joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180099530
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x18014f5f0]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x18014f618]
js 0x1800993f4
cvtsi2ss xmm0, rcx
jmp 0x180099409
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x18014f5e0]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x180136a40]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18009943b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18009943b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18009946d
cmp rbx, 0x200
jae 0x18009946a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18009946d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x180099530
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180099561
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18014f5e8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18014f5f8]
lea rdx, [rdi + rdi]
call fcn.180064780
mov rax, qword [0x18014f5e8]
lea r9, [rdi - 1]
mov qword [0x18014f610], r9
mov qword [0x18014f618], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800996d4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18014f5f8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180099620
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180099695
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18009965d
mov r10, qword [rdx]
cmp r10, rax
je 0x180099657
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180099695
cmp r9, rdx
je 0x180099671
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1800996a9
cmp r9, rdx
jne 0x180099662
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800996cf
mov r9, qword [0x18014f610]
jmp 0x1800995d1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180099695
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800996e0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x18014f5b0]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x18014f5d8]
js 0x1800994a4
cvtsi2ss xmm0, rcx
jmp 0x1800994b9
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x18014f5a0]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x180136a40]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1800994eb
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800994eb
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18009951d
cmp rbx, 0x200
jae 0x18009951a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18009951d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800996e0
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180099711
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18014f5a8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18014f5b8]
lea rdx, [rdi + rdi]
call fcn.180064780
mov rax, qword [0x18014f5a8]
lea r9, [rdi - 1]
mov qword [0x18014f5d0], r9
mov qword [0x18014f5d8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180099884
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18014f5b8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800997d0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180099845
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18009980d
mov r10, qword [rdx]
cmp r10, rax
je 0x180099807
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180099845
cmp r9, rdx
je 0x180099821
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180099859
cmp r9, rdx
jne 0x180099812
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18009987f
mov r9, qword [0x18014f5d0]
jmp 0x180099781
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180099845
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18009bdb0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x18014f040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r11, r8
mov esi, edx
mov rdi, rcx
mov r8d, edx
shr r8d, 0x18
mov eax, edx
shr eax, 0x10
movzx edx, al
mov eax, esi
shr eax, 8
movzx ecx, al
movzx r9d, sil
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rax, 0x100000001b3
imul r9, rax
xor r9, rcx
imul r9, rax
xor r9, rdx
imul r9, rax
xor r9, r8
imul r9, rax
mov r10, qword [0x18014f5d0]
and r10, r9
shl r10, 4
add r10, qword [0x18014f5b8]
mov rcx, qword [r10 + 8]
mov rax, rcx
mov rbx, qword [0x18014f5a8]
xor edx, edx
cmp rcx, rbx
je 0x18009be63
mov r8, qword [r10]
cmp esi, dword [rcx + 0x10]
je 0x18009be66
cmp rax, r8
je 0x18009be63
mov rax, qword [rax + 8]
cmp esi, dword [rax + 0x10]
jne 0x18009be53
jmp 0x18009be66
mov rax, rdx
test rax, rax
jne 0x18009bec0
call fcn.180066100
mov dword [rsp + 0x70], esi
lea rcx, str.mapping_name_was_not_found_with_mapping_index_
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], 0x30
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
lea r9, [rsp + 0x70]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1800820f0
mov qword [rsp + 0x70], 0x12c
lea rcx, [rsp + 0x70]
call fcn.18008e7b0
xor eax, eax
jmp 0x18009c006
and r9, qword [0x180151d50]
shl r9, 4
mov r8, qword [0x180151d38]
add r8, r9
mov rax, qword [r8 + 8]
mov r9, qword [0x180151d28]
cmp rax, r9
je 0x18009bf00
mov r8, qword [r8]
cmp esi, dword [rax + 0x10]
je 0x18009bf03
nop dword [rax]
cmp rax, r8
je 0x18009bf00
mov rax, qword [rax + 8]
cmp esi, dword [rax + 0x10]
jne 0x18009bef0
jmp 0x18009bf03
mov rax, rdx
test rax, rax
je 0x18009bf16
cmp rax, r9
je 0x18009bf16
mov rax, qword [rax + 0x18]
jmp 0x18009c006
cmp rcx, rbx
je 0x18009bf34
mov rax, qword [r10]
cmp esi, dword [rcx + 0x10]
je 0x18009bf31
cmp rcx, rax
je 0x18009bf34
mov rcx, qword [rcx + 8]
cmp esi, dword [rcx + 0x10]
jne 0x18009bf23
mov rdx, rcx
test rdx, rdx
cmovne rbx, rdx
lea r9, [rbx + 0x38]
cmp qword [r9 + 0x18], 0xf
jbe 0x18009bf49
mov r9, qword [r9]
lea r8, [rbx + 0x18]
cmp qword [rbx + 0x30], 0xf
jbe 0x18009bf58
mov r8, qword [rbx + 0x18]
mov rax, qword [r11]
mov r10, qword [rax + 0x108]
mov rdx, rdi
mov rcx, r11
call r10
mov rbp, rax
test rax, rax
jne 0x18009bfeb
call fcn.180066100
mov rdi, rax
mov dword [rsp + 0x70], esi
lea rdx, [rbx + 0x18]
lea rcx, [rsp + 0x50]
call fcn.18008ced0
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rax, str.methodId_is_null_with_mapping_name:___and_index_
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x34
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.18009d580
nop
mov rcx, rbx
call fcn.180065e60
mov qword [rsp + 0x70], 0x12c
lea rcx, [rsp + 0x70]
call fcn.18008e7b0
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x38], rbp
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
call fcn.18009cf40
mov rax, rbp
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800d1810
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x18009d220
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18009d251
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180151d68]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180151d78]
lea rdx, [rdi + rdi]
call fcn.180064780
mov rax, qword [0x180151d68]
lea r9, [rdi - 1]
mov qword [0x180151d90], r9
mov qword [0x180151d98], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18009d3c4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180151d78]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18009d310
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18009d385
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18009d34d
mov r10, qword [rdx]
cmp r10, rax
je 0x18009d347
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18009d385
cmp r9, rdx
je 0x18009d361
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18009d399
cmp r9, rdx
jne 0x18009d352
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18009d3bf
mov r9, qword [0x180151d90]
jmp 0x18009d2c1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18009d385
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18009d3d0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18009d401
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180151d28]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180151d38]
lea rdx, [rdi + rdi]
call fcn.180064780
mov rax, qword [0x180151d28]
lea r9, [rdi - 1]
mov qword [0x180151d50], r9
mov qword [0x180151d58], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18009d574
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180151d38]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18009d4c0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18009d535
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18009d4fd
mov r10, qword [rdx]
cmp r10, rax
je 0x18009d4f7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18009d535
cmp r9, rdx
je 0x18009d511
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18009d549
cmp r9, rdx
jne 0x18009d502
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18009d56f
mov r9, qword [0x180151d50]
jmp 0x18009d471
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18009d535
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800a2de0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18014f040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movss xmm2, dword [0x18015380c]
mov rbx, rcx
lea rcx, [0x1801523b0]
call fcn.180065ac0
subss xmm2, dword [0x180153808]
xorps xmm1, xmm1
mov eax, eax
xorps xmm0, xmm0
lea rdx, [0x180153818]
mov rcx, rbx
cvtsi2ss xmm1, rax
subss xmm1, xmm0
addss xmm1, xmm0
mulss xmm1, dword [0x180136814]
mulss xmm1, xmm2
addss xmm1, dword [0x180153808]
movss dword [0x180153810], xmm1
call fcn.1800a1740
lea rcx, [rsp + 0x20]
call fcn.18008ee80
xorps xmm1, xmm1
mov rcx, qword [rax]
movabs rax, 0x20c49ba5e353f7cf
mov qword [rbx + 0x10], rcx
sub rcx, qword [rbx + 8]
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cvtsi2ss xmm1, rdx
divss xmm1, dword [0x180136a28]
movss dword [rbx + 0x1c], xmm1
movss xmm0, dword [0x180153814]
addss xmm0, dword [0x180153810]
subss xmm0, xmm1
divss xmm0, dword [0x180136a28]
cvtps2pd xmm0, xmm0
call fcn.1800a1930
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1800a2ee0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800d1810
add rsp, 0x40
pop rbx
ret
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], 0
call qword [sym.imp.USER32.dll_GetCursorPos]
movsxd r9, dword [rsp + 0x2c]
mov edx, 0x201
mov rcx, qword [0x1801520d8]
mov r8d, 0x1000000
call qword [sym.imp.USER32.dll_PostMessageW]
lea rcx, [rsp + 0x20]
call fcn.18008ee80
mov rcx, rbx
mov rdx, qword [rax]
mov qword [rbx + 8], rdx
call fcn.1800a1550
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800d1810
add rsp, 0x40
pop rbx
ret
Function at 0x1800a3590
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18014f040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movss xmm2, dword [0x18015386c]
mov rbx, rcx
lea rcx, [0x1801523b0]
call fcn.180065ac0
subss xmm2, dword [0x180153868]
xorps xmm1, xmm1
mov eax, eax
xorps xmm0, xmm0
lea rdx, [0x180153878]
mov rcx, rbx
cvtsi2ss xmm1, rax
subss xmm1, xmm0
addss xmm1, xmm0
mulss xmm1, dword [0x180136814]
mulss xmm1, xmm2
addss xmm1, dword [0x180153868]
movss dword [0x180153870], xmm1
call fcn.1800a1740
lea rcx, [rsp + 0x20]
call fcn.18008ee80
xorps xmm1, xmm1
mov rcx, qword [rax]
movabs rax, 0x20c49ba5e353f7cf
mov qword [rbx + 0x10], rcx
sub rcx, qword [rbx + 8]
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cvtsi2ss xmm1, rdx
divss xmm1, dword [0x180136a28]
movss dword [rbx + 0x1c], xmm1
movss xmm0, dword [0x180153874]
addss xmm0, dword [0x180153870]
subss xmm0, xmm1
divss xmm0, dword [0x180136a28]
cvtps2pd xmm0, xmm0
call fcn.1800a1930
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1800a3690
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800d1810
add rsp, 0x40
pop rbx
ret
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], 0
call qword [sym.imp.USER32.dll_GetCursorPos]
movsxd r9, dword [rsp + 0x2c]
mov edx, 0x204
mov rcx, qword [0x1801520d8]
mov r8d, 0x2000000
call qword [sym.imp.USER32.dll_PostMessageW]
lea rcx, [rsp + 0x20]
call fcn.18008ee80
mov rcx, rbx
mov rdx, qword [rax]
mov qword [rbx + 8], rdx
call fcn.1800a1550
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800d1810
add rsp, 0x40
pop rbx
ret
Function at 0x1800a4890
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x18014f040]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea r14, [0x18014f2d8]
mov dword [rsp + 0x28], 0xfc
mov ecx, dword [0x180151b50]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
xor ebp, ebp
lea r15, str.none
lea rdi, [rbp - 1]
lea rsi, [0x180154df0]
mov eax, dword [rdx + rax]
cmp dword [0x180154de8], eax
jle 0x1800a498d
lea rcx, [0x180154de8]
call fcn.1800d18d8
cmp dword [0x180154de8], edi
jne 0x1800a498d
mov dword [rsp + 0x20], ebp
mov eax, dword [0x18014f2d8]
shr eax, 0x1f
lea rcx, [rsp + 0x20]
test al, al
cmove rcx, r14
lea rax, [rsp + 0x28]
cmp dword [0x18014f2d8], 0xfc
cmovle rax, rcx
movsxd rax, dword [rax]
mov rdx, qword [r15 + rax*8]
xorps xmm0, xmm0
movups xmmword [0x180154df0], xmm0
mov qword [0x180154e00], rbp
mov qword [0x180154e08], rbp
mov r8, rdi
inc r8
cmp byte [rdx + r8], 0
jne 0x1800a4962
mov rcx, rsi
call fcn.180073a20
lea rcx, [0x1800dbf50]
call fcn.1800d1ef4
nop
lea rcx, [0x180154de8]
call fcn.1800d186c
cmp byte [0x180152349], 0
je 0x1800a4a68
mov qword [rsp + 0x20], 0
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, str._..._
call fcn.180044d20
mov ebx, ebp
nop dword [rax]
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800a49dc
inc ebx
cmp ebx, 0xfc
jl 0x1800a49c0
jmp 0x1800a4aae
cmp ebx, 0x1b
cmove ebx, edi
mov dword [0x18014f2d8], ebx
mov dword [rsp + 0x20], ebp
lea rcx, [rsp + 0x20]
test ebx, ebx
cmovns rcx, r14
lea rax, [rsp + 0x28]
cmp ebx, 0xfc
cmovle rax, rcx
movsxd rax, dword [rax]
mov r9, qword [r15 + rax*8]
nop dword [rax]
inc rdi
cmp byte [r9 + rdi], 0
jne 0x1800a4a10
mov rax, qword [0x180154e08]
cmp rdi, rax
ja 0x1800a4a54
cmp rax, 0xf
cmova rsi, qword [0x180154df0]
mov qword [0x180154e00], rdi
mov r8, rdi
mov rdx, r9
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rdi], 0
mov byte [0x180152349], 0
jmp 0x1800a4aae
mov rdx, rdi
mov rcx, rsi
call fcn.18007d790
mov byte [0x180152349], 0
jmp 0x1800a4aae
cmp dword [0x18014f2d8], 0xffffffff
jne 0x1800a4a7a
lea rsi, str._none_
jmp 0x1800a4a8a
cmp qword [0x180154e08], 0xf
cmova rsi, qword [0x180154df0]
mov qword [rsp + 0x20], 0
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180044d20
test al, al
je 0x1800a4aae
mov byte [0x180152349], 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800d1810
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1800a6d20
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x18014f040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov eax, 1
xchg byte [rcx + 0x48], al
mov ecx, 0x10
call fcn.1800d1f8c
mov qword [rax], rbx
lea rcx, [0x1800a6f90]
mov qword [rax + 8], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1800b8480]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800a6db6
cmp dword [rbx + 0x40], 0
jne 0x1800a6daf
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x38], xmm1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800d1810
add rsp, 0x50
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1800b3e30
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
movzx r15d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r15, rax
movabs rcx, 0x100000001b3
imul r15, rcx
movzx eax, byte [r8 + 1]
xor r15, rax
imul r15, rcx
movzx eax, byte [r8 + 2]
xor r15, rax
imul r15, rcx
movzx eax, byte [r8 + 3]
xor r15, rax
imul r15, rcx
mov rcx, qword [0x18014f4c0]
and rcx, r15
add rcx, rcx
mov rax, qword [0x18014f4a8]
mov rbx, qword [rax + rcx*8 + 8]
mov r14, qword [0x18014f498]
cmp rbx, r14
jne 0x1800b3eba
mov rbx, r14
mov rbp, r14
jmp 0x1800b3ef9
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x1800b3ed4
cmp rbx, rcx
je 0x1800b3ef3
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x1800b3ec6
mov qword [rdx], rbx
mov byte [rdx + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r14, rbx
mov rbp, rbx
movabs rax, 0x7ffffffffffffff
cmp qword [0x18014f4a0], rax
jne 0x1800b3f1a
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [0x18014f498]
mov qword [rsp + 0x20], rax
xor r13d, r13d
mov qword [rsp + 0x28], r13
lea ecx, [r13 + 0x20]
call fcn.1800d1f8c
mov rdi, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r12]
mov dword [rdi + 0x10], eax
mov qword [rdi + 0x18], r13
mov rdx, qword [0x18014f4a0]
lea rcx, [rdx + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x1800b3f64
cvtsi2ss xmm0, rcx
jmp 0x1800b3f79
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x18014f4c8]
xorps xmm1, xmm1
test rcx, rcx
js 0x1800b3f8f
cvtsi2ss xmm1, rcx
jmp 0x1800b3fa4
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x18014f490]
seta al
test al, al
je 0x1800b4018
call fcn.1800653a0
mov rcx, qword [0x18014f4c0]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x18014f4a8]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [0x18014f498]
cmp rax, rbx
je 0x1800b4004
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x1800b4001
nop dword [rax]
mov rbx, rax
cmp rax, rdx
je 0x1800b405b
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1800b3ff0
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r14, qword [rsp + 0x20]
mov rdx, qword [0x18014f4a0]
mov r8, qword [rbx + 8]
inc rdx
mov qword [0x18014f4a0], rdx
mov qword [rdi], r14
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [0x18014f4a8]
mov rax, qword [0x18014f4c0]
and rax, r15
add rax, rax
mov rdx, qword [rcx + rax*8]
cmp rdx, qword [0x18014f498]
jne 0x1800b4062
mov qword [rcx + rax*8], rdi
jmp 0x1800b4074
mov qword [rsp + 0x20], rax
jmp 0x1800b4009
cmp rdx, rbp
jne 0x1800b406d
mov qword [rcx + rax*8], rdi
jmp 0x1800b4079
cmp qword [rcx + rax*8 + 8], r8
jne 0x1800b4079
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x1800b3edb