joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18009a0d0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x180150550]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x180150578]
js 0x18009a0f4
cvtsi2ss xmm0, rcx
jmp 0x18009a109
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x180150540]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x1801377f8]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18009a13b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18009a13b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18009a16d
cmp rbx, 0x200
jae 0x18009a16a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18009a16d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x18009a330
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18009a361
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180150548]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180150558]
lea rdx, [rdi + rdi]
call fcn.180064cd0
mov rax, qword [0x180150548]
lea r9, [rdi - 1]
mov qword [0x180150570], r9
mov qword [0x180150578], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18009a4d4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180150558]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18009a420
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18009a495
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18009a45d
mov r10, qword [rdx]
cmp r10, rax
je 0x18009a457
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18009a495
cmp r9, rdx
je 0x18009a471
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18009a4a9
cmp r9, rdx
jne 0x18009a462
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18009a4cf
mov r9, qword [0x180150570]
jmp 0x18009a3d1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18009a495
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18009a180
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x180150590]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x1801505b8]
js 0x18009a044
cvtsi2ss xmm0, rcx
jmp 0x18009a059
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x180150580]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x1801377f8]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18009a08b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18009a08b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18009a0bd
cmp rbx, 0x200
jae 0x18009a0ba
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18009a0bd
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x18009a180
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18009a1b1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180150588]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180150598]
lea rdx, [rdi + rdi]
call fcn.180064cd0
mov rax, qword [0x180150588]
lea r9, [rdi - 1]
mov qword [0x1801505b0], r9
mov qword [0x1801505b8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18009a324
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180150598]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18009a270
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18009a2e5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18009a2ad
mov r10, qword [rdx]
cmp r10, rax
je 0x18009a2a7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18009a2e5
cmp r9, rdx
je 0x18009a2c1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18009a2f9
cmp r9, rdx
jne 0x18009a2b2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18009a31f
mov r9, qword [0x1801505b0]
jmp 0x18009a221
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18009a2e5
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18009a330
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x180150550]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x180150578]
js 0x18009a0f4
cvtsi2ss xmm0, rcx
jmp 0x18009a109
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x180150540]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x1801377f8]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18009a13b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18009a13b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18009a16d
cmp rbx, 0x200
jae 0x18009a16a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18009a16d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x18009a330
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18009a361
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180150548]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180150558]
lea rdx, [rdi + rdi]
call fcn.180064cd0
mov rax, qword [0x180150548]
lea r9, [rdi - 1]
mov qword [0x180150570], r9
mov qword [0x180150578], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18009a4d4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180150558]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18009a420
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18009a495
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18009a45d
mov r10, qword [rdx]
cmp r10, rax
je 0x18009a457
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18009a495
cmp r9, rdx
je 0x18009a471
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18009a4a9
cmp r9, rdx
jne 0x18009a462
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18009a4cf
mov r9, qword [0x180150570]
jmp 0x18009a3d1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18009a495
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18009c9a0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x180150028]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r11, r8
mov esi, edx
mov rdi, rcx
mov r8d, edx
shr r8d, 0x18
mov eax, edx
shr eax, 0x10
movzx edx, al
mov eax, esi
shr eax, 8
movzx ecx, al
movzx r9d, sil
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rax, 0x100000001b3
imul r9, rax
xor r9, rcx
imul r9, rax
xor r9, rdx
imul r9, rax
xor r9, r8
imul r9, rax
mov r10, qword [0x180150570]
and r10, r9
shl r10, 4
add r10, qword [0x180150558]
mov rcx, qword [r10 + 8]
mov rax, rcx
mov rbx, qword [0x180150548]
xor edx, edx
cmp rcx, rbx
je 0x18009ca53
mov r8, qword [r10]
cmp esi, dword [rcx + 0x10]
je 0x18009ca56
cmp rax, r8
je 0x18009ca53
mov rax, qword [rax + 8]
cmp esi, dword [rax + 0x10]
jne 0x18009ca43
jmp 0x18009ca56
mov rax, rdx
test rax, rax
jne 0x18009cab0
call fcn.180066640
mov dword [rsp + 0x70], esi
lea rcx, str.mapping_name_was_not_found_with_mapping_index_
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], 0x30
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
lea r9, [rsp + 0x70]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180082ee0
mov qword [rsp + 0x70], 0x12c
lea rcx, [rsp + 0x70]
call fcn.18008ef60
xor eax, eax
jmp 0x18009cbf6
and r9, qword [0x180152d30]
shl r9, 4
mov r8, qword [0x180152d18]
add r8, r9
mov rax, qword [r8 + 8]
mov r9, qword [0x180152d08]
cmp rax, r9
je 0x18009caf0
mov r8, qword [r8]
cmp esi, dword [rax + 0x10]
je 0x18009caf3
nop dword [rax]
cmp rax, r8
je 0x18009caf0
mov rax, qword [rax + 8]
cmp esi, dword [rax + 0x10]
jne 0x18009cae0
jmp 0x18009caf3
mov rax, rdx
test rax, rax
je 0x18009cb06
cmp rax, r9
je 0x18009cb06
mov rax, qword [rax + 0x18]
jmp 0x18009cbf6
cmp rcx, rbx
je 0x18009cb24
mov rax, qword [r10]
cmp esi, dword [rcx + 0x10]
je 0x18009cb21
cmp rcx, rax
je 0x18009cb24
mov rcx, qword [rcx + 8]
cmp esi, dword [rcx + 0x10]
jne 0x18009cb13
mov rdx, rcx
test rdx, rdx
cmovne rbx, rdx
lea r9, [rbx + 0x38]
cmp qword [r9 + 0x18], 0x10
jb 0x18009cb39
mov r9, qword [r9]
lea r8, [rbx + 0x18]
cmp qword [rbx + 0x30], 0x10
jb 0x18009cb48
mov r8, qword [rbx + 0x18]
mov rax, qword [r11]
mov r10, qword [rax + 0x108]
mov rdx, rdi
mov rcx, r11
call r10
mov rbp, rax
test rax, rax
jne 0x18009cbdb
call fcn.180066640
mov rdi, rax
mov dword [rsp + 0x70], esi
lea rdx, [rbx + 0x18]
lea rcx, [rsp + 0x50]
call fcn.18008d4c0
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rax, str.methodId_is_null_with_mapping_name:___and_index_
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x34
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.18009e170
nop
mov rcx, rbx
call fcn.1800663a0
mov qword [rsp + 0x70], 0x12c
lea rcx, [rsp + 0x70]
call fcn.18008ef60
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x38], rbp
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
call fcn.18009db30
mov rax, rbp
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800d26f0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x18009de10
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18009de41
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180152d48]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180152d58]
lea rdx, [rdi + rdi]
call fcn.180064cd0
mov rax, qword [0x180152d48]
lea r9, [rdi - 1]
mov qword [0x180152d70], r9
mov qword [0x180152d78], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18009dfb4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180152d58]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18009df00
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18009df75
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18009df3d
mov r10, qword [rdx]
cmp r10, rax
je 0x18009df37
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18009df75
cmp r9, rdx
je 0x18009df51
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18009df89
cmp r9, rdx
jne 0x18009df42
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18009dfaf
mov r9, qword [0x180152d70]
jmp 0x18009deb1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18009df75
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18009dfc0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18009dff1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180152d08]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180152d18]
lea rdx, [rdi + rdi]
call fcn.180064cd0
mov rax, qword [0x180152d08]
lea r9, [rdi - 1]
mov qword [0x180152d30], r9
mov qword [0x180152d38], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18009e164
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180152d18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18009e0b0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18009e125
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18009e0ed
mov r10, qword [rdx]
cmp r10, rax
je 0x18009e0e7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18009e125
cmp r9, rdx
je 0x18009e101
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18009e139
cmp r9, rdx
jne 0x18009e0f2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18009e15f
mov r9, qword [0x180152d30]
jmp 0x18009e061
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18009e125
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800a3bd0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x180150028]
xor rax, rsp
mov qword [rsp + 0x28], rax
movss xmm2, dword [0x1801547ec]
mov rbx, rcx
lea rcx, [0x180153390]
call fcn.180066000
subss xmm2, dword [0x1801547e8]
xorps xmm1, xmm1
mov eax, eax
xorps xmm0, xmm0
lea rdx, [0x1801547f8]
mov rcx, rbx
cvtsi2ss xmm1, rax
subss xmm1, xmm0
addss xmm1, xmm0
mulss xmm1, dword [0x1801375c4]
mulss xmm1, xmm2
addss xmm1, dword [0x1801547e8]
movss dword [0x1801547f0], xmm1
call fcn.1800a2200
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x1800a3c66
imul rdx, rax, 0x64
jmp 0x1800a3c84
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
imul rdx, rcx, 0x3b9aca00
add rdx, rax
mov qword [rbx + 0x10], rdx
xorps xmm1, xmm1
sub rdx, qword [rbx + 8]
movabs rax, 0x20c49ba5e353f7cf
imul rdx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cvtsi2ss xmm1, rdx
divss xmm1, dword [0x1801377e0]
movss dword [rbx + 0x1c], xmm1
movss xmm0, dword [0x1801547f4]
addss xmm0, dword [0x1801547f0]
subss xmm0, xmm1
divss xmm0, dword [0x1801377e0]
cvtps2pd xmm0, xmm0
call fcn.1800a23f0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1800a3d6b
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_GetCursorPos]
movsxd r9, dword [rsp + 0x24]
mov edx, 0x201
mov rcx, qword [0x1801530b8]
mov r8d, 0x1000000
call qword [sym.imp.USER32.dll_PostMessageW]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x1800a3d3f
imul rax, rax, 0x64
jmp 0x1800a3d5d
cqo
idiv rdi
mov r8, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
imul rdx, r8, 0x3b9aca00
add rax, rdx
mov rcx, rbx
mov qword [rbx + 8], rax
call fcn.1800a2010
mov al, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800d26f0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1800a4530
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x180150028]
xor rax, rsp
mov qword [rsp + 0x28], rax
movss xmm2, dword [0x18015484c]
mov rbx, rcx
lea rcx, [0x180153390]
call fcn.180066000
subss xmm2, dword [0x180154848]
xorps xmm1, xmm1
mov eax, eax
xorps xmm0, xmm0
lea rdx, [0x180154858]
mov rcx, rbx
cvtsi2ss xmm1, rax
subss xmm1, xmm0
addss xmm1, xmm0
mulss xmm1, dword [0x1801375c4]
mulss xmm1, xmm2
addss xmm1, dword [0x180154848]
movss dword [0x180154850], xmm1
call fcn.1800a2200
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x1800a45c6
imul rdx, rax, 0x64
jmp 0x1800a45e4
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
imul rdx, rcx, 0x3b9aca00
add rdx, rax
mov qword [rbx + 0x10], rdx
xorps xmm1, xmm1
sub rdx, qword [rbx + 8]
movabs rax, 0x20c49ba5e353f7cf
imul rdx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cvtsi2ss xmm1, rdx
divss xmm1, dword [0x1801377e0]
movss dword [rbx + 0x1c], xmm1
movss xmm0, dword [0x180154854]
addss xmm0, dword [0x180154850]
subss xmm0, xmm1
divss xmm0, dword [0x1801377e0]
cvtps2pd xmm0, xmm0
call fcn.1800a23f0
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1800a46cb
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_GetCursorPos]
movsxd r9, dword [rsp + 0x24]
mov edx, 0x204
mov rcx, qword [0x1801530b8]
mov r8d, 0x2000000
call qword [sym.imp.USER32.dll_PostMessageW]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x1800a469f
imul rax, rax, 0x64
jmp 0x1800a46bd
cqo
idiv rdi
mov r8, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
imul rdx, r8, 0x3b9aca00
add rax, rdx
mov rcx, rbx
mov qword [rbx + 8], rax
call fcn.1800a2010
mov al, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800d26f0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1800a5d00
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r15
sub rsp, 0x40
mov rax, qword [0x180150028]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea r15, [0x180150278]
mov dword [rsp + 0x28], 0xfc
mov ecx, dword [0x180152b34]
mov rax, qword gs:[0x58]
mov r8d, 4
mov rdx, qword [rax + rcx*8]
lea r12, str.none
mov rdi, 0xffffffffffffffff
lea rsi, [0x180155dd0]
mov eax, dword [r8 + rdx]
cmp dword [0x180155dc8], eax
jle 0x1800a5e01
lea rcx, [0x180155dc8]
call fcn.1800d2898
cmp dword [0x180155dc8], edi
jne 0x1800a5e01
mov dword [rsp + 0x20], 0
mov eax, dword [0x180150278]
shr eax, 0x1f
lea rcx, [rsp + 0x20]
test al, al
cmove rcx, r15
lea rax, [rsp + 0x28]
cmp dword [0x180150278], 0xfc
cmovle rax, rcx
movsxd rax, dword [rax]
mov rdx, qword [r12 + rax*8]
xorps xmm0, xmm0
movups xmmword [0x180155dd0], xmm0
xorps xmm1, xmm1
movdqu xmmword [0x180155de0], xmm1
mov r8, rdi
inc r8
cmp byte [rdx + r8], 0
jne 0x1800a5dd6
mov rcx, rsi
call fcn.180074370
lea rcx, [0x1800dd620]
call fcn.1800d2f5c
nop
lea rcx, [0x180155dc8]
call fcn.1800d2838
cmp byte [0x180153329], 0
je 0x1800a5ea0
mov qword [rsp + 0x20], 0
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, str._..._
call fcn.180045050
xor ebx, ebx
nop dword [rax]
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x1800a5e4e
inc ebx
cmp ebx, 0xfc
jl 0x1800a5e30
jmp 0x1800a5ef2
cmp ebx, 0x1b
cmove ebx, edi
mov dword [0x180150278], ebx
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
test ebx, ebx
cmovns rcx, r15
lea rax, [rsp + 0x28]
cmp ebx, 0xfc
cmovle rax, rcx
movsxd rax, dword [rax]
mov rdx, qword [r12 + rax*8]
inc rdi
cmp byte [rdx + rdi], 0
jne 0x1800a5e83
mov r8, rdi
mov rcx, rsi
call fcn.18007b710
mov byte [0x180153329], 0
jmp 0x1800a5ef2
cmp dword [0x180150278], 0xffffffff
jne 0x1800a5eb2
lea rsi, str._none_
jmp 0x1800a5ec2
cmp qword [0x180155de8], 0x10
cmovae rsi, qword [0x180155dd0]
mov qword [rsp + 0x20], 0
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180045050
movzx ecx, byte [0x180153329]
mov edx, 1
test al, al
cmovne ecx, edx
mov byte [0x180153329], cl
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800d26f0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r12
pop rdi
ret