cdd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400e7a98
jmp 0x1400f7d50
jns 0x1400f7d50
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400e9ca4
cmp rax, 0xffffffffffffffff
jne 0x1400f7d08
cmp byte [rsi + 0x30], dil
je 0x1400f7d50
mov edi, dword [rsi + 0x2c]
jmp 0x1400f7d50
mov ecx, r14d
call fcn.1400f165c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400f7d50
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400f7d50
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400f7d49
mov eax, dword [rsi + 0x2c]
jmp 0x1400f7d4e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400e9ca4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140015740
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0xe8]
sub rsp, 0x1e0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x140274040]
xor rax, rsp
mov qword [rbp + 0xc0], rax
cmp byte [0x1402964e4], 0
jne 0x14001593b
movabs rsi, 0x7fffffffffffffff
mov r14d, 0xff
mov edi, dword [rsp + 0x48]
movsd xmm6, qword [rsp + 0x40]
nop
mov eax, dword [0x1402964f4]
inc eax
movsxd rbx, eax
lea rcx, [rsp + 0x50]
call fcn.1400019a0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
test rbx, rbx
je 0x1400157f5
js 0x1400157f5
imul r8, rbx, 0xf4240
mov rdx, rsi
sub rdx, r8
cmp rax, rdx
je 0x1400157f0
mov ecx, 1
cmovl ecx, r14d
test cl, cl
jns 0x1400157f0
lea rcx, [r8 + rax]
mov qword [rsp + 0x30], rcx
jmp 0x1400157f5
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x30]
call fcn.140004760
cmp byte [0x1402963f0], 0
je 0x14001592e
cmp qword [0x1402977e0], 0
je 0x14001592e
lea rcx, [rbp + 0x20]
call fcn.140015970
mov qword [rbp + 0xb8], 0
movd xmm1, dword [0x140296404]
cvtdq2ps xmm1, xmm1
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
movzx r9d, byte [0x1402963f8]
mov r8d, dword [0x140296400]
call fcn.140024850
test al, al
je 0x140015925
mov ecx, dword [0x1402963f4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140015925
cmp byte [rbp + 0x60], 0
jne 0x140015925
cmp byte [0x1402963f9], 0
je 0x140015893
cmp byte [rbp + 0xb4], 0
je 0x140015925
mov ecx, dword [0x1402963fc]
test ecx, ecx
je 0x1400158db
sub ecx, 1
je 0x1400158c1
cmp ecx, 1
jne 0x140015902
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.140015a20
mov r9d, 0x60f2
lea rdx, [rsp + 0x58]
jmp 0x1400158f3
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.140015a20
mov r9d, 0x9995
lea rdx, [rsp + 0x64]
jmp 0x1400158f3
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.140015a20
mov r9d, 0x796e
lea rdx, [rsp + 0x70]
mov r8, rax
call fcn.140023fd0
movsd xmm6, qword [rax]
mov edi, dword [rax + 8]
movsd qword [rsp + 0x40], xmm6
mov dword [rsp + 0x48], edi
mov r9d, dword [0x14029640c]
mov r8d, dword [0x140296408]
lea rdx, [rsp + 0x40]
call fcn.140024c80
nop
lea rcx, [rbp + 0x20]
call fcn.140004d30
cmp byte [0x1402964e4], 0
je 0x1400157a0
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.14006de40
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
Function at 0x140015b60
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov rbp, rcx
movzx esi, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rsi, rax
movabs rcx, 0x100000001b3
imul rsi, rcx
movzx eax, byte [r8 + 1]
xor rsi, rax
imul rsi, rcx
movzx eax, byte [r8 + 2]
xor rsi, rax
imul rsi, rcx
movzx eax, byte [r8 + 3]
xor rsi, rax
imul rsi, rcx
mov rcx, rsi
and rcx, qword [rbp + 0x30]
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rbp + 8]
mov r12, qword [rdx]
cmp rbx, r12
jne 0x140015be7
mov rbx, r12
mov r15, r12
jmp 0x140015c2a
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x140015c01
cmp rbx, rcx
je 0x140015c24
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x140015bf3
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r12, rbx
mov r15, rbx
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rbp + 0x10], rax
jne 0x140015c48
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, 0x18
call fcn.14006de60
mov rdi, rax
mov qword [rsp + 0x28], rax
mov rax, qword [r13]
mov qword [rdi + 0x10], rax
mov rdx, qword [rbp + 0x10]
add rdx, 1
xorps xmm0, xmm0
js 0x140015c84
cvtsi2ss xmm0, rdx
jmp 0x140015c9c
mov rcx, rdx
shr rcx, 1
mov rax, rdx
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
mov rcx, qword [rbp + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x140015caf
cvtsi2ss xmm1, rcx
jmp 0x140015cc4
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rbp]
jbe 0x140015d35
mov rcx, rbp
call fcn.140015f50
mov rdx, rax
mov rcx, rbp
call fcn.140015da0
mov rdx, rsi
and rdx, qword [rbp + 0x30]
add rdx, rdx
mov rcx, qword [rbp + 0x18]
mov rax, qword [rcx + rdx*8 + 8]
mov rbx, qword [rbp + 8]
cmp rax, rbx
jne 0x140015d08
mov qword [rsp + 0x28], 0
jmp 0x140015d28
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x140015d25
mov rbx, rax
cmp rax, rdx
je 0x140015d66
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x140015d14
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov r15, rbx
mov r12, qword [rsp + 0x20]
mov rcx, qword [rbx + 8]
inc qword [rbp + 0x10]
mov qword [rdi], r12
mov qword [rdi + 8], rcx
mov qword [rcx], rdi
mov qword [rbx + 8], rdi
mov rax, qword [rbp + 0x18]
and rsi, qword [rbp + 0x30]
add rsi, rsi
mov rdx, qword [rax + rsi*8]
cmp rdx, qword [rbp + 8]
jne 0x140015d76
mov qword [rax + rsi*8], rdi
jmp 0x140015d88
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
jmp 0x140015d2d
cmp rdx, r15
jne 0x140015d81
mov qword [rax + rsi*8], rdi
jmp 0x140015d8d
cmp qword [rax + rsi*8 + 8], rcx
jne 0x140015d8d
mov qword [rax + rsi*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x140015c09
Function at 0x140015da0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x140015dd5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400031e0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140015f14
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rbp
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140015e8d
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140015f03
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x140015eca
mov r10, qword [rdx]
cmp r10, rax
je 0x140015ec4
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140015f03
cmp r9, rdx
je 0x140015edf
nop
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x140015f25
cmp r9, rdx
jne 0x140015ed0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x140015e40
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140015f03
Function at 0x140015ff0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, qword [rcx]
test rdi, rdi
je 0x14001609c
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14001609c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x140016033
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x1400160b0
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14001606a
mov qword [rsp + 0x48], rbx
nop
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.14006e0e4
mov rcx, rbx
test rbx, rbx
jne 0x140016050
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.1400041b0
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x1400161b4
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.14006e0e4
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x1400161c0
cmp rbx, rbp
jne 0x140016160
cmp qword [rsp + 0x20], r14
jne 0x14001618d
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x1400161cf
mov qword [r15], r12
mov rax, r12
jmp 0x1400161d2
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x14001618d
nop dword [rax + rax]
movzx r15d, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r15, rax
movzx eax, byte [rbx + 0x11]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x12]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x13]
imul r15, rdx
xor r15, rax
imul r15, rdx
and r15, qword [rsi + 0x30]
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.14006e0e4
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x140016258
cmp rbx, rbp
jne 0x140016232
jmp 0x14001618a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x1400161e0
jmp 0x14001618d
Function at 0x1400160b0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, qword [rcx]
test rdi, rdi
je 0x14001609c
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14001609c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x140016033
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x1400160b0
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14001606a
mov qword [rsp + 0x48], rbx
nop
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.14006e0e4
mov rcx, rbx
test rbx, rbx
jne 0x140016050
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.1400041b0
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x1400161b4
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.14006e0e4
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x1400161c0
cmp rbx, rbp
jne 0x140016160
cmp qword [rsp + 0x20], r14
jne 0x14001618d
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x1400161cf
mov qword [r15], r12
mov rax, r12
jmp 0x1400161d2
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x14001618d
nop dword [rax + rax]
movzx r15d, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r15, rax
movzx eax, byte [rbx + 0x11]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x12]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x13]
imul r15, rdx
xor r15, rax
imul r15, rdx
and r15, qword [rsi + 0x30]
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.14006e0e4
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x140016258
cmp rbx, rbp
jne 0x140016232
jmp 0x14001618a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x1400161e0
jmp 0x14001618d
Function at 0x1400167c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0xe8]
sub rsp, 0x1e0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x140274040]
xor rax, rsp
mov qword [rbp + 0xc0], rax
cmp byte [0x1402964e4], 0
jne 0x1400169ca
movabs rsi, 0x7fffffffffffffff
mov r14d, 0xff
mov edi, dword [rsp + 0x48]
movsd xmm6, qword [rsp + 0x40]
nop
mov eax, dword [0x1402964f4]
inc eax
movsxd rbx, eax
lea rcx, [rsp + 0x50]
call fcn.1400019a0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
test rbx, rbx
je 0x140016875
js 0x140016875
imul r8, rbx, 0xf4240
mov rdx, rsi
sub rdx, r8
cmp rax, rdx
je 0x140016870
mov ecx, 1
cmovl ecx, r14d
test cl, cl
jns 0x140016870
lea rcx, [r8 + rax]
mov qword [rsp + 0x30], rcx
jmp 0x140016875
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x30]
call fcn.140004760
cmp byte [0x140296424], 0
je 0x1400169bd
cmp qword [0x1402977e0], 0
je 0x1400169bd
lea rcx, [rbp + 0x20]
call fcn.140015970
mov qword [rbp + 0xb8], 0
movd xmm1, dword [0x140296428]
cvtdq2ps xmm1, xmm1
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
movzx r9d, byte [0x140296430]
mov r8d, dword [0x140296434]
call fcn.140024850
test al, al
je 0x14001699f
cmp byte [rbp + 0x60], 0
jne 0x14001699f
cmp byte [0x1402963f9], 0
je 0x1400168fe
cmp byte [rbp + 0xb4], 0
je 0x14001699f
mov ecx, dword [0x14029642c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14001699f
mov ecx, dword [0x140296438]
test ecx, ecx
je 0x14001695b
sub ecx, 1
je 0x140016941
cmp ecx, 1
jne 0x140016982
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.140015a20
mov r9d, 0x60f2
lea rdx, [rsp + 0x58]
jmp 0x140016973
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.140015a20
mov r9d, 0x9995
lea rdx, [rsp + 0x64]
jmp 0x140016973
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.140015a20
mov r9d, 0x796e
lea rdx, [rsp + 0x70]
mov r8, rax
call fcn.140023fd0
movsd xmm6, qword [rax]
mov edi, dword [rax + 8]
movsd qword [rsp + 0x40], xmm6
mov dword [rsp + 0x48], edi
lea rcx, [rsp + 0x40]
call fcn.140016460
mov byte [0x140297488], 1
jmp 0x1400169b4
cmp byte [0x140297488], 0
je 0x1400169b4
call fcn.140016270
mov byte [0x140297488], 0
lea rcx, [rbp + 0x20]
call fcn.140004d30
cmp byte [0x1402964e4], 0
je 0x140016820
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.14006de40
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
Function at 0x1400174a0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1400174d1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x140297528]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x140297538]
lea rdx, [rdi + rdi]
call fcn.1400031e0
mov rax, qword [0x140297528]
lea r9, [rdi - 1]
mov qword [0x140297550], r9
mov qword [0x140297558], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140017672
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x140297538]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1400175bc
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140017633
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x1400175f9
mov r10, qword [rdx]
cmp r10, rax
je 0x1400175f3
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140017633
cmp r9, rdx
je 0x14001760f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x140017647
cmp r9, rdx
jne 0x140017600
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x14001766d
mov r9, qword [0x140297550]
jmp 0x140017541
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140017633
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret