joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180048fc0
Capabilities:
Allocate or change rwx memory
Create thread
Log keystrokes via polling
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1800a8010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, rdx
mov rsi, rcx
cmp dword [0x1800aaef4], 0xd
jne 0x180049205
call fcn.180046680
lea rcx, str.Dialogue
cmp rax, rcx
jne 0x180049015
movss xmm0, dword [0x18009bdec]
movss dword [0x1800aa084], xmm0
call fcn.180046680
lea rcx, str.Battle
cmp rax, rcx
jne 0x180049030
mov dword [0x1800aa084], 0x3f800000
call fcn.180046680
lea rcx, str.World
cmp rax, rcx
jne 0x180049054
cmp byte [0x1800ab150], 0
jne 0x180049054
mov dword [0x1800aa084], 0x3f800000
mov edi, 0x40
mov r14d, 0xc3
cmp byte [0x1800ab14e], 0
cmovne edi, r14d
lea r9, [rsp + 0x30]
mov edx, 1
lea r8d, [rdx + 0x3f]
lea rcx, [rsi + 0x463c120]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rsi + 0x463c120], dil
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, 1
lea rcx, [rsi + 0x463c120]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, 0x40
cmp byte [0x1800ab14a], 0
cmovne edi, r14d
lea r9, [rsp + 0x30]
mov edx, 1
lea r8d, [rdx + 0x3f]
lea rcx, [rsi + 0x3bd9e60]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rsi + 0x3bd9e60], dil
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, 1
lea rcx, [rsi + 0x3bd9e60]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, 0x4c2c20f
mov eax, 0x4d2c20f
cmp byte [0x1800ab149], 0
cmovne edi, eax
lea r9, [rsp + 0x30]
mov edx, 4
lea r8d, [rdx + 0x3c]
lea rcx, [rbp + 0xe7a0ff]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rbp + 0xe7a0ff], edi
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, 4
lea rcx, [rbp + 0xe7a0ff]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [0x1800aa08c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x180049205
cmp byte [0x1800ab14f], 0
sete al
mov byte [0x1800ab14f], al
test al, al
je 0x180049205
mov qword [rsp + 0x30], 0x32
lea rcx, [rsp + 0x30]
call fcn.1800509e0
mov ecx, 8
call fcn.18005cddc
lea rcx, [0x180046730]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x18005a6b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180049227
cmp dword [rsp + 0x48], 0
jne 0x1800491e2
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x180049205
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18005c4e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov dword [rsp + 0x48], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x180049240
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
movaps xmmword [rsp + 0x40], xmm6
mov r14d, ebx
movaps xmmword [rsp + 0x30], xmm7
mov esi, ebx
nop dword [rax]
test rsi, rsi
jne 0x18004929a
lea rcx, str.gameassembly.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, str.unityplayer.dll
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test r14, r14
je 0x180049270
mov qword [rsp + 0x28], rbx
lea r8, [0x180048e10]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15d, dword [0x1800aaea0]
lea r13, str.Dialogue
mov r12, qword gs:[0x58]
movss xmm7, dword [0x18009bdd4]
mov rdx, rsi
mov edi, 4
mov rcx, r14
lea rbx, str.World
call fcn.180048fc0
cmp dword [0x1800aaef4], 0x10
jne 0x180049348
cmp byte [0x1800ab154], 0
je 0x180049309
movss xmm6, dword [0x1800aa080]
jmp 0x18004930c
movaps xmm6, xmm7
call fcn.180046680
cmp rax, r13
jne 0x180049320
mov dword [0x1800aa084], 0x40a00000
call fcn.180046680
movss dword [0x1800aa084], xmm6
call fcn.180046680
cmp rax, rbx
jne 0x180049348
cmp byte [0x1800ab150], 0
jne 0x180049348
movss dword [0x1800aa084], xmm6
mov ebx, edi
mov rdi, qword [r12 + r15*8]
mov eax, dword [rbx + rdi]
cmp dword [0x1800ab208], eax
jle 0x18004938e
lea rcx, [0x1800ab208]
call fcn.18005c688
cmp dword [0x1800ab208], 0xffffffff
jne 0x18004938e
lea rcx, str.GameAssembly.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, [0x1800ab208]
mov qword [0x1800ab238], rax
call fcn.18005c628
mov eax, dword [rbx + rdi]
cmp dword [0x1800ab210], eax
jle 0x1800493ce
lea rcx, [0x1800ab210]
call fcn.18005c688
cmp dword [0x1800ab210], 0xffffffff
jne 0x1800493ce
mov rax, qword [0x1800ab238]
lea rcx, [0x1800ab210]
add rax, 0x2063f00
mov qword [0x1800ab218], rax
call fcn.18005c628
mov eax, dword [rbx + rdi]
cmp dword [0x1800ab22c], eax
jle 0x1800493fa
lea rcx, [0x1800ab22c]
call fcn.18005c688
cmp dword [0x1800ab22c], 0xffffffff
jne 0x1800493fa
lea rcx, [0x1800ab22c]
call fcn.18005c628
mov rax, qword [0x1800aaff8]
lea rcx, str.UIRoot_AboveDialog_BetaHintDialog_Clone_
call rax
mov rcx, rax
call qword [0x1800ab218]
mov ecx, dword [rbx + rdi]
mov rbp, rax
cmp dword [0x1800ab198], ecx
jle 0x180049457
lea rcx, [0x1800ab198]
call fcn.18005c688
cmp dword [0x1800ab198], 0xffffffff
jne 0x180049457
mov rcx, qword [0x1800ab238]
add rcx, 0x20643d0
mov qword [0x1800ab220], rcx
lea rcx, [0x1800ab198]
call fcn.18005c628
cmp byte [0x1800ab156], 0
mov rcx, rbp
sete dl
call qword [0x1800ab220]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x80], 0x32
call fcn.1800509e0
jmp 0x1800492d6
Function at 0x18004a420
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1800a8010]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor edi, edi
mov rsi, rcx
mov ebx, edi
xor eax, eax
mov ebp, 1
lock cmpxchg dword [0x1800aaef0], ebp
je 0x18004a481
nop dword [rax + rax]
cmp rbx, 0x20
jae 0x18004a46a
xor ecx, ecx
jmp 0x18004a46c
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800aaef0], ebp
jne 0x18004a460
cmp qword [0x1800aaef8], rdi
jne 0x18004a5f8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov ecx, edi
mov edx, 9
test rax, rax
mov qword [0x1800aaef8], rax
xchg dword [0x1800aaef0], edi
cmove ecx, edx
test ecx, ecx
jne 0x18004a5fe
lea rcx, str.kernelbase
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18004a5ef
lea rdx, str.CreateFileW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18004a5ef
lea r8, [0x1800aaf00]
mov qword [0x1800aaf08], rax
lea rdx, [0x18004a360]
mov rcx, rax
call fcn.18003fe80
test eax, eax
jne 0x18004a5ef
mov rcx, qword [0x1800aaf08]
call fcn.1800401c0
test eax, eax
je 0x18004a52d
lea rcx, str.____Failed_to_enable_hook_for_CreateFileW_function
jmp 0x18004a605
mov edx, 4
lea r9, [rsp + 0x20]
lea rcx, [rsi + 0xfcdc0]
lea r8d, [rdx + 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov edx, 4
mov dword [rsi + 0xfcdc0], 0xccc3c031
lea rcx, [rsi + 0xfcdc0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r9, [rsp + 0x24]
mov r8d, 0x40
mov rdx, rbp
lea rcx, [rsi + 0xf9940]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x24]
lea r9, [rsp + 0x24]
mov rdx, rbp
mov byte [rsi + 0xf9940], 0xc3
lea rcx, [rsi + 0xf9940]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, 2
lea r9, [rsp + 0x28]
lea rcx, [rsi + 0x1bcba0]
lea r8d, [rdx + 0x3e]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x28]
lea r9, [rsp + 0x28]
mov eax, 0xfeeb
lea rcx, [rsi + 0x1bcba0]
mov edx, 2
mov word [rsi + 0x1bcba0], ax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x18004a60b
lea rcx, str.____Failed_to_create_hook_for_CreateFileW_function
jmp 0x18004a605
xchg dword [0x1800aaef0], edi
lea rcx, str.____Failed_to_initialize_MinHook_library
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18005c4e0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004a720
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x18004a7bc
mov qword [0x1800ab0c8], rcx
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rax
lea rdx, [0x18009a198]
lea rcx, str.CONOUT_
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rax
lea rdx, [0x18009a198]
lea rcx, str.CONOUT_
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rax
lea rdx, [0x18009a1a8]
lea rcx, str.CONIN_
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen]
xor eax, eax
lea r8, [0x18004a630]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret

Function at 0x18004aeb0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x18004aed8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x18004aefe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18004af00
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x18004af59
test ecx, ecx
jle 0x18004af39
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x18004af59
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18004af59
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x18004af80
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x18004afa2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x18004afb8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18004afd4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18004afd6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18004b012
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18004b0ae
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18004b04d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18004b08e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x18004b0ae
cmp rbx, rax
ja 0x18004b060
test rbx, rbx
je 0x18004b0ae
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x18004b4e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1800a8010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18004b50d
xor eax, eax
jmp 0x18004b66a
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x18004b538
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x18004b538
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x18004b66a
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18004b65d
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x18004b57b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18004b5a6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18004b662
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18004b615
sub eax, 1
je 0x18004b615
cmp eax, 2
jne 0x18004b65d
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18004b662
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x18004b643
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x18004b65d
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x18004b662
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18005c4e0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x18004cde0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1800a8010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18004ceb3
cmp byte [rcx + 0x71], 0
je 0x18004ceb3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18004ceaf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18004ce74
sub eax, 1
je 0x18004ce78
cmp eax, 2
jne 0x18004ceaf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18005c4e0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18004cea6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18004ceaf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18004ce5c
xor al, al
jmp 0x18004ce5c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18005c4e0
add rsp, 0x60
pop rbx
ret
Function at 0x180055800
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180055831
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1800ab0d8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1800ab0e8]
lea rdx, [rdi + rdi]
call fcn.18004e3b0
mov rax, qword [0x1800ab0d8]
lea r9, [rdi - 1]
mov qword [0x1800ab100], r9
mov qword [0x1800ab108], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800559a4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1800ab0e8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800558f0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180055965
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18005592d
mov r10, qword [rdx]
cmp r10, rax
je 0x180055927
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180055965
cmp r9, rdx
je 0x180055941
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180055979
cmp r9, rdx
jne 0x180055932
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18005599f
mov r9, qword [0x1800ab100]
jmp 0x1800558a1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180055965
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18005c3e8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18005c46c
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180060890]
cmp byte [rcx + rax], 0
je 0x18005c46c
dec r8
sub rdx, 1
jne 0x18005c452
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x100002454
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x100004758], rdi
je 0x1000024a2
cmp rax, rdi
jne 0x100002495
mov edi, 1
mov r12d, edi
jmp 0x1000024a7
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100002479
mov edi, 1
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x1000024bd
mov ecx, 0x1f
call fcn.100175000
jmp 0x10000251a
mov eax, dword [0x100004750]
test eax, eax
jne 0x100002514
mov dword [0x100004750], edi
lea r13, [0x100001290]
lea rsi, [0x100001278]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x100002506
test eax, eax
jne 0x100002506
mov rcx, qword [rsi]
test rcx, rcx
je 0x1000024fb
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x1000024e4
test eax, eax
je 0x10000251a
mov eax, 0xff
jmp 0x1000025ec
mov dword [0x100004184], edi
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x100002541
lea rdx, [0x100001270]
lea rcx, [0x100001260]
call sub.msvcrt.dll__initterm
mov dword [0x100004750], 2
test r12d, r12d
jne 0x10000254f
xor eax, eax
xchg qword [0x100004758], rax
cmp qword [0x100004760], 0
je 0x100002578
lea rcx, [0x100004760]
call fcn.10000284c
test eax, eax
je 0x100002578
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100004760]
mov r8, qword [0x100004168]
mov rdx, qword [0x100004170]
mov ecx, dword [0x100004160]
call fcn.100001b54
mov dword [0x100004180], eax
cmp dword [0x100004164], 0
jne 0x1000025a8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100004184], 0
jne 0x1000025bd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100004180]
jmp 0x1000025ec
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.100002960
add rsp, 0x28
jmp 0x100002454
Function at 0x1400110aa
Capabilities:
Set console window title

Disassembly:
jmp 0x1400195e0
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x3a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14099a680]
xor rax, rbp
mov qword [rbp + 0x190], rax
lea rcx, [0x1409a1115]
call fcn.1400116c2
mov dword [rbp + 4], 0x20
lea rax, str.abcdefghi9182345jklmnopqrstuv211935960473wxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x42
rep stosb byte [rdi], al
mov dword [rbp + 0xb4], 0
jmp 0x140019659
mov eax, dword [rbp + 0xb4]
inc eax
mov dword [rbp + 0xb4], eax
cmp dword [rbp + 0xb4], 0x20
je 0x1400196b0
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x50
idiv ecx
mov eax, edx
cdqe
mov rcx, qword [rbp + 0x28]
movzx eax, word [rcx + rax*2]
mov dword [rbp + 0x184], eax
movsxd rax, dword [rbp + 0xb4]
movzx eax, word [rbp + rax*2 + 0x50]
mov word [rbp + 0x188], ax
movzx eax, word [rbp + 0x188]
add eax, dword [rbp + 0x184]
movsxd rcx, dword [rbp + 0xb4]
mov word [rbp + rcx*2 + 0x50], ax
jmp 0x14001964b
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea rcx, [rbp - 0x20]
lea rdx, [0x140024030]
call fcn.14001159b
mov rcx, qword [rbp + 0x190]
xor rcx, rbp
call fcn.140011320
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret
Function at 0x140011177
Capabilities:
Terminate process

Disassembly:
jmp 0x1400141e0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1409a1118]
call fcn.1400116c2
cmp qword [rbp + 0xe8], 0
je 0x140014230
cmp qword [rbp + 0xe8], 0xffffffffffffffff
je 0x140014230
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0xe8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rbp + 0xe0]
cmp qword [rax + 8], 0
je 0x14001424f
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0xe0]
cmp qword [rax], 0
je 0x140014281
mov edx, 0xffffffff
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret