joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18018b160
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
mov eax, 0x13c0
call fcn.1803384b0
sub rsp, rax
mov rax, qword [0x180a3f180]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov ebx, edx
mov esi, ecx
call fcn.18031632c
mov dword [rsp + 0x24], eax
mov r9d, 1
mov dword [rsp + 0x13a4], 0xffffffff
mov r8d, eax
shr r8d, 0x1e
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x18018b1a3
btc esi, 0x1f
mov dword [rsp + 0x20], 0x270
btc ebx, 0x1f
lea rcx, [rsp + 0x20]
sub ebx, esi
cmp ebx, 0xffffffff
jne 0x18018b1ed
call fcn.180135580
mov ecx, eax
jmp 0x18018b236
mov qword [rsp + 0x13d0], rdi
inc ebx
call fcn.180135580
mov ecx, eax
mov edi, ebx
imul rcx, rdi
cmp ecx, ebx
jae 0x18018b22a
mov eax, ebx
xor edx, edx
neg eax
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x18018b22a
lea rcx, [rsp + 0x20]
call fcn.180135580
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jb 0x18018b216
mov rdi, qword [rsp + 0x13d0]
shr rcx, 0x20
lea eax, [rsi + rcx]
xor eax, 0x80000000
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.1803373e0
mov rbx, qword [rsp + 0x13d8]
add rsp, 0x13c0
pop rsi
ret

Function at 0x18018db40
Capabilities:
Enumerate process modules

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x180a3f180]
xor rax, rsp
mov qword [rsp + 0x260], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18018db9a
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
mov rcx, rbx
test eax, eax
jne 0x18018db9e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18018dbe7
mov qword [rsp + 0x280], rdi
lea rdx, [rsp + 0x20]
mov edi, 1
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x18018dbd4
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
inc edi
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x18018dbc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rdi, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1803373e0
add rsp, 0x270
pop rbx
ret
Function at 0x18018dc00
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x180a57f48]
test rax, rax
jne 0x18018de2b
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, 0x48
call fcn.180337400
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
lea rcx, [0x18018e070]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [rsp + 0x30]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x18018dd49
movabs rbp, 0x66617263656e694d
nop
lea rdi, [rbx + 0x28]
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x18018dc92
mov rdi, qword [rdi]
cmp rax, 9
jb 0x18018dceb
lea rsi, [rax + rdi]
lea r8, [rsi - 8]
sub r8, rdi
mov edx, 0x4d
mov rcx, rdi
call fcn.180375120
test rax, rax
je 0x18018dceb
cmp qword [rax], rbp
jne 0x18018dcc0
cmp byte [rax + 8], 0x74
je 0x18018dcde
inc rax
lea r8, [rsi - 8]
sub r8, rax
mov edx, 0x4d
mov rcx, rax
call fcn.180375120
test rax, rax
jne 0x18018dcb5
jmp 0x18018dceb
sub rax, rdi
cmp rax, 0xffffffffffffffff
jne 0x18018de44
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x18018dd18
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x18018dd13
nop
cmp rbx, qword [rax + 0x10]
jne 0x18018dd13
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x18018dd00
mov rbx, rax
jmp 0x18018dd3f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x18018dd3f
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x18018dd30
cmp byte [rbx + 0x19], 0
je 0x18018dc80
mov rax, qword [0x180a57f48]
mov qword [rsp + 0xa0], rax
lea rax, str.Minecraft_window_handle:_0x:X
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x1f
call fcn.1801ea340
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], rcx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x70], xmm1
movsd xmm0, qword [rsp + 0x60]
movsd qword [rsp + 0x80], xmm0
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.1800a0970
nop
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rcx + 8]
cmp byte [rdi + 0x19], 0
jne 0x18018de1a
nop dword [rax]
mov r8, qword [rdi + 0x10]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.1800745a0
mov rbx, rdi
mov rdi, qword [rdi]
lea rcx, [rbx + 0x28]
call fcn.1800172b0
mov edx, 0x48
mov rcx, rbx
call fcn.180337884
cmp byte [rdi + 0x19], 0
je 0x18018dde0
mov rcx, qword [rsp + 0x30]
mov edx, 0x48
call fcn.180337884
mov rax, qword [0x180a57f48]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov qword [0x180a57f48], rax
jmp 0x18018dd50
Function at 0x18018e080
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x180a3f180]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x18018e0fe
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
jne 0x18018e10e
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], r15
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
jmp 0x18018e240
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov rsi, r15
mov qword [rsp + 0x30], r15
mov rbx, qword [rsp + 0x28]
nop dword [rax]
nop dword [rax + rax]
lea rax, [rbp + 0xa0]
mov r9, 0xffffffffffffffff
nop
inc r9
cmp byte [rax + r9], 0
jne 0x18018e140
lea rax, [rbp + 0xa0]
add rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
lea rcx, [rbp + 0xa0]
cmp rcx, rax
jne 0x18018e188
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r15w
jmp 0x18018e19a
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x48]
call fcn.18018e610
nop
cmp rbx, rsi
je 0x18018e1b7
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.18017a980
add rbx, 0x20
mov qword [rsp + 0x28], rbx
jmp 0x18018e1d3
lea r8, [rsp + 0x48]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.18018e760
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x18018e211
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18018e20c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18018e26f
call fcn.180337884
lea rdx, [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x18018e130
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x20]
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rsi
mov rax, rdi
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1803373e0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1803459e4
nop
int3
Function at 0x18018f500
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r9
mov rbx, r8
mov rsi, rdx
lea rax, [0x180a40408]
mov qword [rsp + 0x30], rax
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov ecx, 0x40
call fcn.180337400
mov rbp, rax
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rax + 0x20], r15
mov qword [rax + 0x28], r15
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rbx + r8], r15b
jne 0x18018f560
mov rdx, rbx
lea rcx, [rax + 0x10]
call fcn.18000c860
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x30], xmm0
mov r8, qword [rbp + 0x20]
lea rdx, [rbp + 0x10]
mov r14, qword [rbp + 0x28]
cmp r14, 0xf
jbe 0x18018f593
mov rdx, qword [rbp + 0x10]
movabs rbx, 0xcbf29ce484222325
mov rcx, r15
test r8, r8
je 0x18018f5c3
movabs r9, 0x100000001b3
nop
movzx eax, byte [rdx + rcx]
xor rbx, rax
imul rbx, r9
inc rcx
cmp rcx, r8
jb 0x18018f5b0
mov r9, rbx
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x20]
call fcn.180162f60
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x18018f648
mov qword [rsi], rax
mov byte [rsi + 8], 0
test rbp, rbp
je 0x18018f6f8
cmp r14, 0xf
jbe 0x18018f626
lea rdx, [r14 + 1]
mov rcx, qword [rbp + 0x10]
cmp rdx, 0x1000
jb 0x18018f621
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18018f721
mov rcx, r8
call fcn.180337884
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov edx, 0x40
mov rcx, rbp
call fcn.180337884
jmp 0x18018f6f8
mov rcx, qword [0x180a40410]
movabs rax, 0x3ffffffffffffff
cmp rcx, rax
je 0x18018f714
add rcx, 1
xorps xmm1, xmm1
js 0x18018f672
cvtsi2ss xmm1, rcx
jmp 0x18018f687
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mov rcx, qword [0x180a40438]
xorps xmm0, xmm0
test rcx, rcx
js 0x18018f69d
cvtsi2ss xmm0, rcx
jmp 0x18018f6b2
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x180a40400]
comiss xmm0, xmm1
jae 0x18018f6e1
call fcn.1801623e0
lea r8, [rbp + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
call fcn.180162f60
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov r9, rbp
mov r8, qword [rsp + 0x20]
mov rdx, rbx
call fcn.1801624b0
mov qword [rsi], rax
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
lea rcx, str.unordered_map_set_too_long
call fcn.180310e8c
nop
call fcn.1803459e4
int3
Function at 0x18018f730
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rbx, r9
mov rsi, rdx
lea rax, [0x180a40408]
mov qword [rsp + 0x30], rax
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov ecx, 0x40
call fcn.180337400
mov rbp, rax
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rax + 0x20], r15
mov qword [rax + 0x28], r15
mov r8d, 0x17
lea rdx, str.cash_register_sound.wav
lea rcx, [rax + 0x10]
call fcn.18000c860
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x30], xmm0
mov r8, qword [rbp + 0x20]
lea rdx, [rbp + 0x10]
mov r14, qword [rbp + 0x28]
cmp r14, 0xf
jbe 0x18018f7b6
mov rdx, qword [rbp + 0x10]
movabs rbx, 0xcbf29ce484222325
mov rcx, r15
test r8, r8
je 0x18018f7e5
movabs r9, 0x100000001b3
movzx eax, byte [rdx + rcx]
xor rbx, rax
imul rbx, r9
inc rcx
cmp rcx, r8
jb 0x18018f7d2
mov r9, rbx
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x20]
call fcn.180162f60
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x18018f86a
mov qword [rsi], rax
mov byte [rsi + 8], 0
test rbp, rbp
je 0x18018f91a
cmp r14, 0xf
jbe 0x18018f848
lea rdx, [r14 + 1]
mov rcx, qword [rbp + 0x10]
cmp rdx, 0x1000
jb 0x18018f843
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18018f943
mov rcx, r8
call fcn.180337884
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov edx, 0x40
mov rcx, rbp
call fcn.180337884
jmp 0x18018f91a
mov rcx, qword [0x180a40410]
movabs rax, 0x3ffffffffffffff
cmp rcx, rax
je 0x18018f936
add rcx, 1
xorps xmm1, xmm1
js 0x18018f894
cvtsi2ss xmm1, rcx
jmp 0x18018f8a9
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mov rcx, qword [0x180a40438]
xorps xmm0, xmm0
test rcx, rcx
js 0x18018f8bf
cvtsi2ss xmm0, rcx
jmp 0x18018f8d4
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x180a40400]
comiss xmm0, xmm1
jae 0x18018f903
call fcn.1801623e0
lea r8, [rbp + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
call fcn.180162f60
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov r9, rbp
mov r8, qword [rsp + 0x20]
mov rdx, rbx
call fcn.1801624b0
mov qword [rsi], rax
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
lea rcx, str.unordered_map_set_too_long
call fcn.180310e8c
nop
call fcn.1803459e4
int3
Function at 0x18018f950
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rbx, r9
mov rsi, rdx
lea rax, [0x180a40408]
mov qword [rsp + 0x30], rax
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov ecx, 0x40
call fcn.180337400
mov rbp, rax
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rax + 0x20], r15
mov qword [rax + 0x28], r15
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, str.product_sans
lea rcx, [rax + 0x10]
call fcn.18000c860
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x30], xmm0
mov r8, qword [rbp + 0x20]
lea rdx, [rbp + 0x10]
mov r14, qword [rbp + 0x28]
cmp r14, 0xf
jbe 0x18018f9d6
mov rdx, qword [rbp + 0x10]
movabs rbx, 0xcbf29ce484222325
mov rcx, r15
test r8, r8
je 0x18018fa05
movabs r9, 0x100000001b3
movzx eax, byte [rdx + rcx]
xor rbx, rax
imul rbx, r9
inc rcx
cmp rcx, r8
jb 0x18018f9f2
mov r9, rbx
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x20]
call fcn.180162f60
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x18018fa8a
mov qword [rsi], rax
mov byte [rsi + 8], 0
test rbp, rbp
je 0x18018fb3a
cmp r14, 0xf
jbe 0x18018fa68
lea rdx, [r14 + 1]
mov rcx, qword [rbp + 0x10]
cmp rdx, 0x1000
jb 0x18018fa63
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18018fb63
mov rcx, r8
call fcn.180337884
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov edx, 0x40
mov rcx, rbp
call fcn.180337884
jmp 0x18018fb3a
mov rcx, qword [0x180a40410]
movabs rax, 0x3ffffffffffffff
cmp rcx, rax
je 0x18018fb56
add rcx, 1
xorps xmm1, xmm1
js 0x18018fab4
cvtsi2ss xmm1, rcx
jmp 0x18018fac9
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mov rcx, qword [0x180a40438]
xorps xmm0, xmm0
test rcx, rcx
js 0x18018fadf
cvtsi2ss xmm0, rcx
jmp 0x18018faf4
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x180a40400]
comiss xmm0, xmm1
jae 0x18018fb23
call fcn.1801623e0
lea r8, [rbp + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
call fcn.180162f60
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov r9, rbp
mov r8, qword [rsp + 0x20]
mov rdx, rbx
call fcn.1801624b0
mov qword [rsi], rax
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
lea rcx, str.unordered_map_set_too_long
call fcn.180310e8c
nop
call fcn.1803459e4
int3
Function at 0x18018fb70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rbx, r9
mov rsi, rdx
lea rax, [0x180a40408]
mov qword [rsp + 0x30], rax
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov ecx, 0x40
call fcn.180337400
mov rbp, rax
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rax + 0x20], r15
mov qword [rax + 0x28], r15
mov r8d, 0x13
lea rdx, str.sf_pro_display_bold
lea rcx, [rax + 0x10]
call fcn.18000c860
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x30], xmm0
mov r8, qword [rbp + 0x20]
lea rdx, [rbp + 0x10]
mov r14, qword [rbp + 0x28]
cmp r14, 0xf
jbe 0x18018fbf6
mov rdx, qword [rbp + 0x10]
movabs rbx, 0xcbf29ce484222325
mov rcx, r15
test r8, r8
je 0x18018fc25
movabs r9, 0x100000001b3
movzx eax, byte [rdx + rcx]
xor rbx, rax
imul rbx, r9
inc rcx
cmp rcx, r8
jb 0x18018fc12
mov r9, rbx
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x20]
call fcn.180162f60
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x18018fcaa
mov qword [rsi], rax
mov byte [rsi + 8], 0
test rbp, rbp
je 0x18018fd5a
cmp r14, 0xf
jbe 0x18018fc88
lea rdx, [r14 + 1]
mov rcx, qword [rbp + 0x10]
cmp rdx, 0x1000
jb 0x18018fc83
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18018fd83
mov rcx, r8
call fcn.180337884
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov edx, 0x40
mov rcx, rbp
call fcn.180337884
jmp 0x18018fd5a
mov rcx, qword [0x180a40410]
movabs rax, 0x3ffffffffffffff
cmp rcx, rax
je 0x18018fd76
add rcx, 1
xorps xmm1, xmm1
js 0x18018fcd4
cvtsi2ss xmm1, rcx
jmp 0x18018fce9
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mov rcx, qword [0x180a40438]
xorps xmm0, xmm0
test rcx, rcx
js 0x18018fcff
cvtsi2ss xmm0, rcx
jmp 0x18018fd14
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x180a40400]
comiss xmm0, xmm1
jae 0x18018fd43
call fcn.1801623e0
lea r8, [rbp + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
call fcn.180162f60
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov r9, rbp
mov r8, qword [rsp + 0x20]
mov rdx, rbx
call fcn.1801624b0
mov qword [rsi], rax
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
lea rcx, str.unordered_map_set_too_long
call fcn.180310e8c
nop
call fcn.1803459e4
int3
Function at 0x180191530
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x180a3f180]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov qword [rbp - 9], rcx
xor ecx, ecx
xor esi, esi
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1801915e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 9], eax
lea rax, str.Failed_to_open_clipboard:_
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], 0x1c
call fcn.1801ea340
movaps xmm0, xmmword [rbp - 0x19]
lea rcx, [rbp - 9]
movdqa xmmword [rbp - 0x19], xmm0
lea r9, [rbp - 0x19]
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0x27]
mov qword [rbp + 7], rsi
mov rcx, rax
mov qword [rbp - 1], rsi
movups xmm1, xmmword [rbp - 1]
mov qword [rbp + 0xf], rsi
movsd xmm0, qword [rbp + 0xf]
movsd qword [rbp + 0x37], xmm0
movaps xmmword [rbp + 0x27], xmm1
call fcn.1800a0c20
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], sil
jmp 0x1801916db
mov ecx, 1
mov qword [rsp + 0xb8], rdi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
jne 0x180191678
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 9], eax
lea rax, str.Failed_to_get_clipboard_text:_
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], 0x20
call fcn.1801ea340
movaps xmm0, xmmword [rbp - 0x19]
lea rcx, [rbp - 9]
movdqa xmmword [rbp - 0x19], xmm0
lea r9, [rbp - 0x19]
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0x27]
mov qword [rbp + 7], rsi
mov rcx, rax
mov qword [rbp - 1], rsi
movups xmm1, xmmword [rbp - 1]
mov qword [rbp + 0xf], rsi
movsd xmm0, qword [rbp + 0xf]
movsd qword [rbp + 0x37], xmm0
movaps xmmword [rbp + 0x27], xmm1
call fcn.1800a0c20
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], sil
jmp 0x1801916d3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x180191600
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x27], xmm0
mov r8, 0xffffffffffffffff
movdqu xmmword [rbp + 0x37], xmm1
inc r8
cmp byte [rax + r8], sil
jne 0x1801916a0
mov rdx, rax
lea rcx, [rbp + 0x27]
call fcn.18000c860
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
movups xmm0, xmmword [rbp + 0x27]
movups xmm1, xmmword [rbp + 0x37]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov rdi, qword [rsp + 0xb8]
mov rax, rbx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1803373e0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180195990
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x168
mov rax, qword [0x180a3f180]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor ebp, ebp
mov qword [rsp + 0x38], rcx
cmp qword [r9 + 0x18], 0xf
mov rdi, r9
mov rsi, r8
mov rbx, rcx
jbe 0x1801959c8
mov rdi, qword [r9]
cmp qword [r8 + 0x18], 0xf
jbe 0x1801959d2
mov rsi, qword [r8]
cmp qword [rdx + 0x18], 0xf
jbe 0x1801959dc
mov rdx, qword [rdx]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], 0xff
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180195a90
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x180195a5b
xorps xmm0, xmm0
mov r8, 0xffffffffffffffff
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
nop dword [rax]
inc r8
cmp byte [rdi + r8], bpl
jne 0x180195a50
jmp 0x180195aae
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rbp
inc r8
cmp byte [rax + r8], bpl
jne 0x180195a80
lea rdx, [rsp + 0x50]
jmp 0x180195ab1
xorps xmm0, xmm0
mov r8, 0xffffffffffffffff
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
inc r8
cmp byte [rdi + r8], bpl
jne 0x180195aa5
mov rdx, rdi
mov rcx, rbx
call fcn.18000c860
mov rax, rbx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1803373e0
add rsp, 0x168
pop rdi
pop rsi
pop rbp
pop rbx
ret