joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180161bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x10]
mov rbx, rcx
mov r10d, eax
and r10d, 7
je 0x180161bf1
cmp eax, r10d
jge 0x180161bdf
call fcn.1801613a0
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov dword [rbx + 0x14], eax
mov eax, dword [rbx + 0x10]
xor r8d, r8d
mov r9d, eax
test eax, eax
jle 0x180161c32
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r10d, cl
nop word [rax + rax]
shr ecx, 8
lea eax, [r9 - 8]
mov byte [rdx], r10b
lea rdx, [rdx + 1]
inc r8d
mov dword [rbx + 0x14], ecx
mov r9d, eax
movzx r10d, cl
test eax, eax
jg 0x180161c10
mov dword [rbx + 0x10], eax
jns 0x180161c5f
mov edx, dword [0x180ae5124]
mov rax, qword gs:[0x58]
mov ecx, 0x48
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x180161c92
mov r8, qword [rbx + 8]
nop dword [rax]
mov rax, qword [rbx]
cmp rax, r8
jb 0x180161c7c
xor dl, dl
jmp 0x180161c85
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x180161c70
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x180161c34
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x180161d07
mov edx, dword [0x180ae5124]
mov rax, qword gs:[0x58]
mov ecx, 0x48
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x180161d21
mov rcx, rbx
call fcn.1801614e0
test eax, eax
je 0x180161cfa
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.180381630
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x18017b780
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x180acd980]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov edi, edx
call fcn.18017a410
mov rdx, qword [rax]
movsxd rcx, dword [0x180ae5eb4]
mov r8, qword [rdx + rcx*8]
mov rcx, rax
call r8
mov rbx, rax
mov edx, 0x1e
lea rcx, [rsp + 0x20]
call qword [0x180ae5ef0]
mov r14, qword [rsp + 0x20]
mov qword [rsp + 0x30], r14
mov rbp, qword [rsp + 0x28]
mov qword [rsp + 0x38], rbp
mov ecx, 0x108
call fcn.1803427a0
mov qword [rsp + 0x20], rax
mov rcx, rax
call fcn.18017baa0
mov rsi, rax
mov qword [rsp + 0x20], rax
mov dword [rax + 0x68], 1
mov dword [rax + 0x84], edi
movsxd rcx, dword [0x180ae6054]
movsxd r8, dword [0x180ae5fa0]
mov rcx, qword [rcx + rbx]
mov edx, edi
mov rcx, qword [r8 + rcx]
call fcn.18017bd50
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
mov edx, dword [0x180ae5124]
mov rcx, qword gs:[0x58]
mov eax, 0x1c
mov rcx, qword [rcx + rdx*8]
mov edx, dword [rax + rcx]
cmp dword [0x180ae6690], edx
jg 0x18017b9a5
mov rdx, rbx
lea rcx, [rsp + 0x40]
call qword [0x180ae6698]
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi + 0x88], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x98], xmm1
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 0xa8], xmm0
movaps xmm1, xmmword [rsp + 0x70]
movups xmmword [rsi + 0xb8], xmm1
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rsi + 0xc8], xmm0
movaps xmm1, xmmword [rsp + 0x90]
movups xmmword [rsi + 0xd8], xmm1
mov qword [rsp + 0x20], 0
mov rbx, qword [r14 + 0x58]
mov qword [r14 + 0x58], rsi
test rbx, rbx
je 0x18017b92b
lea rcx, [rbx + 0x50]
call fcn.180110a40
lea rcx, [rbx + 0x28]
call fcn.180018cd0
mov rdx, qword [rbx + 0x18]
call fcn.180110970
mov edx, 0x38
mov rcx, qword [rbx + 0x18]
call fcn.180342c24
mov edx, 0x68
mov rcx, rbx
call fcn.180342c24
call fcn.18017a410
movsxd rcx, dword [0x180ae5f08]
mov rcx, qword [rcx + rax]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + 0x10]
nop
test rbp, rbp
je 0x18017b97d
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbp + 8], eax
cmp eax, 1
jne 0x18017b97d
mov rbx, qword [rsp + 0x38]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x18017b97d
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180342780
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea rcx, [0x180ae6690]
call fcn.180342d00
cmp dword [0x180ae6690], 0xffffffff
jne 0x18017b883
mov rax, qword [0x180ae6108]
mov qword [0x180ae6698], rax
lea rcx, [0x180ae6690]
call fcn.180342c94
jmp 0x18017b883
Function at 0x18017c4a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x180acd980]
xor rax, rsp
mov qword [rsp + 0x60], rax
inc dword [0x180ae94c8]
mov r14, rcx
xor eax, eax
movsxd r13, r9d
mov ecx, 0x20
mov qword [rsp + 0x48], rax
mov r15, r8
mov r12, rdx
call fcn.1803427a0
movdqa xmm0, xmmword [0x1804264b0]
mov rcx, rax
mov qword [rsp + 0x40], rax
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [str.Minecraft.Windows.exe]
movups xmmword [rax], xmm0
mov eax, dword [0x180418f20]
mov dword [rcx + 0x10], eax
movzx eax, byte [0x180418f24]
mov byte [rcx + 0x14], al
mov byte [rcx + 0x15], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [rsp + 0x58]
mov rbp, rax
cmp rdx, 0xf
jbe 0x18017c560
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18017c55b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18017c69b
call fcn.180342c24
movdqa xmm0, xmmword [0x180426360]
mov eax, 0x5a4d
mov qword [rsp + 0xc8], rbx
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
cmp word [rbp], ax
jne 0x18017c5e7
movsxd rsi, dword [rbp + 0x3c]
add rsi, rbp
cmp dword [rsi], 0x4550
jne 0x18017c5e7
test rsi, rsi
je 0x18017c5e7
movzx ebx, word [rsi + 0x14]
xor eax, eax
add rbx, 0x18
mov edi, eax
add rbx, rsi
cmp ax, word [rsi + 6]
jae 0x18017c5e7
nop dword [rax]
mov r8d, 5
lea rcx, str..text
mov rdx, rbx
call fcn.18035ca20
test eax, eax
je 0x18017c63a
movzx eax, word [rsi + 6]
inc edi
add rbx, 0x28
cmp edi, eax
jl 0x18017c5c0
mov r8, r15
lea rdx, [rsp + 0x40]
lea rcx, [0x180acead0]
call fcn.18017cd20
mov rcx, qword [rax]
xor eax, eax
mov qword [rcx + 0x30], rax
mov qword [r14], rax
mov rsi, qword [rsp + 0x78]
mov rax, r14
mov rbx, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180342780
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov edx, dword [rbx + 0xc]
mov eax, dword [rbx + 8]
add rdx, rbp
test rax, rax
je 0x18017c5e7
movaps xmm0, xmmword [r12]
lea r8, [rdx + rax]
lea r9, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x30]
call fcn.180106b40
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x18017c5e7
mov r8, r15
lea rdx, [rsp + 0x40]
lea rcx, [0x180acead0]
call fcn.18017cd20
lea rdx, [rbx + r13]
mov rcx, qword [rax]
mov qword [rcx + 0x30], rdx
mov qword [r14], rbx
jmp 0x18017c607
call fcn.180350d84
int3
Function at 0x18017c970
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
lea rcx, str._offsets__deinitializing...
call fcn.180055800
mov rbx, qword [0x180aceb80]
mov rdi, qword [0x180aceb88]
cmp rbx, rdi
je 0x18017c9d5
mov qword [rsp + 0x30], rsi
xor esi, esi
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x18017c9b9
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rsi
add rbx, 0x40
cmp rbx, rdi
jne 0x18017c9a0
mov rax, qword [0x180aceb80]
mov rsi, qword [rsp + 0x30]
mov qword [0x180aceb88], rax
lea rcx, [0x180acead0]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x18017ca20
Function at 0x18017d570
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x180acd980]
xor rax, rsp
mov qword [rsp + 0x60], rax
inc dword [0x180ae94cc]
mov r14, rcx
xor eax, eax
movsxd r12, r9d
mov ecx, 0x20
mov qword [rsp + 0x48], rax
mov r15, r8
mov r13, rdx
call fcn.1803427a0
movdqa xmm0, xmmword [0x1804264b0]
mov rcx, rax
mov qword [rsp + 0x40], rax
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [str.Minecraft.Windows.exe]
movups xmmword [rax], xmm0
mov eax, dword [0x180418f20]
mov dword [rcx + 0x10], eax
movzx eax, byte [0x180418f24]
mov byte [rcx + 0x14], al
mov byte [rcx + 0x15], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [rsp + 0x58]
mov rbp, rax
cmp rdx, 0xf
jbe 0x18017d630
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18017d62b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18017d796
call fcn.180342c24
movdqa xmm0, xmmword [0x180426360]
mov eax, 0x5a4d
mov qword [rsp + 0xc8], rbx
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
cmp word [rbp], ax
jne 0x18017d6b7
movsxd rsi, dword [rbp + 0x3c]
add rsi, rbp
cmp dword [rsi], 0x4550
jne 0x18017d6b7
test rsi, rsi
je 0x18017d6b7
movzx ebx, word [rsi + 0x14]
xor eax, eax
add rbx, 0x18
mov edi, eax
add rbx, rsi
cmp ax, word [rsi + 6]
jae 0x18017d6b7
nop dword [rax]
mov r8d, 5
lea rcx, str..text
mov rdx, rbx
call fcn.18035ca20
test eax, eax
je 0x18017d70a
movzx eax, word [rsi + 6]
inc edi
add rbx, 0x28
cmp edi, eax
jl 0x18017d690
mov r8, r15
lea rdx, [rsp + 0x40]
lea rcx, [0x180acebe0]
call fcn.18017cd20
mov rcx, qword [rax]
xor eax, eax
mov qword [rcx + 0x30], rax
mov qword [r14], rax
mov rsi, qword [rsp + 0x78]
mov rax, r14
mov rbx, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180342780
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov edx, dword [rbx + 0xc]
mov eax, dword [rbx + 8]
add rdx, rbp
test rax, rax
je 0x18017d6b7
movaps xmm0, xmmword [r13]
lea r8, [rdx + rax]
lea r9, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x30]
call fcn.180106b40
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x18017d6b7
lea rdx, [rsp + 0x40]
mov r8, r15
test r12d, r12d
jne 0x18017d76c
lea rcx, [0x180acebe0]
call fcn.18017cd20
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov qword [r14], rbx
jmp 0x18017d6d7
movsxd rdi, dword [r12 + rbx]
lea rcx, [r12 + 4]
add rdi, rcx
lea rcx, [0x180acebe0]
add rdi, rbx
call fcn.18017cd20
mov rcx, qword [rax]
mov qword [rcx + 0x30], rdi
mov qword [r14], rbx
jmp 0x18017d6d7
call fcn.180350d84
int3
Function at 0x180182800
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
sub rsp, 0x30
cmp qword [rdx + 0x18], 0xf
mov rbx, rdx
jbe 0x180182817
mov rbx, qword [rdx]
cmp qword [rcx + 0x18], 0xf
jbe 0x180182821
mov rcx, qword [rcx]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x50], 8
mov rdx, rcx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18018289b
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x48]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x180182885
mov qword [rsp + 0x48], 0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x180184a90
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
cmp rdi, 0x40000000
jbe 0x180184ad0
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x180ae6880]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x180184b0e
cmp rsi, r14
jb 0x180184b06
cmp rsi, r15
jae 0x180184b06
cmp qword [rsi + 8], 0
jne 0x180184cd7
mov rsi, qword [rsi]
test rsi, rsi
jne 0x180184af1
mov qword [rsp + 0xa0], rbx
mov rbx, rdi
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x180184ba2
nop dword [rax]
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x180184b99
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180184b99
cmp dword [rsp + 0x70], 0x10000
je 0x180184c1b
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x180184b99
sub rbx, rbp
cmp rbx, r14
jae 0x180184b60
test rsi, rsi
jne 0x180184c80
cmp rdi, r15
ja 0x180184cbf
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x180184cbf
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180184cbf
cmp dword [rsp + 0x70], 0x10000
je 0x180184c51
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x180184bd2
jmp 0x180184cbf
test rbx, rbx
je 0x180184b99
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180184c80
cmp rbx, r14
jae 0x180184b40
jmp 0x180184ba2
test rdi, rdi
je 0x180184cbf
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180184c80
cmp rdi, r15
jbe 0x180184bb0
jmp 0x180184cbf
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x180184c90
mov rax, qword [0x180ae6880]
mov qword [rsi], rax
mov qword [0x180ae6880], rsi
mov r12, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x180185560
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x180acd980]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
mov rdx, rcx
lea rcx, [rsp + 0x60]
call fcn.1801858f0
nop
lea rcx, [rsp + 0x60]
call fcn.180186640
movzx ebx, al
lea rcx, [rsp + 0x60]
call fcn.1800723b0
test bl, bl
je 0x1801855c2
cmp qword [rdi + 0x18], 0xf
jbe 0x1801855b5
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, 1
jmp 0x18018562d
lea rax, str.Failed_to_delete_file:_
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x19
call fcn.1801f56e0
xor ecx, ecx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x50], rcx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x60], xmm1
movsd xmm0, qword [rsp + 0x50]
movsd qword [rsp + 0x70], xmm0
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x30]
mov r8d, 4
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.18003b320
xor al, al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180342780
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x18018b6e0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rdx + 8]
lea r9, [rsp + 0x38]
sub rdi, qword [rdx]
mov rbx, rdx
mov rdx, rdi
mov r8d, 0x40
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, rsi
call fcn.180381630
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180193e10
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, r8
mov rbx, rdx
movzx esi, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rsi, rax
movabs rcx, 0x100000001b3
imul rsi, rcx
movzx eax, byte [r8 + 1]
xor rsi, rax
imul rsi, rcx
movzx eax, byte [r8 + 2]
xor rsi, rax
imul rsi, rcx
movzx eax, byte [r8 + 3]
xor rsi, rax
imul rsi, rcx
mov rdx, qword [0x180ae8b30]
and rdx, rsi
add rdx, rdx
mov rcx, qword [0x180ae8b18]
mov rax, qword [rcx + rdx*8 + 8]
mov rbp, qword [0x180ae8b08]
cmp rax, rbp
je 0x180193ed6
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [r8]
cmp ecx, dword [rax + 0x10]
je 0x180193eb0
cmp rax, rdx
je 0x180193ed3
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x180193ea2
mov qword [rbx], rax
mov byte [rbx + 8], 0
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov rbp, rax
movabs rax, 0x555555555555555
cmp qword [0x180ae8b10], rax
je 0x18019400c
lea rax, [0x180ae8b08]
mov qword [rsp + 0x20], rax
xor r15d, r15d
mov qword [rsp + 0x28], r15
mov ecx, 0x30
call fcn.1803427a0
mov rdi, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r14]
mov dword [rdi + 0x10], eax
mov qword [rdi + 0x18], r15
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov rcx, qword [0x180ae8b10]
add rcx, 1
xorps xmm1, xmm1
js 0x180193f3c
cvtsi2ss xmm1, rcx
jmp 0x180193f51
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mov rcx, qword [0x180ae8b38]
xorps xmm0, xmm0
test rcx, rcx
js 0x180193f67
cvtsi2ss xmm0, rcx
jmp 0x180193f7c
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x180ae8b00]
comiss xmm0, xmm1
jae 0x180193feb
call fcn.18005d0d0
mov rax, qword [0x180ae8b30]
and rax, rsi
add rax, rax
mov r8, qword [0x180ae8b18]
mov rcx, qword [r8 + rax*8 + 8]
mov rdx, qword [0x180ae8b08]
cmp rcx, rdx
jne 0x180193fbe
mov qword [rsp + 0x20], rdx
jmp 0x180193fe6
mov rdx, qword [r8 + rax*8]
mov eax, dword [rdi + 0x10]
cmp eax, dword [rcx + 0x10]
je 0x180193fde
nop word [rax + rax]
cmp rcx, rdx
je 0x180194005
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x180193fd0
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov rbp, qword [rsp + 0x20]
mov r9, rdi
mov r8, rbp
mov rdx, rsi
call fcn.18005d1a0
mov qword [rbx], rax
mov byte [rbx + 8], 1
jmp 0x180193eb7
mov qword [rsp + 0x20], rcx
jmp 0x180193fe6
lea rcx, str.unordered_map_set_too_long
call fcn.18031c22c
int3
Function at 0x180196a90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
mov eax, 0x13c0
call fcn.180343850
sub rsp, rax
mov rax, qword [0x180acd980]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov ebx, edx
mov esi, ecx
call fcn.1803216cc
mov dword [rsp + 0x24], eax
mov r9d, 1
mov dword [rsp + 0x13a4], 0xffffffff
mov r8d, eax
shr r8d, 0x1e
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x180196ad3
btc esi, 0x1f
mov dword [rsp + 0x20], 0x270
btc ebx, 0x1f
lea rcx, [rsp + 0x20]
sub ebx, esi
cmp ebx, 0xffffffff
jne 0x180196b1d
call fcn.18013ddf0
mov ecx, eax
jmp 0x180196b66
mov qword [rsp + 0x13d0], rdi
inc ebx
call fcn.18013ddf0
mov ecx, eax
mov edi, ebx
imul rcx, rdi
cmp ecx, ebx
jae 0x180196b5a
mov eax, ebx
xor edx, edx
neg eax
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x180196b5a
lea rcx, [rsp + 0x20]
call fcn.18013ddf0
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jb 0x180196b46
mov rdi, qword [rsp + 0x13d0]
shr rcx, 0x20
lea eax, [rsi + rcx]
xor eax, 0x80000000
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.180342780
mov rbx, qword [rsp + 0x13d8]
add rsp, 0x13c0
pop rsi
ret

Function at 0x180199470
Capabilities:
Enumerate process modules

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x180acd980]
xor rax, rsp
mov qword [rsp + 0x260], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1801994ca
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
mov rcx, rbx
test eax, eax
jne 0x1801994ce
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180199517
mov qword [rsp + 0x280], rdi
lea rdx, [rsp + 0x20]
mov edi, 1
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x180199504
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
inc edi
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1801994f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rdi, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180342780
add rsp, 0x270
pop rbx
ret
Function at 0x180199530
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x180ae6de8]
test rax, rax
jne 0x18019975b
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, 0x48
call fcn.1803427a0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
lea rcx, [0x1801999a0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [rsp + 0x30]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x180199679
movabs rbp, 0x66617263656e694d
nop
lea rdi, [rbx + 0x28]
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x1801995c2
mov rdi, qword [rdi]
cmp rax, 9
jb 0x18019961b
lea rsi, [rax + rdi]
lea r8, [rsi - 8]
sub r8, rdi
mov edx, 0x4d
mov rcx, rdi
call fcn.180381490
test rax, rax
je 0x18019961b
cmp qword [rax], rbp
jne 0x1801995f0
cmp byte [rax + 8], 0x74
je 0x18019960e
inc rax
lea r8, [rsi - 8]
sub r8, rax
mov edx, 0x4d
mov rcx, rax
call fcn.180381490
test rax, rax
jne 0x1801995e5
jmp 0x18019961b
sub rax, rdi
cmp rax, 0xffffffffffffffff
jne 0x180199774
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x180199648
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x180199643
nop
cmp rbx, qword [rax + 0x10]
jne 0x180199643
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x180199630
mov rbx, rax
jmp 0x18019966f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x18019966f
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x180199660
cmp byte [rbx + 0x19], 0
je 0x1801995b0
mov rax, qword [0x180ae6de8]
mov qword [rsp + 0xa0], rax
lea rax, str.Minecraft_window_handle:_0x:X
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x1f
call fcn.1801f56e0
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], rcx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x70], xmm1
movsd xmm0, qword [rsp + 0x60]
movsd qword [rsp + 0x80], xmm0
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.1800a3d90
nop
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rcx + 8]
cmp byte [rdi + 0x19], 0
jne 0x18019974a
nop dword [rax]
mov r8, qword [rdi + 0x10]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.180076540
mov rbx, rdi
mov rdi, qword [rdi]
lea rcx, [rbx + 0x28]
call fcn.180019190
mov edx, 0x48
mov rcx, rbx
call fcn.180342c24
cmp byte [rdi + 0x19], 0
je 0x180199710
mov rcx, qword [rsp + 0x30]
mov edx, 0x48
call fcn.180342c24
mov rax, qword [0x180ae6de8]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov qword [0x180ae6de8], rax
jmp 0x180199680