joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800720c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180407040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov word [rcx], 1
lea rax, [0x180071620]
mov qword [rcx + 8], rax
mov rcx, qword [0x180420f80]
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov dword [rbx + 0x28], 0x25ff
mov dword [rbx + 0x2c], 0x1010000
mov dword [rbx + 0x30], 0x1010101
mov word [rbx + 0x34], 0x101
call fcn.180078280
mov rcx, qword [rbx + 0x10]
mov edx, 0xe
mov byte [rbx + 1], al
lea r8d, [rdx + 0x32]
call fcn.180079260
mov qword [rbx + 0x20], rax
mov rcx, rax
test rax, rax
jne 0x18007215c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Hook:_Failed_to_allocate_memory_n
call fcn.180005350
jmp 0x18007225a
mov rax, qword [rbx + 8]
mov r8d, 0x3000
mov qword [rbx + 0x2e], rax
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + 0xc], ax
xor ecx, ecx
movzx edx, byte [rbx + 1]
add rdx, 0xe
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x180072144
mov qword [0x180420f98], rax
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x48], rdi
call sub.VCRUNTIME140.dll_memcpy
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
add rcx, rdx
mov qword [rbx + 0x2e], rcx
mov rcx, qword [rbx + 0x18]
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx + rdx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + rdx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + rdx + 0xc], ax
mov edx, 5
mov edi, dword [rbx + 0x20]
sub edi, dword [rbx + 0x10]
mov rcx, qword [rbx + 0x10]
sub edi, 5
lea r8d, [rdx + 0x3b]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18007222b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Hook:_Failed_to_change_target_function_protection_n
call fcn.180005350
jmp 0x180072255
mov rax, qword [rbx + 0x10]
lea r9, [rsp + 0x20]
mov edx, 5
mov byte [rax], 0xe9
mov rax, qword [rbx + 0x10]
mov dword [rax + 1], edi
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx], 0
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800ad110
add rsp, 0x30
pop rbx
ret
Function at 0x180076c60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
cmp rdx, r8
je 0x180076e56
cmp qword [rdx + 0x28], 0x10
lea r8, [rdx + 0x10]
mov rax, qword [rdx + 8]
mov r9, qword [r8 + 0x10]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov r13, qword [rcx + 8]
mov qword [rsp + 0x28], r14
mov r14, qword [rcx + 0x18]
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x68], rax
jb 0x180076cbb
mov r8, qword [r8]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
movabs r10, 0x100000001b3
test r9, r9
je 0x180076cf4
nop word [rax + rax]
movzx eax, byte [rcx + r8]
inc rcx
xor rdx, rax
imul rdx, r10
cmp rcx, r9
jb 0x180076ce0
mov r15, qword [rdi + 0x30]
mov rbx, qword [rsi]
and r15, rdx
shl r15, 4
mov rdx, rsi
add r15, r14
mov rax, qword [r15]
mov r12, qword [r15 + 8]
mov qword [rsp + 0x70], rax
call fcn.1800726a0
dec qword [rdi + 0x10]
cmp rsi, r12
je 0x180076d43
mov r14, rbx
cmp rbx, rbp
je 0x180076d57
mov rdx, rbx
mov rbx, qword [rbx]
call fcn.1800726a0
dec qword [rdi + 0x10]
cmp r14, r12
jne 0x180076d22
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x68]
cmp qword [rsp + 0x70], rsi
jne 0x180076d72
mov qword [r15], r13
mov rax, r13
jmp 0x180076d75
cmp qword [rsp + 0x70], rsi
jne 0x180076d61
mov qword [r15], rbx
mov rax, qword [rsp + 0x68]
mov qword [rax], rbx
mov qword [rbx + 8], rax
jmp 0x180076e3d
mov rax, r12
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x180076e35
nop dword [rax]
nop word [rax + rax]
cmp qword [rbx + 0x28], 0x10
lea r8, [rbx + 0x10]
mov r9, qword [r8 + 0x10]
mov rsi, rbx
jb 0x180076da5
mov r8, qword [r8]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
test r9, r9
je 0x180076dd9
movabs r12, 0x100000001b3
movzx eax, byte [rdx + r8]
inc rdx
xor rcx, rax
imul rcx, r12
cmp rdx, r9
jb 0x180076dc0
mov r12, qword [rsp + 0x68]
mov r15, qword [rdi + 0x30]
mov rdx, rbx
mov rbx, qword [rbx]
and r15, rcx
shl r15, 4
add r15, r14
mov r14, qword [r15 + 8]
call fcn.1800726a0
dec qword [rdi + 0x10]
cmp rsi, r14
je 0x180076e1c
nop
mov rsi, rbx
cmp rbx, rbp
je 0x180076e32
mov rdx, rbx
mov rbx, qword [rbx]
call fcn.1800726a0
dec qword [rdi + 0x10]
cmp rsi, r14
jne 0x180076e00
mov qword [r15], r13
mov qword [r15 + 8], r13
cmp rbx, rbp
je 0x180076e35
mov r14, qword [rsp + 0x78]
jmp 0x180076d90
mov qword [r15], rbx
mov qword [r12], rbx
mov qword [rbx + 8], r12
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x20]
mov rax, rbp
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x180077870
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x1800778d1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x180077890
mov ecx, dword [r10]
jmp 0x1800779ba
cmp ecx, 0x4e0
jb 0x1800779ba
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1800778f0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x180077940
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x180078b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x180407040]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rdi, rdx
mov qword [rcx + 8], rdx
mov edx, 0x66
mov byte [rcx], 1
mov rbx, rcx
mov qword [rcx + 0x10], 0
mov rcx, rdi
mov dword [rbp - 0x19], 0x41525150
mov dword [rbp - 0x15], 0x41514150
lea r8d, [rdx - 0x26]
mov dword [rbp - 0x11], 0x55534152
mov dword [rbp - 0xd], 0x8948006a
mov dword [rbp - 9], 0xfa894ce9
mov dword [rbp - 5], 0x24048d4c
mov dword [rbp - 1], 0x48e58948
mov dword [rbp + 3], 0x48f0e483
mov dword [rbp + 7], 0xff20ec83
mov dword [rbp + 0xb], 0x2d15
mov dword [rbp + 0xf], 0xec894800
mov dword [rbp + 0x13], 0xf8834858
mov dword [rbp + 0x17], 0x5b415d00
mov dword [rbp + 0x1b], 0x59415a41
mov dword [rbp + 0x1f], 0x595a5841
mov word [rbp + 0x23], 0xf58
mov byte [rbp + 0x25], 0x84
mov dword [rbp + 0x2a], 0x6e0f4866
mov dword [rbp + 0x2e], 0x5d8b48c0
mov dword [rbp + 0x32], 0xec8948f8
mov dword [rbp + 0x36], 0x89485e5d
mov word [rbp + 0x3a], 0xffdc
mov byte [rbp + 0x3c], 0xe6
call fcn.180079260
mov qword [rbx + 0x10], rax
mov rcx, rax
test rax, rax
jne 0x180078c48
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_allocate_memory_for_i2i_hook_n
call fcn.180005350
jmp 0x180078d02
movaps xmm0, xmmword [rbp - 0x19]
lea r9, [rbp + 0x47]
movaps xmm1, xmmword [rbp - 9]
mov eax, edi
sub eax, ecx
mov edx, 0x66
sub eax, 0x43
mov dword [rbp + 0x26], eax
lea rax, [0x180078a10]
mov qword [rbp + 0x3d], rax
mov rax, qword [rdi]
lea r8d, [rdx - 0x46]
mov qword [rcx], rax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbp + 0x3f]
movups xmmword [rcx + 8], xmm0
movaps xmm0, xmmword [rbp + 7]
movups xmmword [rcx + 0x18], xmm1
movaps xmm1, xmmword [rbp + 0x17]
movups xmmword [rcx + 0x28], xmm0
movaps xmm0, xmmword [rbp + 0x27]
movups xmmword [rcx + 0x38], xmm1
movsd xmm1, qword [rbp + 0x37]
movups xmmword [rcx + 0x48], xmm0
movsd qword [rcx + 0x58], xmm1
mov dword [rcx + 0x60], eax
movzx eax, word [rbp + 0x43]
mov word [rcx + 0x64], ax
mov rcx, qword [rbx + 0x10]
mov dword [rbp + 0x47], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, 5
lea r9, [rbp + 0x47]
mov rcx, rdi
lea r8d, [rdx + 0x3b]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rbp + 0x47]
lea r9, [rbp + 0x47]
mov byte [rdi], 0xe9
mov edx, 5
mov eax, dword [rbx + 0x10]
mov rcx, rdi
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx], 0
mov rax, rbx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1800ad110
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18007b9c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r12, rdx
mov r14, rcx
mov rcx, rdx
call fcn.180079690
lea r15, [rax + 8]
mov rsi, qword [r14 + 0x10]
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x18007b9fa
mov rdx, qword [r14]
movabs rbx, 0xcbf29ce484222325
mov r9, rbx
xor edi, edi
mov ecx, edi
movabs r13, 0x100000001b3
test rsi, rsi
je 0x18007ba33
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r13
inc rcx
cmp rcx, rsi
jb 0x18007ba20
mov r8, r14
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.18007db00
mov rcx, r14
cmp qword [rax + 8], rdi
jne 0x18007bb3f
lea rdx, [rsp + 0x20]
call fcn.18007bda0
nop
mov rdx, r12
mov rcx, rax
call fcn.18007bec0
mov rdx, qword [r12]
mov r8, qword [rdx + 0xa8]
mov rdx, rax
mov rcx, r12
call r8
mov rbx, rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18007babd
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007bab8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18007bab8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800ad85c
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.18006ad20
mov qword [rsp + 0x60], rbx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.18007dbd0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x18007bb22
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007bb1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18007bb1d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800ad85c
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp qword [r14 + 0x18], 0x10
jb 0x18007bb49
mov rcx, qword [r14]
test rsi, rsi
je 0x18007bb63
nop
movzx eax, byte [rdi + rcx]
xor rbx, rax
imul rbx, r13
inc rdi
cmp rdi, rsi
jb 0x18007bb50
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.18007db00
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x18007bb86
mov rax, qword [rax + 0x30]
jmp 0x18007bb25
lea rcx, str.invalid_unordered_map_K__T__key
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
Function at 0x18007bba0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov r8, rcx
mov r10, qword [rcx + 0x10]
mov rdx, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x18007bbce
mov rdx, qword [rcx]
movabs rbx, 0xcbf29ce484222325
mov r9, rbx
xor edi, edi
mov ecx, edi
movabs rsi, 0x100000001b3
test r10, r10
je 0x18007bc03
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, rsi
inc rcx
cmp rcx, r10
jb 0x18007bbf0
lea rdx, [rsp + 0x28]
call fcn.18007d780
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x18007bc74
lea r10, [rax + 0x30]
mov rdx, qword [r14 + 0x10]
mov rcx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x18007bc2c
mov rcx, qword [r14]
test rdx, rdx
je 0x18007bc44
movzx eax, byte [rdi + rcx]
xor rbx, rax
imul rbx, rsi
inc rdi
cmp rdi, rdx
jb 0x18007bc31
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x28]
mov rcx, r10
call fcn.18007db00
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x18007bc67
mov rax, qword [rax + 0x30]
jmp 0x18007bc84
lea rcx, str.invalid_unordered_map_K__T__key
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
lea rcx, str.invalid_unordered_map_K__T__key
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
nop
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x18007bca0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov r8, rcx
mov r10, qword [rcx + 0x10]
mov rdx, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x18007bcce
mov rdx, qword [rcx]
movabs rbx, 0xcbf29ce484222325
mov r9, rbx
xor edi, edi
mov ecx, edi
movabs rsi, 0x100000001b3
test r10, r10
je 0x18007bd03
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, rsi
inc rcx
cmp rcx, r10
jb 0x18007bcf0
lea rdx, [rsp + 0x28]
call fcn.18007d780
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x18007bd74
lea r10, [rax + 0x70]
mov rdx, qword [r14 + 0x10]
mov rcx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x18007bd2c
mov rcx, qword [r14]
test rdx, rdx
je 0x18007bd44
movzx eax, byte [rdi + rcx]
xor rbx, rax
imul rbx, rsi
inc rdi
cmp rdi, rdx
jb 0x18007bd31
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x28]
mov rcx, r10
call fcn.18007db00
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x18007bd67
mov rax, qword [rax + 0x30]
jmp 0x18007bd84
lea rcx, str.invalid_unordered_map_K__T__key
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
lea rcx, str.invalid_unordered_map_K__T__key
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
nop
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x18007f110
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x18007f135
cvtsi2ss xmm0, rdx
jmp 0x18007f14a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x1803f5020]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18007f178
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18007f178
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18007f1aa
cmp rbx, 0x200
jae 0x18007f1a7
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18007f1aa
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18007d0d0
Function at 0x1800932f0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180093321
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180421038]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180421048]
lea rdx, [rdi + rdi]
call fcn.180072470
mov rax, qword [0x180421038]
lea r9, [rdi - 1]
mov qword [0x180421060], r9
mov qword [0x180421068], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800934c2
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180421048]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18009340c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180093483
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x180093449
mov r10, qword [rdx]
cmp r10, rax
je 0x180093443
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180093483
cmp r9, rdx
je 0x18009345f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x180093497
cmp r9, rdx
jne 0x180093450
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800934bd
mov r9, qword [0x180421060]
jmp 0x180093391
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180093483
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800934d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
cmp byte [rcx + 8], 0
je 0x18009365e
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18009365e
mov rsi, qword [0x180422b00]
cmp qword [rsi + 8], 0
je 0x18009365e
mov rbx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x14
lea rdx, str.rightClickDelayTimer
lea rcx, [rsp + 0x20]
call fcn.180003f70
nop
lea rdx, [rsp + 0x20]
lea rcx, [0x1804211d0]
call fcn.18007bba0
mov rdx, qword [rbx]
mov r9, qword [rdx + 0x320]
mov r8, rax
mov rdx, qword [rsi + 8]
mov rcx, rbx
call r9
mov ebx, eax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1800935a8
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800935a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800935a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800ad85c
cmp ebx, 4
jne 0x18009365e
mov rsi, qword [0x180422b00]
mov edi, dword [rdi + 0x20]
cmp qword [rsi + 8], 0
je 0x18009365e
mov rbx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x14
lea rdx, str.rightClickDelayTimer
lea rcx, [rsp + 0x20]
call fcn.180003f70
nop
lea rdx, [rsp + 0x20]
lea rcx, [0x1804211d0]
call fcn.18007bba0
mov r8, qword [rbx]
mov r10, qword [r8 + 0x368]
mov r9d, edi
mov r8, rax
mov rdx, qword [rsi + 8]
mov rcx, rbx
call r10
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18009365e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180093659
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180093659
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800ad85c
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180095a80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, edx
mov ebx, ecx
mov r8d, dword [0x18042091c]
mov rax, qword gs:[0x58]
mov ecx, 4
mov r9, qword [rax + r8*8]
lea rbp, [0x180422cb0]
mov eax, dword [rcx + r9]
cmp dword [0x1804253c8], eax
jle 0x180095b39
lea rcx, [0x1804253c8]
call fcn.1800ad2b8
cmp dword [0x1804253c8], 0xffffffff
jne 0x180095b39
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [0x180424034], 0xffffffff
mov dword [0x180422cb4], eax
mov edx, 1
nop word [rax + rax]
mov r8d, eax
shr r8d, 0x1e
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 4], eax
inc rdx
cmp rdx, 0x270
jb 0x180095b00
mov dword [0x180422cb0], 0x270
lea rcx, [0x1804253c8]
call fcn.1800ad258
lea eax, [rbx - 0x80000000]
mov r14d, 0x80000000
lea esi, [rbx + r14]
cmp ebx, r14d
cmovae esi, eax
lea eax, [rdi - 0x80000000]
lea ebx, [rdi + r14]
cmp edi, r14d
cmovae ebx, eax
sub ebx, esi
cmp ebx, 0xffffffff
jne 0x180095b72
mov rcx, rbp
call fcn.180077870
mov edx, eax
jmp 0x180095ba7
lea edi, [rbx + 1]
xor r8d, r8d
xor eax, eax
test ebx, ebx
je 0x180095b8e
mov rcx, rbp
call fcn.180077870
mov r8d, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov r9d, edx
mov ecx, eax
xor edx, edx
mov eax, r8d
div edi
cmp eax, ecx
jb 0x180095ba7
cmp r9d, ebx
jne 0x180095b75
add edx, esi
lea ecx, [rdx - 0x80000000]
lea eax, [rdx + r14]
cmp edx, r14d
cmovae eax, ecx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180095be0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm7
movaps xmm6, xmm1
movaps xmm7, xmm0
mov ecx, dword [0x18042091c]
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax + rcx*8]
lea rbx, [0x1804253d0]
mov eax, dword [rdx + rcx]
cmp dword [0x1804253cc], eax
jle 0x180095c97
lea rcx, [0x1804253cc]
call fcn.1800ad2b8
cmp dword [0x1804253cc], 0xffffffff
jne 0x180095c97
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [0x180426754], 0xffffffff
mov dword [0x1804253d4], eax
mov r8d, 1
nop dword [rax]
nop word [rax + rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, r8d
mov dword [rbx + r8*4 + 4], eax
inc r8
cmp r8, 0x270
jb 0x180095c60
mov dword [0x1804253d0], 0x270
lea rcx, [0x1804253cc]
call fcn.1800ad258
mov rcx, rbx
call fcn.180077870
mov eax, eax
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
xorps xmm1, xmm1
subss xmm0, xmm1
addss xmm0, xmm1
mulss xmm0, dword [0x1803f4d8c]
subss xmm6, xmm7
mulss xmm0, xmm6
addss xmm0, xmm7
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x40
pop rbx
ret