joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801fa800
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x90
mov rax, qword [0x180acd980]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov r12, rdx
mov r13, rcx
mov qword [rsp + 0x20], rdx
mov rdx, qword [rdx]
add rdx, 8
lea rcx, [rsp + 0x48]
call fcn.18000e6d0
nop
lea r8, [rsp + 0x48]
mov rbp, qword [rsp + 0x48]
mov r14, qword [rsp + 0x60]
cmp r14, 0xf
cmova r8, rbp
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x1801fa894
movabs r9, 0x100000001b3
nop
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x1801fa880
mov rcx, qword [r13 + 0x120]
and rcx, rdx
add rcx, rcx
mov rax, qword [r13 + 0x108]
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r13 + 0xf8]
je 0x1801fa8f9
mov rsi, qword [rax + rcx*8]
nop word [rax + rax]
lea rdx, [rbx + 0x10]
cmp qword [rbx + 0x28], 0xf
jbe 0x1801fa8cf
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x48]
cmp r14, 0xf
cmova rcx, rbp
cmp rdi, qword [rbx + 0x20]
jne 0x1801fa8ee
mov r8, rdi
call fcn.180381530
test eax, eax
je 0x1801fa8fb
cmp rbx, rsi
je 0x1801fa8f9
mov rbx, qword [rbx + 8]
jmp 0x1801fa8c0
xor ebx, ebx
test rbx, rbx
cmove rbx, qword [r13 + 0xf8]
lea r8, [rsp + 0x48]
cmp rbx, qword [r13 + 0xf8]
jne 0x1801fa9f1
lea rcx, [r13 + 0xf0]
lea rdx, [rsp + 0x28]
call fcn.1801eed30
mov rcx, qword [rax]
add rcx, 0x30
mov rdx, r12
call fcn.1800eac80
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x1801fa972
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801fa96d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801fa9eb
call fcn.180342c24
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
mov rbx, qword [r12 + 8]
test rbx, rbx
je 0x1801fa9bf
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1801fa9bf
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1801fa9bf
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180342780
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
call fcn.180350d84
nop
lea rdx, str.logger_with_name_
lea rcx, [rsp + 0x68]
call fcn.18002b7b0
nop
lea r8, str._already_exists
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.18002aaa0
mov rcx, rax
call fcn.1801fb0d0
int3
Function at 0x1802000f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x180acd980]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx + 0x10]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1802002d6
mov rbx, qword [rcx + 0x18]
mov qword [rsp + 0x30], rbx
mov rcx, rbx
call fcn.18031c5e8
test eax, eax
jne 0x180200303
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
je 0x18020030e
xor r14d, r14d
mov qword [rsi + 0x28], r14
mov qword [rsi + 0x30], r14
mov qword [rsp + 0x60], r14
lea r15, vtable.fmt::v8::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], 0xfa
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
mov rdx, rsi
call qword [rax + 8]
cmp byte [rdi + 0x20], r14b
je 0x18020026a
mov r8, qword [rsi + 0x28]
cmp qword [rsi + 0x30], r8
jbe 0x18020026a
test r8, r8
je 0x1802001c8
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
movsxd rax, dword [rsi + 0x10]
movzx ebp, word [rdi + rax*2 + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x1802001eb
mov ebp, 7
jmp 0x180200206
mov edx, dword [rsp + 0x40]
and edx, 0xfff0
or edx, ebp
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movzx ebp, word [rsp + 0x40]
mov r8, qword [rsi + 0x30]
mov rcx, qword [rsi + 0x28]
cmp r8, rcx
jbe 0x180200230
sub r8d, ecx
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
movzx edx, bp
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [rsi + 0x30]
mov r8, qword [rsp + 0x60]
cmp r8, rcx
jbe 0x18020028e
sub r8d, ecx
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
jmp 0x18020028e
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
je 0x1802002ce
mov rdx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1802002c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1802002fd
call fcn.180342c24
nop
mov rcx, rbx
call fcn.18031c5f0
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180342780
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x180
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.180350d84
nop
mov ecx, 5
call fcn.18031c864
int3
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call fcn.18031c864
int3
Function at 0x18020e990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
push rbx
push r12
push r15
sub rsp, 0x50
movaps xmmword [rax - 0x38], xmm6
mov r15, rdx
movaps xmmword [rax - 0x48], xmm7
mov r12, rcx
mov qword [rax + 0x10], rbp
xor ebp, ebp
mov qword [rax + 0x18], rsi
mov ebx, ebp
mov qword [rax + 0x20], rdi
mov qword [rax - 0x20], r13
lea r13, [rcx + 1]
mov qword [rax - 0x28], r14
movzx eax, byte [rcx]
cmp al, 0x2d
mov byte [rsp + 0x70], al
cmovne r13, rcx
mov rdi, r13
movzx eax, byte [r13]
cmp al, 0x2d
jne 0x18020ea2a
movzx ecx, byte [r13 + 1]
lea rbx, [r13 + 1]
mov esi, ebp
call fcn.180259340
test eax, eax
je 0x18020ea1b
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rbx]
lea ecx, [rsi - 6]
lea ecx, [rsi + rcx*4]
inc rbx
lea esi, [rax + rcx*2]
movzx ecx, byte [rbx]
call fcn.180259340
test eax, eax
jne 0x18020ea00
cmp rbx, r13
jbe 0x18020ea65
mov ebp, esi
test esi, esi
je 0x18020ea65
neg ebp
jmp 0x18020ea65
mov ecx, eax
call fcn.180259340
test eax, eax
je 0x18020ea62
nop word [rax + rax]
movsx eax, byte [rdi]
lea ecx, [rbx - 6]
lea ecx, [rbx + rcx*4]
inc rdi
lea ebx, [rax + rcx*2]
movzx ecx, byte [rdi]
call fcn.180259340
test eax, eax
jne 0x18020ea40
cmp rdi, r13
jbe 0x18020ea62
mov ebp, ebx
mov rbx, rdi
mov r14, qword [rsp + 0x40]
sub rbx, r13
mov rsi, qword [rsp + 0x80]
xorps xmm6, xmm6
mov eax, ebp
add rbx, r13
mov r13, qword [rsp + 0x48]
xorps xmm7, xmm7
mov rbp, qword [rsp + 0x78]
cmp byte [rbx], 0x2e
cvtsi2sd xmm6, rax
addsd xmm6, xmm7
jne 0x18020eae3
movzx ecx, byte [rbx + 1]
inc rbx
mov edi, 0xa
call fcn.180259340
test eax, eax
je 0x18020eae3
nop dword [rax]
movsx eax, byte [rbx]
xorps xmm1, xmm1
movzx ecx, byte [rbx + 1]
sub eax, 0x30
movd xmm0, edi
inc rbx
cvtdq2pd xmm0, xmm0
lea edi, [rdi + rdi*4]
add edi, edi
cvtsi2sd xmm1, rax
divsd xmm1, xmm0
addsd xmm6, xmm1
call fcn.180259340
test eax, eax
jne 0x18020eab0
mov rdi, qword [rsp + 0x88]
test r15, r15
je 0x18020eb10
cmp rbx, r12
jbe 0x18020eb10
cmp byte [rsp + 0x70], 0x2d
jne 0x18020eb0b
ucomisd xmm6, xmm7
jp 0x18020eb04
je 0x18020eb0b
xorps xmm6, xmmword [0x180426e70]
movsd qword [r15], xmm6
movaps xmm6, xmmword [rsp + 0x30]
sub rbx, r12
movaps xmm7, xmmword [rsp + 0x20]
mov rax, rbx
add rsp, 0x50
pop r15
pop r12
pop rbx
ret
Function at 0x180213510
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rdi
sub rsp, 0x28
mov qword [rsp + 0x40], rbp
mov rbx, rcx
mov qword [rsp + 0x48], rsi
xor edx, edx
mov qword [rsp + 0x50], r12
xor ecx, ecx
mov qword [rsp + 0x20], r15
call fcn.180244ab0
mov ecx, 0x17
mov edi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, 1
mov r15d, eax
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r12d, 3
test ax, ax
js 0x1802135bb
movzx eax, byte [rbx + 0x74]
test r15d, r15d
mov ecx, r12d
mov qword [rsp + 0x58], r14
cmove ecx, esi
mov ebp, esi
movzx r14d, cl
lea ecx, [r14 - 1]
shl ebp, cl
test eax, ebp
je 0x1802135a1
btr eax, ecx
mov rcx, qword [rbx]
mov byte [rbx + 0x74], al
call fcn.18027b2b0
xor edx, edx
lea rcx, str.SDL_MOUSE_FOCUS_CLICKTHROUGH
call fcn.180233340
test eax, eax
je 0x1802135b6
test edi, ebp
je 0x1802135b6
mov rcx, qword [rbx]
movzx r9d, r14b
xor r8d, r8d
xor edx, edx
call fcn.180245d20
mov r14, qword [rsp + 0x58]
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180213619
test r15d, r15d
mov eax, esi
cmove eax, r12d
movzx ebp, al
movzx eax, byte [rbx + 0x74]
lea ecx, [rbp - 1]
shl esi, cl
test eax, esi
je 0x180213604
btr eax, ecx
mov rcx, qword [rbx]
mov byte [rbx + 0x74], al
call fcn.18027b2b0
xor edx, edx
lea rcx, str.SDL_MOUSE_FOCUS_CLICKTHROUGH
call fcn.180233340
test eax, eax
je 0x180213619
test edi, esi
je 0x180213619
mov rcx, qword [rbx]
movzx r9d, bpl
xor r8d, r8d
xor edx, edx
call fcn.180245d20
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
test ax, ax
js 0x18021367c
movzx eax, byte [rbx + 0x74]
test al, 2
je 0x180213666
mov rcx, qword [rbx]
btr eax, 1
mov byte [rbx + 0x74], al
call fcn.18027b2b0
xor edx, edx
lea rcx, str.SDL_MOUSE_FOCUS_CLICKTHROUGH
call fcn.180233340
test eax, eax
je 0x18021367c
test dil, 2
je 0x18021367c
mov rcx, qword [rbx]
mov r9b, 2
xor r8d, r8d
xor edx, edx
call fcn.180245d20
mov ecx, 5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1802136cb
movzx eax, byte [rbx + 0x74]
test al, 8
je 0x1802136b5
mov rcx, qword [rbx]
btr eax, 3
mov byte [rbx + 0x74], al
call fcn.18027b2b0
xor edx, edx
lea rcx, str.SDL_MOUSE_FOCUS_CLICKTHROUGH
call fcn.180233340
test eax, eax
je 0x1802136cb
test dil, 8
je 0x1802136cb
mov rcx, qword [rbx]
mov r9b, 4
xor r8d, r8d
xor edx, edx
call fcn.180245d20
mov ecx, 6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18021371a
movzx eax, byte [rbx + 0x74]
test al, 0x10
je 0x180213704
mov rcx, qword [rbx]
btr eax, 4
mov byte [rbx + 0x74], al
call fcn.18027b2b0
xor edx, edx
lea rcx, str.SDL_MOUSE_FOCUS_CLICKTHROUGH
call fcn.180233340
test eax, eax
je 0x18021371a
test dil, 0x10
je 0x18021371a
mov rcx, qword [rbx]
mov r9b, 5
xor r8d, r8d
xor edx, edx
call fcn.180245d20
mov qword [rbx + 0x50], 0xffffffffffffffff
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x1802142d0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rdi, qword [rcx + 0xd8]
mov ebp, edx
mov rsi, rcx
mov r14, qword [rdi + 8]
call fcn.18023b030
xor ebx, ebx
cmp rax, rsi
sete bl
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp rax, r14
sete cl
cmp ebx, ecx
je 0x180214513
cmp ecx, ebp
jne 0x180214513
cmp rax, r14
jne 0x180214498
mov ecx, 0x17
mov qword [rsp + 0x78], r15
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, 1
mov ebp, eax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r15d, 4
test ax, ax
je 0x180214354
test ebp, ebp
mov ecx, r15d
cmove ecx, ebx
or byte [rdi + 0x74], cl
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18021436f
test ebp, ebp
mov eax, ebx
cmove eax, r15d
or byte [rdi + 0x74], al
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r15, qword [rsp + 0x78]
test ax, ax
je 0x180214386
or byte [rdi + 0x74], 2
mov ecx, 5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18021439a
or byte [rdi + 0x74], 8
mov ecx, 6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1802143ae
or byte [rdi + 0x74], 0x10
mov rcx, rsi
call fcn.18023bb00
call fcn.180244a90
cmp dword [rax + 0x84], 0
jne 0x18021441c
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0x80]
mov rcx, r14
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rsp + 0x80]
lea r8, [rsp + 0x74]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], rax
call fcn.180279ce0
mov eax, dword [rsp + 0x74]
xor r8d, r8d
mov r9d, dword [rsp + 0x70]
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.180245d40
mov rcx, rdi
call fcn.180213510
mov rcx, rsi
call fcn.18027b2b0
mov rcx, qword [rdi + 0xb0]
call fcn.1802747b0
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, ebx
mov ecx, 0x2000
mov edx, eax
call fcn.18023bdf0
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, ebx
mov ecx, 0x1000
mov edx, eax
call fcn.18023bdf0
mov ecx, 0x91
call qword [sym.imp.USER32.dll_GetKeyState]
and eax, ebx
mov ecx, 0x8000
mov edx, eax
call fcn.18023bdf0
mov rcx, qword [rdi]
mov edx, ebx
call fcn.18027b660
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor ecx, ecx
mov dword [rdi + 0x88], 1
call fcn.18023bb00
call fcn.180244a90
cmp dword [rax + 0x84], 0
je 0x1802144be
xor ecx, ecx
call fcn.180246230
call fcn.180276c90
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetClipCursor]
test eax, eax
je 0x180214509
mov r8d, 0x10
lea rdx, [rdi + 0x8c]
lea rcx, [rsp + 0x30]
call fcn.18020f140
test eax, eax
jne 0x180214509
xor ecx, ecx
call qword [sym.imp.USER32.dll_ClipCursor]
xor edx, edx
lea rcx, [rdi + 0x8c]
mov r8d, 0x10
call fcn.180259560
mov dword [rdi + 0x88], 0
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18021ed70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
movzx eax, byte [rcx]
mov r9d, 0x7fff
movdqa xmm0, xmmword [0x18039fc10]
mov r10, rcx
movsx r11d, dx
mov dword [rbp - 0x79], 0x80007
mov dword [rbp - 0x75], 0xa0009
mov dword [rbp - 0x71], 0xc000b
mov dword [rbp - 0x6d], 0xe000d
mov dword [rbp - 0x69], 0x110010
mov dword [rbp - 0x65], 0x150013
mov dword [rbp - 0x61], 0x190017
mov dword [rbp - 0x5d], 0x1f001c
mov dword [rbp - 0x59], 0x250022
mov dword [rbp - 0x55], 0x2d0029
mov dword [rbp - 0x51], 0x370032
mov dword [rbp - 0x4d], 0x42003c
mov dword [rbp - 0x49], 0x500049
mov dword [rbp - 0x45], 0x610058
mov dword [rbp - 0x41], 0x76006b
mov dword [rbp - 0x3d], 0x8f0082
mov dword [rbp - 0x39], 0xad009d
mov dword [rbp - 0x35], 0xd100be
mov dword [rbp - 0x31], 0xfd00e6
mov dword [rbp - 0x2d], 0x1330117
mov dword [rbp - 0x29], 0x1730151
mov dword [rbp - 0x25], 0x1c10198
mov dword [rbp - 0x21], 0x22001ee
mov dword [rbp - 0x1d], 0x2920256
mov dword [rbp - 0x19], 0x31c02d4
mov dword [rbp - 0x15], 0x3c3036c
mov dword [rbp - 0x11], 0x48e0424
mov dword [rbp - 0xd], 0x5830502
mov dword [rbp - 9], 0x6ab0610
mov dword [rbp - 5], 0x8120756
mov dword [rbp - 1], 0x9c308e0
mov dword [rbp + 3], 0xbd00abd
mov dword [rbp + 7], 0xe4c0cff
mov dword [rbp + 0xb], 0x114c0fba
mov dword [rbp + 0xf], 0x14ee1307
mov dword [rbp + 0x13], 0x19541706
mov dword [rbp + 0x17], 0x1ea51bdc
mov dword [rbp + 0x1b], 0x251521b6
mov dword [rbp + 0x1f], 0x2cdf28ca
mov dword [rbp + 0x23], 0x364b315b
mov dword [rbp + 0x27], 0x41b23bb9
mov dword [rbp + 0x2b], 0x4f7e4844
mov dword [rbp + 0x2f], 0x602f5771
mov dword [rbp + 0x33], 0x746269ce
mov word [rbp + 0x37], r9w
movdqu xmmword [rbp + 0x47], xmm0
cmp al, 0x58
jle 0x18021eedc
mov cl, 0x58
jmp 0x18021eee5
xor edx, edx
mov ecx, eax
test al, al
cmovs ecx, edx
movsx rax, cl
movzx edx, word [rbp + rax*2 - 0x79]
movzx eax, r8b
add cl, byte [rbp + rax + 0x47]
mov byte [r10], cl
mov ecx, edx
shr ecx, 3
test r8b, 4
je 0x18021ef06
add ecx, edx
test r8b, 2
je 0x18021ef12
mov eax, edx
shr eax, 1
add ecx, eax
test r8b, 1
je 0x18021ef1d
shr edx, 2
add ecx, edx
mov edx, ecx
neg edx
test r8b, 8
cmove edx, ecx
add edx, r11d
cmp edx, r9d
jle 0x18021ef3d
movzx eax, r9w
add rsp, 0xd0
pop rbp
ret
mov eax, 0xffff8000
cmp edx, eax
cmovl edx, eax
movzx eax, dx
add rsp, 0xd0
pop rbp
ret
Function at 0x180230950
Capabilities:
Hash data using djb2

Disassembly:
mov r9d, 0x1505
lea r8, [rcx + 0x68]
mov r10d, 4
cvttss2si rax, dword [r8 - 4]
imul ecx, eax, 0x21
cvttss2si rax, dword [r8]
add ecx, eax
cvttss2si rax, dword [r8 + 4]
imul edx, ecx, 0x21
add edx, eax
cvttss2si rax, dword [r8 + 8]
imul ecx, edx, 0x21
add ecx, eax
cvttss2si rax, dword [r8 + 0xc]
imul edx, ecx, 0x21
add edx, eax
cvttss2si rax, dword [r8 + 0x10]
imul ecx, edx, 0x21
add ecx, eax
cvttss2si rax, dword [r8 - 0x14]
imul edx, ecx, 0x21
imul ecx, eax, 0x21
cvttss2si rax, dword [r8 - 0x10]
add ecx, eax
imul eax, ecx, 0x40a9121
add edx, eax
cvttss2si rax, dword [r8 - 0x64]
imul ecx, eax, 0x333b303f
cvttss2si rax, dword [r8 - 0x4c]
sub edx, ecx
imul ecx, eax, 0x53e7acff
cvttss2si rax, dword [r8 - 0x58]
sub edx, ecx
imul ecx, eax, 0x7d64009f
cvttss2si rax, dword [r8 - 0x2c]
sub edx, ecx
imul ecx, eax, 0x6d261dff
cvttss2si rax, dword [r8 - 0x38]
sub edx, ecx
imul ecx, eax, 0x33d8d19f
cvttss2si rax, dword [r8 - 0x44]
sub edx, ecx
imul ecx, eax, 0x37ca613f
cvttss2si rax, dword [r8 - 0x34]
sub edx, ecx
imul ecx, eax, 0x4f2599bf
cvttss2si rax, dword [r8 - 0x24]
sub edx, ecx
imul ecx, eax, 0x5cb8923f
cvttss2si rax, dword [r8 - 0x30]
sub edx, ecx
imul ecx, eax, 0x11e9dddf
cvttss2si rax, dword [r8 - 0x60]
sub edx, ecx
imul ecx, eax, 0x6666a45f
cvttss2si rax, dword [r8 - 0x5c]
sub edx, ecx
imul ecx, eax, 0x29e4147f
cvttss2si rax, dword [r8 - 8]
sub edx, ecx
imul ecx, eax, 0x13be2b1f
cvttss2si rax, dword [r8 - 0x48]
sub edx, ecx
imul ecx, eax, 0x3116891f
cvttss2si rax, dword [r8 - 0x28]
sub edx, ecx
imul ecx, eax, 0xc3525e1
cvttss2si rax, dword [r8 - 0x68]
add edx, ecx
imul ecx, eax, 0x655ec7e1
cvttss2si rax, dword [r8 - 0x50]
add edx, ecx
imul ecx, eax, 0x2f22b321
cvttss2si rax, dword [r8 - 0xc]
add edx, ecx
imul ecx, eax, 0x747c7101
cvttss2si rax, dword [r8 - 0x54]
add edx, ecx
imul ecx, eax, 0x13791741
cvttss2si rax, dword [r8 - 0x20]
add edx, ecx
imul ecx, eax, 0x3b4039a1
cvttss2si rax, dword [r8 - 0x18]
add edx, ecx
imul ecx, eax, 0x30f35d61
imul r9d, r9d, 0x1137c401
cvttss2si rax, dword [r8 - 0x1c]
lea r8, [r8 + 0x80]
add edx, ecx
imul ecx, eax, 0x4f5f0981
cvttss2si rax, dword [r8 - 0xc0]
add edx, ecx
imul ecx, eax, 0x72ac4aa1
cvttss2si rax, dword [r8 - 0xbc]
add edx, ecx
imul ecx, eax, 0x510cfa81
cvttss2si rax, dword [r8 - 0x6c]
add edx, ecx
add edx, eax
add r9d, edx
sub r10, 1
jne 0x180230960
mov eax, r9d
ret
Function at 0x18024e3c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x40
mov r14, r9
mov r15, r8
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x18024e535
lea rax, [0x180ae36f5]
cmp qword [rcx], rax
jne 0x18024e535
cmp dword [rcx + 0xc], 1
je 0x18024e40e
lea rcx, str.SDL_LockTexture__:_texture_must_be_streaming
call fcn.18020d1d0
jmp 0x18024e46c
test rdx, rdx
jne 0x18024e42d
xor eax, eax
lea rdi, [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x38], eax
mov eax, dword [rcx + 0x14]
mov dword [rsp + 0x3c], eax
cmp qword [rcx + 0x38], 0
mov qword [rsp + 0x50], rsi
je 0x18024e482
mov rcx, qword [rcx + 0x28]
mov eax, dword [rcx + 0x280]
cmp dword [rbx + 0x68], eax
jne 0x18024e455
call fcn.18024b140
test eax, eax
js 0x18024e50f
mov rcx, qword [rbx + 0x38]
mov r9, r14
mov r8, r15
mov rdx, rdi
call fcn.1802a15e0
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret
cmp qword [rcx + 0x30], 0
je 0x18024e4f4
movups xmm0, xmmword [rdi]
movups xmmword [rcx + 0x4c], xmm0
mov ecx, dword [rcx + 8]
test ecx, ecx
je 0x18024e4cb
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x10000000
je 0x18024e4cb
cmp ecx, 0x32595559
je 0x18024e4c4
cmp ecx, 0x59565955
je 0x18024e4c4
cmp ecx, 0x55595659
je 0x18024e4c4
mov edx, 1
jmp 0x18024e4ce
mov edx, 2
jmp 0x18024e4ce
movzx edx, cl
mov eax, dword [rdi + 4]
imul eax, dword [rbx + 0x48]
imul edx, dword [rdi]
movsxd rcx, eax
mov eax, edx
add rcx, rax
add rcx, qword [rbx + 0x40]
mov qword [r8], rcx
mov eax, dword [rbx + 0x48]
mov dword [r9], eax
xor eax, eax
jmp 0x18024e467
mov rsi, qword [rcx + 0x28]
mov eax, dword [rsi + 0x280]
cmp dword [rcx + 0x68], eax
jne 0x18024e519
mov rcx, rsi
call fcn.18024b140
test eax, eax
jns 0x18024e519
mov eax, 0xffffffff
jmp 0x18024e467
mov r9, r15
mov qword [rsp + 0x20], r14
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call qword [rsi + 0x88]
jmp 0x18024e467
lea rdx, str.texture
lea rcx, str.Parameter__s_is_invalid
call fcn.18020d1d0
mov eax, 0xffffffff
jmp 0x18024e46c

Function at 0x180256840
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xor eax, eax
cmp qword [0x180ae3710], rax
jne 0x1802568f1
mov qword [rsp + 0x50], rbx
mov ebx, 1
mov qword [0x180ae3720], 0x40000
mov qword [0x180ae3728], 0x200000
mov dword [0x180ae3730], 7
lock cmpxchg dword [0x180ae3700], ebx
je 0x18025689b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lock cmpxchg dword [0x180ae3700], ebx
jne 0x180256887
mov rbx, qword [rsp + 0x50]
xor ecx, ecx
cmp qword [0x180ae3708], rcx
jne 0x1802568c8
mov eax, dword [0x180ae3730]
mov dword [0x180ae3aa0], eax
mov qword [0x180ae3708], 0x58585858
mov dword [0x180ae3aa4], ecx
xchg dword [0x180ae3700], ecx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [0x180ae3710], rax
mov eax, dword [rsp + 0x48]
mov qword [0x180ae3718], rax
xor eax, eax
add rsp, 0x58
ret