joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180095d00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x1802ae098]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x20], rdx
mov rcx, rdx
call fcn.180091b10
cmp qword [rdi + 0x18], 0x10
jb 0x180095d4f
mov rsi, qword [rdi]
mov rbp, rsi
add rbp, qword [rdi + 0x10]
mov rbx, rsi
jmp 0x180095d5c
mov rsi, rdi
mov rbp, qword [rdi + 0x10]
add rbp, rdi
mov rbx, rdi
cmp rbx, rbp
je 0x180095d77
sub rsi, rbx
movsx ecx, byte [rbx]
call fcn.18011c0e4
mov byte [rsi + rbx], al
inc rbx
cmp rbx, rbp
jne 0x180095d64
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180095d88
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180095dc3
movabs r10, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180095db0
mov r8, rdi
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.18009a180
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x180095def
cmp rbx, qword [r14 + 8]
je 0x180095def
mov rbx, qword [rbx + 0x30]
lea rsi, [r14 + 0x40]
jmp 0x180095ebf
lea rsi, [r14 + 0x40]
mov rbx, qword [rsi + 8]
sub rbx, qword [rsi]
sar rbx, 6
mov r8, rdi
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.1800998b0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
movdqa xmm6, xmmword [0x180267f40]
movdqu xmmword [rsp + 0x38], xmm6
mov byte [rsp + 0x28], 0
mov rbp, qword [rsi + 8]
cmp rbp, qword [rsi + 0x10]
je 0x180095e73
mov rdx, rdi
mov rcx, rbp
call fcn.18007a710
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm6
mov edx, 0xf
mov byte [rsp + 0x28], 0
add qword [rsi + 8], 0x40
jmp 0x180095e8b
lea r9, [rsp + 0x28]
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call fcn.18009aec0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x180095ebf
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180095eba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180095ef9
call fcn.180114f60
shl rbx, 6
add rbx, qword [rsi]
mov rcx, rdi
call fcn.18007ab80
lea rax, [rbx + 0x20]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180114f40
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
movaps xmm6, xmmword [rsp + 0x50]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.18011d874
nop
int3
Function at 0x180095fa0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1802ae098]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rdx
mov qword [rsp + 0x28], rdx
mov r12, rcx
mov qword [rsp + 0x40], rdx
mov rcx, rdx
call fcn.180091b10
cmp qword [r14 + 0x18], 0x10
jb 0x180095ff1
mov rdi, qword [r14]
mov rsi, rdi
mov rbx, rdi
add rsi, qword [r14 + 0x10]
jmp 0x180095ffe
mov rbx, r14
mov rsi, qword [r14 + 0x10]
add rsi, r14
mov rdi, r14
cmp rbx, rsi
je 0x180096019
sub rdi, rbx
movsx ecx, byte [rbx]
call fcn.18011c0e4
mov byte [rdi + rbx], al
inc rbx
cmp rbx, rsi
jne 0x180096006
mov r8, qword [r14 + 0x10]
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x18009602a
mov rdx, qword [r14]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180096063
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180096050
mov r8, r14
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.18009a180
mov r13, qword [rax + 8]
test r13, r13
je 0x1800961ad
cmp r13, qword [r12 + 8]
je 0x1800961ad
mov rsi, qword [r13 + 0x30]
mov qword [rsp + 0x30], rsi
imul r15, rsi, 0x78
add r15, qword [r12 + 0x40]
mov rax, qword [r12 + 0x48]
lea rbp, [r15 + 0x78]
cmp rbp, rax
je 0x180096143
lea rsi, [r15 + 0x20]
lea rbx, [rbp + 0x60]
mov r14, rax
nop word [rax + rax]
mov rdx, rbp
mov rcx, r15
call fcn.180081320
lea rax, [rbx - 0x40]
lea rdi, [rsi + 0x40]
cmp rsi, rax
je 0x180096109
mov qword [rsp + 0x20], rsi
mov eax, dword [rax]
mov dword [rsi], eax
mov r8, qword [rbx - 0x38]
mov rdx, qword [r8]
lea rcx, [rdi - 0x38]
call fcn.18009bca0
mov rdx, qword [rdi - 0x30]
mov rcx, rsi
call fcn.180099fe0
mov rdx, rax
mov rcx, rsi
call fcn.180099d60
nop
cmp rdi, rbx
je 0x180096124
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
sub r8, rdx
sar r8, 6
mov rcx, rdi
call fcn.18009b9b0
add r15, 0x78
add rsi, 0x78
add rbp, 0x78
add rbx, 0x78
cmp rbp, r14
jne 0x1800960c0
mov r14, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [r12 + 0x48]
lea rcx, [rdi - 0x18]
call fcn.180095f00
lea rcx, [rdi - 0x58]
call fcn.180094430
lea rcx, [rdi - 0x78]
call fcn.18007ab80
add qword [r12 + 0x48], 0xffffffffffffff88
mov r8, r13
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.1800992d0
mov rcx, qword [r12 + 8]
mov rax, qword [rcx]
cmp rax, rcx
je 0x1800961a1
mov rdx, qword [rax + 0x30]
cmp rdx, rsi
jbe 0x180096196
dec rdx
mov qword [rax + 0x30], rdx
mov rdx, qword [rax]
mov rax, rdx
cmp rdx, rcx
jne 0x180096186
mov rcx, r14
call fcn.18007ab80
mov al, 1
jmp 0x1800961b7
mov rcx, r14
call fcn.18007ab80
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180114f40
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800961e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1802ae098]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, r8
mov rsi, rdx
mov r15, rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x38], r8
xor r12d, r12d
mov rcx, r8
call fcn.180091b10
cmp qword [rdi + 0x18], 0x10
jb 0x180096232
mov r14, qword [rdi]
mov rbp, r14
add rbp, qword [rdi + 0x10]
mov rbx, r14
jmp 0x18009623f
mov r14, rdi
mov rbp, qword [rdi + 0x10]
add rbp, rdi
mov rbx, rdi
cmp rbx, rbp
je 0x18009625b
sub r14, rbx
movsx ecx, byte [rbx]
call fcn.18011c0e4
mov byte [r14 + rbx], al
inc rbx
cmp rbx, rbp
jne 0x180096247
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18009626c
mov rdx, qword [rdi]
movabs r9, 0xcbf29ce484222325
mov rcx, r12
test r8, r8
je 0x1800962a3
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180096290
mov r8, rdi
lea rdx, [rsp + 0x28]
mov rcx, r15
call fcn.18009a180
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1800962d9
cmp rcx, qword [r15 + 8]
je 0x1800962d9
imul rdx, qword [rcx + 0x30], 0x78
add rdx, 0x20
add rdx, qword [r15 + 0x40]
mov rcx, rsi
call fcn.180097cb0
jmp 0x1800962ed
mov rcx, rsi
call fcn.180098480
mov qword [rsi + 0x40], r12
mov qword [rsi + 0x48], r12
mov qword [rsi + 0x50], r12
mov rcx, rdi
call fcn.18007ab80
mov rax, rsi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180114f40
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180096320
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1802ae098]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x30], rdx
mov rcx, rdx
call fcn.180091b10
cmp qword [rdi + 0x18], 0x10
jb 0x18009636a
mov rsi, qword [rdi]
mov rbp, rsi
add rbp, qword [rdi + 0x10]
mov rbx, rsi
jmp 0x180096377
mov rsi, rdi
mov rbp, qword [rdi + 0x10]
add rbp, rdi
mov rbx, rdi
cmp rbx, rbp
je 0x180096393
sub rsi, rbx
nop
movsx ecx, byte [rbx]
call fcn.18011c0e4
mov byte [rsi + rbx], al
inc rbx
cmp rbx, rbp
jne 0x180096380
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1800963a4
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x1800963d3
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1800963c0
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.18009a180
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1800963f8
cmp rcx, qword [r14 + 8]
je 0x1800963f8
mov rax, qword [rcx + 0x30]
jmp 0x180096403
mov rdx, rdi
mov rcx, r14
call fcn.180097f30
imul rbx, rax, 0x78
add rbx, qword [r14 + 0x40]
mov rcx, rdi
call fcn.18007ab80
lea rax, [rbx + 0x20]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180114f40
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x180096990
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1800969c1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x180096a3b
mov rdi, r14
mov rcx, rbx
call fcn.18007aad0
test rax, rax
jle 0x180096a13
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1801176a0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x180096a2b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x180096a33
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1800969d5
sub r14, rdi
jmp 0x180096b1f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x180096a52
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180096a54
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180096a86
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1801176a0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x180096b1c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180096ac1
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x180096afd
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.180126640
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x180096b1c
cmp rbp, rax
ja 0x180096ad0
test rbp, rbp
je 0x180096b1c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.180126640
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1800992d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [r8 + 0x28], 0x10
lea r10, [r8 + 0x10]
mov r11, qword [r8 + 0x20]
mov rbx, r8
mov r14, rdx
mov rbp, rcx
jb 0x180099306
mov r10, qword [r8 + 0x10]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x180099344
movabs rcx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, r11
jb 0x180099330
mov rdx, qword [rbp + 0x30]
and rdx, r9
shl rdx, 4
add rdx, qword [rbp + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x180099378
cmp rax, rbx
jne 0x18009936e
mov rax, qword [rbp + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x180099383
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x180099383
cmp rax, rbx
jne 0x180099383
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdi, qword [rbx]
lea rcx, [rbx + 0x10]
dec qword [rbp + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
call fcn.18007ab80
mov edx, 0x38
mov rcx, rbx
call fcn.180114f60
mov rbx, qword [rsp + 0x30]
mov rax, r14
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [r14], rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18009c860
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r13
push r14
sub rsp, 0x178
mov rax, qword [0x1802ae098]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor r13d, r13d
mov r14, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x18009c88d
mov rcx, qword [rcx]
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a0], rbp
mov qword [rsp + 0x1a8], rsi
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x168], r12
mov qword [rsp + 0x160], r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x18009ca49
mov rdi, qword [r14 + 0x10]
test rdi, rdi
je 0x18009cad8
mov rbp, r13
lea r12, [0x1801de460]
nop dword [rax]
nop word [rax + rax]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r12 + rbx], r13b
jne 0x18009c8f7
mov r15, qword [r14 + 0x18]
mov rsi, r14
cmp r15, 0x10
jb 0x18009c910
mov rsi, qword [r14]
test rbx, rbx
je 0x18009c976
cmp rbp, rdi
jae 0x18009c976
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, pe_nt_image_headers64
call fcn.180117ec0
lea rdx, [rbx + r12]
mov rcx, r12
cmp r12, rdx
je 0x18009c950
nop dword [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rsp + rax + 0x50], 1
cmp rcx, rdx
jne 0x18009c940
lea rdx, [rdi + rsi]
lea rax, [rsi + rbp]
cmp rax, rdx
jae 0x18009c976
nop dword [rax]
movzx ecx, byte [rax]
cmp byte [rsp + rcx + 0x50], r13b
jne 0x18009ca97
inc rax
cmp rax, rdx
jb 0x18009c960
mov rax, 0xffffffffffffffff
cmp rax, 0xffffffffffffffff
mov qword [rsp + 0x38], r13
mov rbx, rdi
mov qword [rsp + 0x40], r13
cmovne rbx, rax
xorps xmm0, xmm0
cmp rdi, rbx
mov r8, rbx
movups xmmword [rsp + 0x28], xmm0
cmovb r8, rdi
mov rdx, r14
cmp r15, 0x10
jb 0x18009c9b0
mov rdx, qword [r14]
lea rcx, [rsp + 0x28]
call fcn.18007b4f0
cmp qword [rsp + 0x38], r13
je 0x18009c9fb
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x18009c9fb
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call fcn.1801273a0
test eax, eax
jne 0x18009ca9f
mov rdx, qword [rsp + 0x40]
lea rbp, [rbx + 1]
cmp rdx, 0x10
jb 0x18009ca3c
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009ca37
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009cadf
call fcn.180114f60
mov rdi, qword [r14 + 0x10]
cmp rbp, rdi
jb 0x18009c8f0
mov al, 1
mov r15, qword [rsp + 0x160]
mov r12, qword [rsp + 0x168]
mov rdi, qword [rsp + 0x170]
mov rsi, qword [rsp + 0x1a8]
mov rbp, qword [rsp + 0x1a0]
mov rbx, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180114f40
add rsp, 0x178
pop r14
pop r13
ret
sub rax, rsi
jmp 0x18009c97d
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18009cad8
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009cad3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009cadf
call fcn.180114f60
xor al, al
jmp 0x18009ca4b
call fcn.18011d874
int3
Function at 0x1800a22c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x1802ae098]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx + 0x10]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1800a24a4
mov rbx, qword [rcx + 0x18]
mov qword [rsp + 0x30], rbx
mov rcx, rbx
call fcn.180113d48
test eax, eax
jne 0x1800a24d1
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
je 0x1800a24dc
xor r14d, r14d
mov qword [rsi + 0x28], r14
mov qword [rsi + 0x30], r14
mov qword [rsp + 0x60], r14
lea r15, vtable.fmt::v9::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], 0xfa
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
mov rdx, rsi
call qword [rax + 8]
cmp byte [rdi + 0x20], r14b
je 0x1800a2438
mov r8, qword [rsi + 0x28]
cmp qword [rsi + 0x30], r8
jbe 0x1800a2438
test r8, r8
je 0x1800a2398
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
movsxd rax, dword [rsi + 0x10]
movzx ebp, word [rdi + rax*2 + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x1800a23b9
lea ebp, [rax + 7]
jmp 0x1800a23d4
mov edx, dword [rsp + 0x40]
and edx, 0xfff0
or edx, ebp
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movzx ebp, word [rsp + 0x40]
mov r8, qword [rsi + 0x30]
mov rcx, qword [rsi + 0x28]
cmp r8, rcx
jbe 0x1800a23fe
sub r8d, ecx
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
movzx edx, bp
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [rsi + 0x30]
mov r8, qword [rsp + 0x60]
cmp r8, rcx
jbe 0x1800a245c
sub r8d, ecx
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
jmp 0x1800a245c
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
je 0x1800a249c
mov rdx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a2496
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800a24cb
call fcn.180114f60
nop
mov rcx, rbx
call fcn.180113d50
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180114f40
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x180
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.18011d874
nop
mov ecx, 5
call fcn.180113af0
int3
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call fcn.180113af0
int3
Function at 0x1800a7440
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1800a75cf
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.180098e60
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800a7594
mov qword [rsp + 0x38], rbp
movabs rdi, 0xcbf29ce484222325
movabs rbp, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [rax + 0x10]
mov rcx, qword [rcx]
mov r11d, r9d
xor r11, rdi
imul r11, rbp
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rbx
jne 0x1800a750f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800a7583
mov rdx, qword [r11 + 8]
cmp r9b, byte [rdx + 0x10]
jne 0x1800a7548
mov r10, qword [rdx]
cmp r10, rax
je 0x1800a7542
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800a7583
cmp r8, rdx
je 0x1800a755f
nop dword [rax]
mov rdx, qword [rdx + 8]
cmp r9b, byte [rdx + 0x10]
je 0x1800a75a9
cmp r8, rdx
jne 0x1800a7550
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1800a74e0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800a7583
lea rcx, str.invalid_hash_bucket_count
call fcn.180112404
int3
Function at 0x1800c9470
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0xf0
movaps xmmword [rax - 0x18], xmm6
xor ebx, ebx
movaps xmmword [rax - 0x28], xmm7
xor esi, esi
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
movss xmm11, dword [0x180267130]
movaps xmmword [rax - 0x78], xmm12
movss xmm12, dword [0x180267114]
movaps xmmword [rsp + 0x70], xmm13
movss xmm13, dword [0x180267104]
movdqa xmm10, xmmword [0x180268140]
xorps xmm0, xmm0
mov ecx, 0x30
mov qword [rsp + 0x60], rsi
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x68], 0xf
movaps xmm9, xmm13
movaps xmm8, xmm12
movaps xmm7, xmm11
movaps xmm6, xmm11
call fcn.180114f68
movups xmm0, xmmword [str.Press_any_key__press_Backspace_to_cancel]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x60], 0x28
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x68], 0x2f
movups xmmword [rax], xmm0
mov byte [rsp + 0x28], sil
movups xmm1, xmmword [0x18025e7c8]
mov dword [rsp + 0x40], ebx
movaps xmmword [rsp + 0x30], xmm10
movups xmmword [rax + 0x10], xmm1
mov byte [rsp + 0x20], 1
movsd xmm0, qword [0x18025e7d8]
movaps xmm1, xmm8
movsd qword [rax + 0x20], xmm0
movaps xmm0, xmm6
unpcklps xmm0, xmm7
unpcklps xmm1, xmm9
movq r9, xmm0
movq r8, xmm1
mov byte [rax + 0x28], sil
call fcn.1800cad50
mov edi, 1
nop
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rbx, rax
jne 0x1800c95c2
cmp byte [0x1802cdbe2], sil
jne 0x1800c95c2
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1800c95c2
cmp edi, 0xd
je 0x1800c95c2
cmp edi, 0x65
je 0x1800c95c2
cmp edi, 0x1b
jne 0x1800c95e0
inc edi
cmp edi, 0x100
jl 0x1800c9580
mov rcx, qword [0x1802cdb18]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
xor ebx, ebx
jmp 0x1800c94c9
cmp edi, 8
jne 0x1800c95f7
xor edx, edx
lea rcx, str.Canceled_Key_Selection
call fcn.1800b05d0
xor eax, eax
jmp 0x1800c95f9
mov eax, edi
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
mov rsp, r11
pop rdi
ret