joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180087170
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
cmp byte [0x180382c9a], 1
jne 0x1800872ba
mov ecx, 0x5a
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
test ax, ax
jne 0x1800871f8
mov qword [rsp + 0x38], rbx
movabs rax, 0xf3a21bcd95725a4a
mov qword [0x1803afcd8], rax
mov dword [rsp + 0x38], 2
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rbx
mov qword [0x18035ebb8], rax
mov dword [rsp + 0x38], 0x4a
mov rax, qword [rsp + 0x38]
mov qword [0x18035ebc0], rax
mov dword [0x18035eaf0], ebx
mov dword [0x18035eae0], 2
call fcn.180110360
cmp dword [rax], ebx
je 0x1800872b5
movabs rax, 0xd80958fc74e988a6
mov dword [0x18035eae0], ebx
mov qword [0x1803afcd8], rax
mov dword [0x18035eaf0], ebx
call fcn.180110360
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0x38], ecx
mov qword [0x1803afcd8], rax
mov rax, qword [rsp + 0x38]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], ebx
mov qword [0x18035ebc0], rbx
mov dword [0x18035eae0], 2
call fcn.180110360
mov qword [rsp + 0x38], rbx
xorps xmm0, xmm0
mov ecx, dword [rax]
movabs rax, 0xab54a438726d25d5
mov dword [rsp + 0x38], ecx
mov qword [0x1803afcd8], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rbx
movss dword [rsp + 0x38], xmm0
mov qword [0x18035ebb8], rax
mov rax, qword [rsp + 0x38]
mov qword [0x18035ebc0], rax
mov dword [0x18035eaf0], ebx
mov dword [0x18035eae0], 2
call fcn.180110360
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x180087ee0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor ebp, ebp
lea r14, str.mpply_last_mp_char
mov edi, ebp
mov ebx, ebp
mov esi, ecx
mov eax, edi
movsx ecx, byte [rax + r14]
call fcn.18022e718
add eax, ebx
inc edi
imul ebx, eax, 0x401
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp edi, 0x12
jb 0x180087f01
lea eax, [rbx + rbx*8]
mov r8d, 0xffffffff
mov ecx, eax
lea rdx, [rsp + 0x40]
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
call qword [0x1803856b0]
movabs rax, 0xd47a2c1ba117471d
mov qword [rsp + 0x48], rbp
mov qword [0x1803afcd8], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x48], rbp
mov qword [0x18035ebb8], rax
mov dword [rsp + 0x48], esi
mov rax, qword [rsp + 0x48]
mov qword [0x18035ebc0], rax
mov dword [0x18035eaf0], ebp
mov dword [0x18035eae0], 2
call fcn.180110360
movabs rax, 0x498c1e05ce5f7877
mov dword [0x18035eae0], ebp
mov qword [0x1803afcd8], rax
mov dword [0x18035eaf0], ebp
call fcn.180110360
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x180091150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov r14, rdx
movaps xmm6, xmm3
mov rsi, rcx
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x180091175
xor r15d, r15d
mov ebp, r15d
mov edi, r15d
test rbx, rbx
je 0x1800911b1
mov eax, r15d
nop
movsx ecx, byte [rax + rsi]
call fcn.18022e718
add eax, edi
inc ebp
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, ebp
cmp rax, rbx
jb 0x180091190
lea eax, [rdi + rdi*8]
mov qword [rsp + 0x30], r15
mov ecx, eax
mov dword [0x18035eaf0], r15d
shr ecx, 0xb
xor ecx, eax
mov dword [0x18035eae0], 1
imul ebx, ecx, 0x8001
movabs rax, 0x35b9e0803292b641
mov qword [0x1803afcd8], rax
mov dword [rsp + 0x30], ebx
mov rax, qword [rsp + 0x30]
mov qword [0x18035ebb8], rax
call fcn.180110360
cmp dword [rax], r15d
je 0x180091351
mov ecx, ebx
call qword [0x180385698]
test eax, eax
je 0x180091351
mov ecx, ebx
call qword [0x1803856f0]
mov qword [rsp + 0x30], r15
movabs rdi, 0x98a4eb5d89a0c952
mov dword [rsp + 0x30], ebx
mov rax, qword [rsp + 0x30]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r15d
mov qword [0x1803afcd8], rdi
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r15d
jne 0x1800912b0
nop
call qword [sym.imp.WINMM.dll_timeGetTime]
mov rcx, qword [0x180385680]
mov dword [0x1803855fc], eax
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x30], ebx
mov rax, qword [rsp + 0x30]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r15d
mov qword [0x1803afcd8], rdi
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r15d
je 0x180091260
mov r9d, 1
mov dword [rsp + 0x20], 1
movaps xmm2, xmm6
mov rdx, r14
mov ecx, ebx
call qword [0x1803856e8]
mov ebx, eax
mov qword [rsp + 0x30], r15
movabs rax, 0x49733e92263139d1
mov dword [rsp + 0x30], ebx
mov rcx, qword [rsp + 0x30]
mov qword [0x18035ebb8], rcx
mov dword [0x18035eaf0], r15d
mov qword [0x1803afcd8], rax
mov dword [0x18035eae0], 1
call fcn.180110360
movabs rax, 0x67b2c79aa7ff5738
mov qword [rsp + 0x30], r15
mov qword [0x1803afcd8], rax
mov dword [rsp + 0x30], ebx
mov rax, qword [rsp + 0x30]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r15d
mov qword [0x18035ebc0], r15
mov dword [0x18035eae0], 2
call fcn.180110360
mov eax, ebx
jmp 0x180091353
xor eax, eax
mov rbx, qword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180092a60
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
bt ax, 0xf
jb 0x180092b7a
mov qword [rsp + 0x38], rbx
movabs rax, 0xf3a21bcd95725a4a
mov qword [0x1803afcd8], rax
mov dword [rsp + 0x38], 2
mov rax, qword [rsp + 0x38]
mov qword [0x18035ebb8], rax
mov eax, dword [0x18034bdb0]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x38]
mov qword [0x18035ebc0], rax
mov dword [0x18035eaf0], ebx
mov dword [0x18035eae0], 2
call fcn.180110360
cmp dword [rax], ebx
jne 0x180092b7a
movabs rax, 0xd80958fc74e988a6
mov dword [0x18035eae0], ebx
mov qword [0x1803afcd8], rax
mov dword [0x18035eaf0], ebx
call fcn.180110360
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0x38], ecx
mov qword [0x1803afcd8], rax
mov rax, qword [rsp + 0x38]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], ebx
mov qword [0x18035ebc0], rbx
mov dword [0x18035eae0], 2
call fcn.180110360
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x222ff6a823d122e2
mov dword [rsp + 0x38], ecx
mov qword [0x1803afcd8], rax
mov rax, qword [rsp + 0x38]
mov qword [0x18035ebb8], rax
mov qword [0x18035ebc0], rbx
jmp 0x180092c37
movabs rax, 0xd80958fc74e988a6
mov dword [0x18035eae0], ebx
mov qword [0x1803afcd8], rax
mov dword [0x18035eaf0], ebx
call fcn.180110360
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov qword [0x1803afcd8], rax
mov dword [rsp + 0x38], ecx
mov rax, qword [rsp + 0x38]
mov qword [0x18035ebb8], rax
mov eax, dword [0x180343eb0]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x38]
mov qword [0x18035ebc0], rax
mov dword [0x18035eaf0], ebx
mov dword [0x18035eae0], 2
call fcn.180110360
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x222ff6a823d122e2
mov qword [0x1803afcd8], rax
mov dword [rsp + 0x38], ecx
mov rax, qword [rsp + 0x38]
mov qword [0x18035ebb8], rax
mov eax, dword [0x180343eac]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x38]
mov qword [0x18035ebc0], rax
mov dword [0x18035eaf0], ebx
mov dword [0x18035eae0], 2
call fcn.180110360
add rsp, 0x20
pop rbx
ret
Function at 0x180092e00
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
test ax, ax
jne 0x180092f16
mov qword [rsp + 0x38], rbx
movabs rax, 0xf3a21bcd95725a4a
mov qword [0x1803afcd8], rax
mov dword [rsp + 0x38], 2
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rbx
mov qword [0x18035ebb8], rax
mov dword [rsp + 0x38], 0x49
mov rax, qword [rsp + 0x38]
mov qword [0x18035ebc0], rax
mov dword [0x18035eaf0], ebx
mov dword [0x18035eae0], 2
call fcn.180110360
cmp dword [rax], ebx
jne 0x180092f16
movabs rax, 0xd80958fc74e988a6
mov dword [0x18035eae0], ebx
mov qword [0x1803afcd8], rax
mov dword [0x18035eaf0], ebx
call fcn.180110360
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0x38], ecx
mov qword [0x1803afcd8], rax
mov rax, qword [rsp + 0x38]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], ebx
mov qword [0x18035ebc0], rbx
mov dword [0x18035eae0], 2
call fcn.180110360
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0xfb8794444a7d60fb
mov dword [rsp + 0x38], ecx
mov qword [0x1803afcd8], rax
mov rax, qword [rsp + 0x38]
mov qword [0x18035ebb8], rax
mov qword [0x18035ebc0], rbx
jmp 0x180092fbd
movabs rax, 0xd80958fc74e988a6
mov dword [0x18035eae0], ebx
mov qword [0x1803afcd8], rax
mov dword [0x18035eaf0], ebx
call fcn.180110360
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0x38], ecx
mov qword [0x1803afcd8], rax
mov rax, qword [rsp + 0x38]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], ebx
mov qword [0x18035ebc0], rbx
mov dword [0x18035eae0], 2
call fcn.180110360
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0xfb8794444a7d60fb
mov dword [rsp + 0x38], ecx
mov qword [0x1803afcd8], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x38], 1
mov qword [0x18035ebb8], rax
mov rax, qword [rsp + 0x38]
mov qword [0x18035ebc0], rax
mov dword [0x18035eaf0], ebx
mov dword [0x18035eae0], 2
call fcn.180110360
add rsp, 0x20
pop rbx
ret
Function at 0x1800e4ac0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x18], 0x10
mov r14, rcx
mov rsi, rcx
jb 0x1800e4ae2
mov rsi, qword [rcx]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1800e4af0
xor ebp, ebp
mov edi, ebp
test rbx, rbx
je 0x1800e4b25
mov eax, ebp
movsx ecx, byte [rax + rsi]
call fcn.18022e718
add eax, edi
inc ebp
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, ebp
cmp rax, rbx
jb 0x1800e4b04
mov rcx, r14
lea ebx, [rdi + rdi*8]
call fcn.1800292b0
mov rbp, qword [rsp + 0x50]
mov eax, ebx
shr eax, 0xb
xor eax, ebx
mov rbx, qword [rsp + 0x48]
imul eax, eax, 0x8001
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x1800e5e60
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x18032f0e0]
xor rax, rsp
mov qword [rbp + 0x37], rax
lea rcx, str.appdata
call fcn.18022124c
xor r15d, r15d
mov qword [rbp + 7], r15
mov qword [rbp + 0xf], 0xf
mov byte [rbp - 9], r15b
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], r15b
jne 0x1800e5eb7
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.1800294e0
nop
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rbp + 7]
sub rax, rcx
cmp rax, 0x13
jb 0x1800e601b
lea r9, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae r9, qword [rbp - 9]
mov qword [rsp + 0x30], 0x13
lea rax, str.ThunderMenuUsers_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x29]
call fcn.18003a8a0
nop
mov esi, dword [rbp - 0x19]
lea r8, [rbp - 0x29]
cmp qword [rbp - 0x11], 0x10
cmovae r8, qword [rbp - 0x29]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
cmovo rax, rbx
mov rcx, rax
call fcn.1801fd5b0
mov r14, rax
lea r8, [rbp - 0x29]
cmp qword [rbp - 0x11], 0x10
cmovae r8, qword [rbp - 0x29]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], 7
mov word [rbp + 0x17], r15w
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x1800e5f93
mov r8, rbx
mov rdx, r14
lea rcx, [rbp + 0x17]
call fcn.180045ad0
mov rcx, r14
call fcn.1801fcf24
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rcx, qword [rbp + 0x17]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1800e5fd5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp + 0x17]
call fcn.180045f80
nop
lea rcx, [rbp - 0x29]
call fcn.1800292b0
nop
lea rcx, [rbp - 9]
call fcn.1800292b0
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1801fcf00
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.180029320
nop
int3
Function at 0x1800e6030
Capabilities:
Create directory

Disassembly:
sub rsp, 0x98
mov rax, qword [0x18032f0e0]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x60]
call fcn.1801f20a0
nop
mov r8d, 0x14
lea rdx, str.ThunderMenuOutfit_
mov rcx, rax
call fcn.180040280
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x60]
call fcn.1800292b0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1800e5d70
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1800e60d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x20]
call fcn.180045f80
nop
lea rcx, [rsp + 0x40]
call fcn.1800292b0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1801fcf00
add rsp, 0x98
ret
Function at 0x1800e6e10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x40
xor r14d, r14d
movabs rax, 0xd80958fc74e988a6
mov dword [0x18035eae0], r14d
mov rbp, rcx
mov dword [0x18035eaf0], r14d
mov qword [0x1803afcd8], rax
call fcn.180110360
mov qword [rsp + 0x68], r14
mov edx, dword [rax]
movabs rax, 0x3fef770d40960d5a
mov qword [0x1803afcd8], rax
mov dword [rsp + 0x68], edx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], r14
mov qword [0x18035ebb8], rax
mov dword [rsp + 0x68], 1
mov rax, qword [rsp + 0x68]
mov qword [0x18035ebc0], rax
mov dword [0x18035eaf0], r14d
mov dword [0x18035eae0], 2
call fcn.180110360
mov rbx, 0xffffffffffffffff
movups xmm0, xmmword [rax]
movsd xmm1, qword [rax + 0x10]
movups xmmword [rsp + 0x20], xmm0
movsd qword [rsp + 0x30], xmm1
inc rbx
cmp byte [rbx + rbp], r14b
jne 0x1800e6ec2
mov esi, r14d
mov edi, r14d
test rbx, rbx
je 0x1800e6f01
mov rax, r14
nop dword [rax]
movsx ecx, byte [rax + rbp]
call fcn.18022e718
add eax, edi
inc esi
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, esi
cmp rax, rbx
jb 0x1800e6ee0
movss xmm0, dword [rsp + 0x20]
lea ecx, [rdi + rdi*8]
movabs rax, 0x509d5878eb39e842
mov qword [rsp + 0x68], r14
mov qword [0x1803afcd8], rax
mov eax, ecx
shr eax, 0xb
xor eax, ecx
mov dword [0x18035eaf0], r14d
imul eax, eax, 0x8001
mov qword [0x18035ebe8], r14
mov dword [0x18035eae0], 7
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x68]
mov qword [0x18035ebb8], rax
mov qword [rsp + 0x68], r14
movss dword [rsp + 0x68], xmm0
mov rax, qword [rsp + 0x68]
movss xmm0, dword [rsp + 0x28]
mov qword [0x18035ebc0], rax
mov qword [rsp + 0x68], r14
movss dword [rsp + 0x68], xmm0
mov rax, qword [rsp + 0x68]
movss xmm0, dword [rsp + 0x30]
mov qword [0x18035ebc8], rax
mov qword [rsp + 0x68], r14
movss dword [rsp + 0x68], xmm0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], r14
mov qword [0x18035ebd0], rax
mov dword [rsp + 0x68], 1
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], r14
mov qword [0x18035ebd8], rax
mov dword [rsp + 0x68], 1
mov rax, qword [rsp + 0x68]
mov qword [0x18035ebe0], rax
call fcn.180110360
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
movd xmm0, dword [rax]
cvtdq2ps xmm0, xmm0
cvttss2si eax, xmm0
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1800eb430
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rbx + rcx], 0
jne 0x1800eb450
xor esi, esi
mov edi, esi
test rbx, rbx
je 0x1800eb485
mov eax, esi
movsx ecx, byte [rax + rbp]
call fcn.18022e718
add eax, edi
inc esi
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, esi
cmp rax, rbx
jb 0x1800eb464
mov rbx, qword [rsp + 0x30]
lea eax, [rdi + rdi*8]
mov rbp, qword [rsp + 0x38]
mov ecx, eax
mov rsi, qword [rsp + 0x40]
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
add rsp, 0x20
pop rdi
ret

Function at 0x1800f2560
Capabilities:
Download url
Receive data

Disassembly:
push rbx
sub rsp, 0xe0
mov rax, qword [0x18032f0e0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov r8d, 0x44
lea rdx, str.https:__github.com_3xploitch3ats_Thunder_Menu_raw_header_Thunder.ytd
lea rcx, [rsp + 0x30]
call fcn.1800294e0
nop
lea rcx, [rsp + 0xb0]
call fcn.1801f20a0
nop
mov r8d, 0x18
lea rdx, str.ThunderMenuThunder.ytd
mov rcx, rax
call fcn.180040280
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xa0], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xa0], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0xb0]
call fcn.1800292b0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.1800e5d70
nop
lea rbx, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae rbx, qword [rsp + 0x70]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.1800e5d70
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, [rsp + 0x50]
call fcn.180045f80
nop
lea rcx, [rsp + 0x70]
call fcn.180045f80
nop
lea rcx, [rsp + 0x90]
call fcn.1800292b0
nop
lea rcx, [rsp + 0x30]
call fcn.1800292b0
xor eax, eax
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1801fcf00
add rsp, 0xe0
pop rbx
ret

Function at 0x1800f3100
Capabilities:
Create thread

Disassembly:
mov eax, 0x1048
call fcn.1801fde20
sub rsp, rax
mov rax, qword [0x18032f0e0]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov r8, rcx
lea rdx, str.finding__s
lea rcx, [rsp + 0x30]
call fcn.1800f5e90
lea rcx, [rsp + 0x30]
call fcn.180109470
lea rcx, str.Cleaning_up_hooks
call fcn.180109330
xor eax, eax
lea r8, [0x1800f5d50]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov edx, 0x1fffff
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1801fcf00
add rsp, 0x1048
ret
Function at 0x1800f6920
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1800f6b00
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1803afc98]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1803afca8]
lea rdx, [rdi + rdi]
call fcn.180046820
mov rcx, qword [0x1803afc98]
lea r9, [rdi - 1]
mov qword [0x1803afcc0], r9
mov qword [0x1803afcc8], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1800f6af5
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x14]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x15]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x16]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x17]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1803afca8]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1800f6a3b
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1800f6ab6
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x1800f6a78
mov r10, qword [rax]
cmp r10, rcx
je 0x1800f6a72
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1800f6ab6
mov r8, rax
cmp r10, rax
je 0x1800f6a92
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x1800f6aca
cmp r10, rax
jne 0x1800f6a80
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x1800f6af0
mov r9, qword [0x1803afcc0]
jmp 0x1800f69c0
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1800f6ab6
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1801fa5a8
int3
Function at 0x180109330
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x1e58
call fcn.1801fde20
sub rsp, rax
mov rax, qword [0x18032f0e0]
xor rax, rsp
mov qword [rsp + 0x1e40], rax
xor ecx, ecx
call fcn.180220514
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x40]
call fcn.180220894
mov eax, dword [rsp + 0x40]
lea rdx, str.__02d:_02d:_02d____s_n
mov r9d, dword [rsp + 0x44]
lea rcx, [rsp + 0x68]
mov r8d, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
call fcn.1801096b0
mov r9, qword [rsp + 0x1e60]
lea rax, [rsp + 0x1e68]
mov edx, 0xdac
mov qword [rsp + 0x28], rax
mov r8d, edx
lea rcx, [rsp + 0x90]
call fcn.1800e1b00
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xe40]
call fcn.1800f5e90
cmp byte [0x18034f151], 0
je 0x18010942d
lea r8, str.abcdefghijklmnopqrstuvwyz1234567
lea rdx, [0x180386840]
lea rcx, [rsp + 0x30]
call fcn.18022824c
test eax, eax
jne 0x18010942d
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0xe40]
lea rdx, [0x180273708]
call fcn.180109730
mov rcx, qword [rsp + 0x30]
call fcn.180227c80
lea r8, [rsp + 0x90]
lea rdx, [0x1802b0154]
lea rcx, [rsp + 0xe40]
call fcn.1800f5e90
lea rcx, [rsp + 0xe40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x1e40]
xor rcx, rsp
call fcn.1801fcf00
add rsp, 0x1e58
ret

Function at 0x1801095a0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x1e58
call fcn.1801fde20
sub rsp, rax
mov rax, qword [0x18032f0e0]
xor rax, rsp
mov qword [rsp + 0x1e40], rax
call fcn.180109790
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x40]
call fcn.180109780
mov eax, dword [rsp + 0x40]
lea rdx, str.__02d:_02d:_02d__FATAL:___s_n
mov r9d, dword [rsp + 0x44]
lea rcx, [rsp + 0x68]
mov r8d, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
call fcn.1801096b0
mov r8, qword [rsp + 0x1e60]
lea r9, [rsp + 0x1e68]
lea rcx, [rsp + 0x90]
call fcn.180109710
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xe40]
call fcn.1800f5e90
lea r8, str.abcdefghijklmnopqrstuvwyz1234567
lea rdx, [0x180386840]
lea rcx, [rsp + 0x30]
call fcn.18022824c
test eax, eax
jne 0x180109685
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0xe40]
lea rdx, [0x180273708]
call fcn.180109730
mov rcx, qword [rsp + 0x30]
call fcn.180227c80
mov r9d, 0x10
lea r8, str.FATAL_ERROR
lea rdx, [rsp + 0xe40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]