joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015790
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140057040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400bf2a0]
mov edi, ecx
cmp byte [rbx + 0x4a2d], 0
jne 0x1400157f1
cmp byte [rbx + 0x4a2e], 0
jne 0x1400157f1
movsx r9d, word [rbx + 0x5b2a]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002e50
test dil, 1
je 0x140015918
jmp 0x14001587a
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x140050614]
xor eax, eax
mulss xmm1, dword [0x140050600]
addss xmm0, dword [rbx + 0xdfc]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x4790], rax
mov dword [rbx + 0x477c], 1
movss dword [rbx + 0x4788], xmm0
movss dword [rbx + 0x478c], xmm1
movss xmm0, dword [rbx + 0x38f4]
mulss xmm0, dword [0x140050584]
or dword [rbx + 0x4778], 0x41
movss dword [rbx + 0x47d8], xmm0
movsx r9d, word [rbx + 0x5b2a]
call fcn.140002e50
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400158d0
lea r11, [0x140049af0]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x1400158b3
cmp byte [r8], r9b
jne 0x1400158b3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400158a0
not ecx
call fcn.14000af50
test rax, rax
je 0x140015918
cmp byte [rax + 0xae], 0
je 0x140015918
mov byte [rax + 0xb5], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b2a]
mov edx, 0x10
movsx r9d, word [rbx + 0x5b2a]
call fcn.140002e50
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000d840
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140041a30
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14001acf0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c10], 0
lea rbx, [rcx + 0x5c18]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001ad93
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test ecx, ecx
jns 0x14001ad46
mov eax, ecx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.14001d2d0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400036c0
mov eax, dword [rbx]
lea rcx, [0x1400bf298]
mov r9, qword [rdi + 0x5c10]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rdi + 0x5c20]
cmove edx, r14d
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001ad9b
mov rcx, rbx
call fcn.1400036c0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001b330
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x1400bf2a0]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x14001b394
lea r10, [0x140049af0]
cmp r8b, 0x23
jne 0x14001b377
cmp byte [rdx], r8b
jne 0x14001b377
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14001b364
mov eax, dword [r14 + 0x5b88]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x14001b3f5
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x14001b3ba
cmp edi, eax
jl 0x14001b3d4
mov r8d, 0x6fa
lea rdx, str.D:1ImGui_LoaderImGui_Loaderimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [r14 + 0x5b90]
cmp dword [rax + rbp + 8], ebx
je 0x14001b412
mov eax, dword [r14 + 0x5b88]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x14001b3b1
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x14001b41f
cmp edi, dword [r14 + 0x5b88]
jl 0x14001b439
mov r8d, 0x6fa
lea rdx, str.D:1ImGui_LoaderImGui_Loaderimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5b90]
lea rax, [rax + rcx*8]
jmp 0x14001b3f7
Function at 0x1400316c0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x210
call fcn.1400112e0
cmp byte [rax], 0
je 0x140031759
mov ecx, 0x210
call fcn.140001e30
cmp byte [rax + 8], 0
jne 0x140031759
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x140031759
mov rbx, qword [0x1400bf2a0]
test rbx, rbx
jne 0x140031728
mov r8d, 0xfdc
lea rdx, str.D:1ImGui_LoaderImGui_Loaderimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1400bf2a0]
cmp byte [rbx + 0x37a9], 0
je 0x140031745
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.140002690
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov ecx, 0x214
call fcn.1400112e0
cmp byte [rax], 0
je 0x1400317ec
mov ecx, 0x214
call fcn.140001e30
cmp byte [rax + 8], 0
jne 0x1400317ec
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1400317ec
mov rbx, qword [0x1400bf2a0]
test rbx, rbx
jne 0x1400317bb
mov r8d, 0xfdc
lea rdx, str.D:1ImGui_LoaderImGui_Loaderimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1400bf2a0]
cmp byte [rbx + 0x37a9], 0
je 0x1400317d8
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.140002690
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov ecx, 0x212
call fcn.1400112e0
cmp byte [rax], 0
je 0x14003187f
mov ecx, 0x212
call fcn.140001e30
cmp byte [rax + 8], 0
jne 0x14003187f
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14003187f
mov rbx, qword [0x1400bf2a0]
test rbx, rbx
jne 0x14003184e
mov r8d, 0xfdc
lea rdx, str.D:1ImGui_LoaderImGui_Loaderimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1400bf2a0]
cmp byte [rbx + 0x37a9], 0
je 0x14003186b
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.140002690
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov ecx, 0x216
call fcn.1400112e0
cmp byte [rax], 0
je 0x140031912
mov ecx, 0x216
call fcn.140001e30
cmp byte [rax + 8], 0
jne 0x140031912
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x140031912
mov rbx, qword [0x1400bf2a0]
test rbx, rbx
jne 0x1400318e1
mov r8d, 0xfdc
lea rdx, str.D:1ImGui_LoaderImGui_Loaderimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1400bf2a0]
cmp byte [rbx + 0x37a9], 0
je 0x1400318fe
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.140002690
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x140042708
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140042752
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140042752
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140042752
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140042752
cmp dword [rcx + 0x84], 0xe
jbe 0x140042752
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140042754
xor al, al
add rsp, 0x28
ret
Function at 0x100001448
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xf0
mov rax, qword [0x100003110]
xor rax, rsp
mov qword [rsp + 0xe0], rax
and dword [rsp + 0x70], 0
xor edx, edx
mov rbp, rcx
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x40]
mov r12d, r9d
call sub.msvcrt.dll_memset
lea r11, [0x100001314]
mov edx, 0x7f00
xor ecx, ecx
mov dword [rsp + 0x84], 8
mov qword [rsp + 0x78], r11
call qword [sym.imp.USER32.dll_LoadCursorW]
xor ecx, ecx
mov qword [rsp + 0x98], rax
call qword [sym.imp.GDI32.dll_GetStockObject]
lea r15, [0x100001220]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0xa0], rax
call qword [sym.imp.USER32.dll_RegisterClassW]
and dword [rsp + 0x60], 0
mov esi, 0x40000
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
lea r14d, [rbx + 1]
test ax, ax
movzx edi, ax
je 0x100001551
lea r9d, [rbx + 0x10]
lea r8, [rsp + 0xc0]
lea edx, [rbx + 0x58]
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100001551
bt word [rsp + 0xce], 0xb
jae 0x100001551
xor eax, eax
lea r8, [rsp + 0x68]
lea rcx, [0x100001298]
xor edx, edx
mov word [rsp + 0x68], di
mov dword [rsp + 0x6c], eax
call qword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
cmp dword [rsp + 0x6c], ebx
cmovne ebx, r14d
neg ebx
lea r8, [0x100001248]
mov rdx, r15
sbb eax, eax
add eax, 2
xchg dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], r14d
mov eax, 0x440000
cmove esi, eax
and qword [rsp + 0x58], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
mov eax, 0x80000000
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov ecx, esi
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
test rax, rax
mov rbx, rax
je 0x1000015d3
lea r8, [0x100001250]
mov r9d, r12d
mov rdx, rbp
mov rcx, rax
call sub.SHELL32.dll_Control_RunDLL
mov rcx, rbx
call qword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1000019c0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180006020
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov edx, dword [rcx]
mov r9d, 0x138
mov r10, rcx
cmp edx, r9d
jne 0x180006087
lea r8, [rcx + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x180006042
mov edx, dword [r10]
jmp 0x180006189
cmp edx, 0x270
jb 0x180006189
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [rcx + 0x9c8]
mov qword [rsp], rdi
mov r9, qword [rbx]
mov edi, 0x9c
mov r8, qword [rbx + 8]
lea rbx, [rbx + 8]
xor r9, r8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rbx + 0x4d8]
xor rcx, r9
mov r9, r8
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x1800060b5
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
mov r8, qword [rbx + 8]
lea rbx, [rbx + 8]
xor r9, r8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rbx - 0xea8]
xor rcx, r9
mov r9, r8
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x180006104
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
xor edx, edx
mov qword [r10 + 0x9c0], rcx
mov dword [r10], edx
mov eax, edx
xorps xmm0, xmm0
mov rcx, qword [r10 + rax*8 + 8]
lea eax, [rdx + 1]
mov dword [r10], eax
movabs rdx, 0x38eb3ffff6d3
mov rax, rcx
shr rax, 0x1d
and rax, qword [r10 + 0x1388]
xor rcx, rax
mov rax, rcx
and rax, rdx
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rdx, rcx
shr rdx, 0x2b
xor rdx, rcx
js 0x1800061ef
cvtsi2sd xmm0, rdx
mulsd xmm0, qword [0x1802644b8]
add rsp, 8
ret
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, qword [0x1802644b8]
add rsp, 8
ret
Function at 0x1800066a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, qword [0x1802bb018]
mov rbx, r8
lea rsi, [rdi + 0x164]
lea rcx, [rdi + 0x16c]
mov dword [rsi], 1
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + 0x168], ebx
add rbx, 8
je 0x18000677b
mov rax, qword [rdi]
test rax, rax
je 0x18000672b
mov rcx, qword [rax + 8]
cmp rcx, 0xffffffffffffffff
je 0x18000672b
test rsi, rsi
je 0x18000672b
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x18000672b
cmp dword [rsp + 0x40], ebx
je 0x18000677b
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x18000674a
mov eax, dword [rdi + 8]
dec eax
test eax, 0xfffffffd
jne 0x18000674a
mov ecx, dword [rdi + 0x60]
lea rdx, [rdi + 0x64]
call r8
mov rbx, qword [rdi]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
xor al, al
mov byte [rbx], 0
mov dword [rdi + 8], 0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov al, 1
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180012a10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test rcx, rcx
je 0x180012a70
mov r8, qword [rcx]
test r8, r8
je 0x180012a70
mov r8, qword [r8 + 0x10]
mov eax, 0xffffffff
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [r8 + rcx], 0
jne 0x180012a30
test ecx, ecx
je 0x180012a6d
mov r9d, ecx
lea r10, [0x180245050]
nop dword [rax + rax]
movsx edx, byte [r8]
lea r8, [r8 + 1]
mov ecx, eax
shr eax, 8
xor rdx, rcx
movzx ecx, dl
xor eax, dword [r10 + rcx*4]
sub r9, 1
jne 0x180012a50
not eax
ret
xor eax, eax
ret

Function at 0x180013350
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
test rcx, rcx
jne 0x18001335d
xor eax, eax
jmp 0x1800133d6
mov r9, qword [rcx]
test r9, r9
jne 0x180013369
xor eax, eax
jmp 0x1800133d6
mov r9, qword [r9 + 0x10]
test r9, r9
jne 0x180013376
xor eax, eax
jmp 0x1800133d6
mov r10, r9
mov qword [rsp + 8], r9
xor edx, edx
mov r8d, 0xffffffff
lea r11, [0x180245050]
mov dword [rsp], edx
mov ecx, r8d
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x1800133a0
cmp edx, eax
jae 0x1800133cc
movsx eax, byte [r10]
xor rax, rcx
movzx ecx, al
shr r8d, 8
xor r8d, dword [r11 + rcx*4]
inc r10
mov qword [rsp + 8], r10
inc edx
jmp 0x18001338d
not r8d
mov eax, r8d
jmp 0x1800133d6
add rsp, 0x18
ret

Function at 0x180013b40
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x18029571f], 0
mov rbx, rcx
je 0x180013bb1
mov ecx, dword [0x180295800]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180013bb1
cmp dword [0x180295738], 1
jne 0x180013bb1
lea rcx, [rbx + 0x98]
cmp rcx, 0x40000
jbe 0x180013bb1
lea rax, [rcx + 8]
movabs rdx, 0x7fffffff0000
cmp rax, rdx
jae 0x180013bb1
mov rcx, qword [rcx]
add rcx, 0x1dc
cmp rcx, 0x40000
jbe 0x180013bb1
lea rax, [rcx + 4]
cmp rax, rdx
jae 0x180013bb1
mov dword [rcx], 0x3c23d70a
add rsp, 0x20
pop rbx
ret

Function at 0x180018330
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
cmp byte [0x18029561c], 0
jne 0x180018390
lea rcx, [rsp + 0x30]
mov byte [0x18029561c], 1
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm0, xmm0
xorps xmm1, xmm1
cvtsi2ss xmm0, qword [rsp + 0x38]
cvtsi2ss xmm1, qword [rsp + 0x30]
movss dword [0x180295830], xmm0
movss dword [0x18029567c], xmm1
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rsp + 0x30]
subss xmm0, dword [0x18029567c]
divss xmm0, dword [0x180295830]
add rsp, 0x28
ret
Function at 0x180019d70
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1802956e0]
add rax, 0x40cbe0
call rax
mov rcx, rax
call fcn.1800143e0
mov rbx, rax
test rax, rax
je 0x180019f44
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.180013990
cmp dword [rsp + 0x20], 0
je 0x180019f44
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x180019f44
cmp eax, 0xfffffffe
jne 0x180019e56
mov rcx, rbx
call fcn.180013bc0
cmp byte [0x1802956d5], 0
je 0x180019f44
add rbx, 0x98
cmp rbx, 0x40000
jbe 0x180019f44
lea rax, [rbx + 8]
movabs rcx, 0x7fffffff0000
cmp rax, rcx
jae 0x180019f44
mov rdx, qword [rbx]
mov r8, rdx
lea r9, [rdx + 0x340]
cmp r9, 0x40000
jbe 0x180019e29
lea rax, [r9 + 1]
cmp rax, rcx
jae 0x180019e29
mov byte [r9], 1
lea rdx, [r8 + 0x344]
cmp rdx, 0x40000
jbe 0x180019f44
lea rax, [rdx + 4]
cmp rax, rcx
jae 0x180019f44
mov dword [rdx], 0x3f800000
add rsp, 0x70
pop rbx
ret
cmp eax, 3
jne 0x180019e70
mov rcx, rbx
call fcn.180013bc0
mov rcx, rbx
add rsp, 0x70
pop rbx
jmp fcn.180013b40
cmp eax, 2
jne 0x180019ec9
mov rcx, rbx
call fcn.180013bc0
mov rcx, rbx
call fcn.180013b40
cmp byte [0x1802956d4], 0
je 0x180019f44
add rbx, 0x98
cmp rbx, 0x40000
jbe 0x180019f44
lea rax, [rbx + 8]
movabs rcx, 0x7fffffff0000
cmp rax, rcx
jae 0x180019f44
mov rdx, qword [rbx]
add rdx, 0x270
jmp 0x180019f2f
cmp eax, 0xffffffff
jne 0x180019f44
mov rcx, rbx
call fcn.180013bc0
cmp byte [0x180295716], 0
je 0x180019f44
add rbx, 0x98
cmp rbx, 0x40000
jbe 0x180019f44
lea rax, [rbx + 8]
movabs rcx, 0x7fffffff0000
cmp rax, rcx
jae 0x180019f44
mov rdx, qword [rbx]
mov r8, rdx
lea r9, [rdx + 0x340]
cmp r9, 0x40000
jbe 0x180019f28
lea rax, [r9 + 4]
cmp rax, rcx
jae 0x180019f28
mov dword [r9], 0x3f800000
lea rdx, [r8 + 0x350]
cmp rdx, 0x40000
jbe 0x180019f44
lea rax, [rdx + 1]
cmp rax, rcx
jae 0x180019f44
mov byte [rdx], 1
add rsp, 0x70
pop rbx
ret
Function at 0x18001ca50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18001cac8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x18001cac8
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x18001cab5
nop
cmp rbx, rcx
jae 0x18001cac8
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x18001caa0
cmp rbx, rcx
jae 0x18001cac8
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x18001caca
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18003d3f0
Capabilities:
Execute command
Hash data with crc32

Disassembly:
sub rsp, 0x48
cmp dword [0x1802b6b98], 4
jne 0x18003d617
mov r10, qword [0x180295860]
lea rdx, [0x180261cad]
mov qword [rsp + 0x40], rbx
lea r11, [0x18025a0a0]
mov dword [rsp + 0x50], 0xc0c00000
mov r8b, 0x4d
mov dword [rsp + 0x54], 0x43d20000
mov rax, qword [r10 + 0x3ea0]
mov byte [rax + 0x98], 1
mov rax, qword [r10 + 0x3ea0]
movsxd rcx, dword [rax + 0xd0]
mov rax, qword [rax + 0xd8]
mov r9d, dword [rax + rcx*4 - 4]
not r9d
mov ebx, r9d
nop dword [rax]
cmp r8b, 0x23
jne 0x18003d473
cmp byte [rdx], r8b
jne 0x18003d473
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r11 + rcx*4]
test r8b, r8b
jne 0x18003d460
not ebx
cmp dword [r10 + 0x3ed4], ebx
jne 0x18003d4ae
lea r8, str.Main
mov edx, 0xb
mov ecx, ebx
call fcn.18005b750
lea r8, [rsp + 0x50]
mov edx, ebx
lea rcx, str.Main
call fcn.180039ae0
xor eax, eax
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x38], rax
lea r8, [0x180278270]
mov qword [rsp + 0x30], rax
lea rcx, [0x18025e917]
mov dword [rsp + 0x28], eax
mov r9d, 0x100
lea rax, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.18006df90
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0
lea rcx, str.Save
call fcn.1800686e0
mov rbx, qword [rsp + 0x40]
test al, al
je 0x18003d527
call fcn.18002cab0
movss xmm1, dword [0x180264c20]
call fcn.180054500
lea rcx, str.Load
mov qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
call fcn.1800686e0
test al, al
je 0x18003d557
call fcn.18002d0b0
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0
lea rcx, str.Open_Folder
call fcn.1800686e0
test al, al
je 0x18003d582
lea rcx, str.start_C:CHLENIX
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0
lea rcx, str.Unload_Cheat
call fcn.1800686e0
test al, al
je 0x18003d5a7
mov byte [0x18029573d], 1
mov r8d, 0x260
lea rdx, [0x180294af0]
lea rcx, str.UI_color
call fcn.180071520
test al, al
je 0x18003d60e
movss xmm2, dword [0x180264b58]
movss xmm0, dword [0x180294af0]
movss xmm1, dword [0x180294af8]
mulss xmm0, xmm2
mulss xmm1, xmm2
cvttss2si eax, xmm0
movss xmm0, dword [0x180294af4]
mov dword [0x1802780a8], eax
mulss xmm0, xmm2
cvttss2si eax, xmm0
mov dword [0x1802780ac], eax
cvttss2si eax, xmm1
mov dword [0x1802780b0], eax
add rsp, 0x48
jmp fcn.18004df60
add rsp, 0x48
ret
Function at 0x18003f830
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
je 0x18003f840
xor al, al
add rsp, 0x38
ret
xor eax, eax
lea r8, [0x18003f4e0]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18003f86d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x38
ret