joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800046f8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
mov r8d, dword [0x1801b5354]
mov rdi, rcx
movaps xmmword [rax - 0x28], xmm6
xor ebp, ebp
mov rax, qword gs:[0x58]
mov sil, dl
movss xmm6, dword [0x180162ce4]
mov ecx, 4
mov r9, qword [rax + r8*8]
mov eax, dword [rcx + r9]
cmp dword [0x1801b60f0], eax
jg 0x18000489d
movabs rbx, 0xcbf29ce484222325
mov rdx, rbp
mov rcx, rbx
movabs r14, 0x100000001b3
movzx eax, byte [rsp + rdx + 0x70]
inc rdx
xor rcx, rax
imul rcx, r14
cmp rdx, 8
jb 0x180004766
and rcx, qword [0x1801b60e0]
mov r8, qword [0x1801b60c8]
add rcx, rcx
mov rdx, qword [0x1801b60b8]
mov rax, qword [r8 + rcx*8 + 8]
cmp rax, rdx
je 0x1800047b7
mov r9, qword [r8 + rcx*8]
jmp 0x1800047ac
cmp rax, r9
je 0x1800047b7
mov rax, qword [rax + 8]
cmp rdi, qword [rax + 0x10]
jne 0x1800047a3
test rax, rax
jne 0x1800047ba
mov rax, rdx
cmp rax, rdx
jne 0x18000482e
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], ebp
call fcn.18000500c
mov rcx, rbp
movzx eax, byte [rsp + rcx + 0x70]
inc rcx
xor rbx, rax
imul rbx, r14
cmp rcx, 8
jb 0x1800047da
and rbx, qword [0x1801b60e0]
mov rcx, qword [0x1801b60c8]
add rbx, rbx
mov rdx, qword [0x1801b60b8]
mov rax, qword [rcx + rbx*8 + 8]
cmp rax, rdx
je 0x18000482b
mov r8, qword [rcx + rbx*8]
jmp 0x180004820
cmp rax, r8
je 0x18000482b
mov rax, qword [rax + 8]
cmp rdi, qword [rax + 0x10]
jne 0x180004817
test rax, rax
jne 0x18000482e
mov rax, rdx
mov rcx, qword [0x1801b5b38]
mov edx, 0xff
subss xmm6, dword [rcx + 0x18]
mov ecx, dword [rax + 0x18]
mulss xmm6, dword [0x1801630e4]
test sil, sil
je 0x180004860
cmp ecx, edx
jge 0x180004875
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
addss xmm0, xmm6
jmp 0x18000486f
test ecx, ecx
jle 0x180004873
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
subss xmm0, xmm6
cvttss2si ecx, xmm0
cmp ecx, edx
jg 0x18000487e
test ecx, ecx
mov edx, ecx
cmovs edx, ebp
movaps xmm6, xmmword [rsp + 0x40]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov dword [rax + 0x18], edx
mov eax, edx
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea rcx, [0x1801b60f0]
call fcn.18006fb50
cmp dword [0x1801b60f0], 0xffffffff
jne 0x18000474c
mov ecx, 0x20
call fcn.18006f980
xorps xmm0, xmm0
lea rcx, [0x1801b60c8]
mov r8, rax
mov edx, 0x10
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x1801b60b8], rax
mov qword [0x1801b60c8], rbp
movdqa xmmword [0x1801b60d0], xmm0
mov qword [0x1801b60e0], 7
mov qword [0x1801b60e8], 8
mov dword [0x1801b60b0], 0x3f800000
call fcn.180004c90
lea rcx, [0x1800dcae4]
call fcn.18006ffc8
lea rcx, [0x1801b60f0]
call fcn.18006faf0
jmp 0x18000474c
Function at 0x1800049d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x60
mov r8d, dword [0x1801b5354]
mov rdi, rcx
movaps xmmword [rax - 0x18], xmm6
mov sil, dl
movaps xmmword [rax - 0x28], xmm8
movaps xmm6, xmm3
mov rax, qword gs:[0x58]
movss xmm8, dword [0x180162ce4]
mov ecx, 4
mov r9, qword [rax + r8*8]
mov eax, dword [rcx + r9]
cmp dword [0x1801b60f4], eax
jg 0x180004b85
movabs rbx, 0xcbf29ce484222325
xor edx, edx
mov rcx, rbx
movabs rbp, 0x100000001b3
movzx eax, byte [rsp + rdx + 0x70]
inc rdx
xor rcx, rax
imul rcx, rbp
cmp rdx, 8
jb 0x180004a45
and rcx, qword [0x1801b60a0]
mov r8, qword [0x1801b6088]
add rcx, rcx
mov rdx, qword [0x1801b6078]
mov rax, qword [r8 + rcx*8 + 8]
cmp rax, rdx
je 0x180004a96
mov r9, qword [r8 + rcx*8]
jmp 0x180004a8b
cmp rax, r9
je 0x180004a96
mov rax, qword [rax + 8]
cmp rdi, qword [rax + 0x10]
jne 0x180004a82
test rax, rax
jne 0x180004a99
mov rax, rdx
cmp rax, rdx
jne 0x180004b0d
and dword [rsp + 0x28], 0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
call fcn.180004dc8
xor ecx, ecx
movzx eax, byte [rsp + rcx + 0x70]
inc rcx
xor rbx, rax
imul rbx, rbp
cmp rcx, 8
jb 0x180004ab9
and rbx, qword [0x1801b60a0]
mov rcx, qword [0x1801b6088]
add rbx, rbx
mov rdx, qword [0x1801b6078]
mov rax, qword [rcx + rbx*8 + 8]
cmp rax, rdx
je 0x180004b0a
mov r8, qword [rcx + rbx*8]
jmp 0x180004aff
cmp rax, r8
je 0x180004b0a
mov rax, qword [rax + 8]
cmp rdi, qword [rax + 0x10]
jne 0x180004af6
test rax, rax
jne 0x180004b0d
mov rax, rdx
mov rcx, qword [0x1801b5b38]
movss xmm0, dword [rax + 0x18]
subss xmm8, dword [rcx + 0x18]
mulss xmm8, dword [0x180162af0]
test sil, sil
je 0x180004b39
comiss xmm0, xmm6
jae 0x180004b47
addss xmm0, xmm8
jmp 0x180004b47
comiss xmm0, dword [0x180162a4c]
jbe 0x180004b47
subss xmm0, xmm8
comiss xmm6, xmm0
jb 0x180004b5d
comiss xmm0, dword [0x180162a4c]
jae 0x180004b5a
xorps xmm6, xmm6
jmp 0x180004b5d
movaps xmm6, xmm0
lea r11, [rsp + 0x60]
movss dword [rax + 0x18], xmm6
mov rbx, qword [r11 + 0x18]
movaps xmm0, xmm6
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
movaps xmm8, xmmword [r11 - 0x20]
movaps xmm6, xmmword [rsp + 0x50]
mov rsp, r11
pop rdi
ret
lea rcx, [0x1801b60f4]
call fcn.18006fb50
cmp dword [0x1801b60f4], 0xffffffff
jne 0x180004a2c
mov ecx, 0x20
call fcn.18006f980
xorps xmm0, xmm0
lea rcx, [0x1801b6088]
mov r8, rax
mov edx, 0x10
mov qword [rax], rax
mov qword [rax + 8], rax
and qword [0x1801b6088], 0
mov qword [0x1801b6078], rax
movdqa xmmword [0x1801b6090], xmm0
mov qword [0x1801b60a0], 7
mov qword [0x1801b60a8], 8
mov dword [0x1801b6070], 0x3f800000
call fcn.180004c90
lea rcx, [0x1800dcaf0]
call fcn.18006ffc8
lea rcx, [0x1801b60f4]
call fcn.18006faf0
jmp 0x180004a2c
Function at 0x180004dc8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, r8
mov rdi, rdx
movabs rbp, 0xcbf29ce484222325
xor ecx, ecx
movzx eax, byte [rcx + r8]
movabs rdx, 0x100000001b3
xor rbp, rax
inc rcx
imul rbp, rdx
cmp rcx, 8
jb 0x180004df3
mov rcx, qword [0x1801b60a0]
mov rdx, qword [0x1801b6088]
and rcx, rbp
mov rsi, qword [0x1801b6078]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, rsi
je 0x180004e6a
mov r8, qword [rdx + rcx*8]
mov rcx, qword [r14]
jmp 0x180004e49
cmp rax, r8
je 0x180004e63
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x180004e40
mov rsi, qword [rax]
test rax, rax
je 0x180004e6a
mov qword [rdi], rax
mov byte [rdi + 8], 0
jmp 0x180004feb
mov rsi, rax
xor eax, eax
jmp 0x180004e52
movabs rax, 0x7ffffffffffffff
cmp qword [0x1801b6080], rax
jne 0x180004e8b
lea rcx, [0x18015d9e0]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov ecx, 0x20
call fcn.18006f980
movups xmm0, xmmword [r14]
mov rbx, rax
xorps xmm1, xmm1
movdqu xmmword [rax + 0x10], xmm0
mov rdx, qword [0x1801b6080]
lea rcx, [rdx + 1]
test rcx, rcx
js 0x180004ebb
cvtsi2ss xmm1, rcx
jmp 0x180004ed0
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mov rcx, qword [0x1801b60a8]
xorps xmm0, xmm0
test rcx, rcx
js 0x180004ee6
cvtsi2ss xmm0, rcx
jmp 0x180004efb
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x1801b6070]
comiss xmm0, xmm1
jae 0x180004f80
call fcn.180005250
mov rax, qword [0x1801b60a0]
mov r8, qword [0x1801b6088]
and rax, rbp
mov rdx, qword [0x1801b6078]
add rax, rax
mov rcx, qword [r8 + rax*8 + 8]
cmp rcx, rdx
jne 0x180004f43
mov qword [rsp + 0x20], rdx
and qword [rsp + 0x28], 0
jmp 0x180004f69
mov rdx, qword [r8 + rax*8]
mov rax, qword [rbx + 0x10]
jmp 0x180004f56
cmp rcx, rdx
je 0x180004fc3
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x180004f4d
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
movaps xmm0, xmmword [rsp + 0x20]
mov rdx, qword [0x1801b6080]
movdqa xmmword [rsp + 0x20], xmm0
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsi + 8]
inc rdx
mov qword [0x1801b6080], rdx
mov qword [rbx], rsi
mov qword [rbx + 8], r8
mov qword [r8], rbx
mov qword [rsi + 8], rbx
mov rax, qword [0x1801b60a0]
mov rcx, qword [0x1801b6088]
and rax, rbp
add rax, rax
mov rdx, qword [rcx + rax*8]
cmp rdx, qword [0x1801b6078]
jne 0x180004fcd
mov qword [rcx + rax*8], rbx
jmp 0x180004fdf
mov qword [rsp + 0x20], rcx
jmp 0x180004f3b
cmp rdx, rsi
jne 0x180004fd8
mov qword [rcx + rax*8], rbx
jmp 0x180004fe4
cmp qword [rcx + rax*8 + 8], r8
jne 0x180004fe4
mov qword [rcx + rax*8 + 8], rbx
mov qword [rdi], rbx
mov byte [rdi + 8], 1
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x18000500c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, r8
mov rdi, rdx
movabs rbp, 0xcbf29ce484222325
xor ecx, ecx
movzx eax, byte [rcx + r8]
movabs rdx, 0x100000001b3
xor rbp, rax
inc rcx
imul rbp, rdx
cmp rcx, 8
jb 0x180005037
mov rcx, qword [0x1801b60e0]
mov rdx, qword [0x1801b60c8]
and rcx, rbp
mov rsi, qword [0x1801b60b8]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, rsi
je 0x1800050ae
mov r8, qword [rdx + rcx*8]
mov rcx, qword [r14]
jmp 0x18000508d
cmp rax, r8
je 0x1800050a7
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x180005084
mov rsi, qword [rax]
test rax, rax
je 0x1800050ae
mov qword [rdi], rax
mov byte [rdi + 8], 0
jmp 0x18000522f
mov rsi, rax
xor eax, eax
jmp 0x180005096
movabs rax, 0x7ffffffffffffff
cmp qword [0x1801b60c0], rax
jne 0x1800050cf
lea rcx, [0x18015d9e0]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov ecx, 0x20
call fcn.18006f980
movups xmm0, xmmword [r14]
mov rbx, rax
xorps xmm1, xmm1
movdqu xmmword [rax + 0x10], xmm0
mov rdx, qword [0x1801b60c0]
lea rcx, [rdx + 1]
test rcx, rcx
js 0x1800050ff
cvtsi2ss xmm1, rcx
jmp 0x180005114
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mov rcx, qword [0x1801b60e8]
xorps xmm0, xmm0
test rcx, rcx
js 0x18000512a
cvtsi2ss xmm0, rcx
jmp 0x18000513f
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x1801b60b0]
comiss xmm0, xmm1
jae 0x1800051c4
call fcn.1800054a0
mov rax, qword [0x1801b60e0]
mov r8, qword [0x1801b60c8]
and rax, rbp
mov rdx, qword [0x1801b60b8]
add rax, rax
mov rcx, qword [r8 + rax*8 + 8]
cmp rcx, rdx
jne 0x180005187
mov qword [rsp + 0x20], rdx
and qword [rsp + 0x28], 0
jmp 0x1800051ad
mov rdx, qword [r8 + rax*8]
mov rax, qword [rbx + 0x10]
jmp 0x18000519a
cmp rcx, rdx
je 0x180005207
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x180005191
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
movaps xmm0, xmmword [rsp + 0x20]
mov rdx, qword [0x1801b60c0]
movdqa xmmword [rsp + 0x20], xmm0
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsi + 8]
inc rdx
mov qword [0x1801b60c0], rdx
mov qword [rbx], rsi
mov qword [rbx + 8], r8
mov qword [r8], rbx
mov qword [rsi + 8], rbx
mov rax, qword [0x1801b60e0]
mov rcx, qword [0x1801b60c8]
and rax, rbp
add rax, rax
mov rdx, qword [rcx + rax*8]
cmp rdx, qword [0x1801b60b8]
jne 0x180005211
mov qword [rcx + rax*8], rbx
jmp 0x180005223
mov qword [rsp + 0x20], rcx
jmp 0x18000517f
cmp rdx, rsi
jne 0x18000521c
mov qword [rcx + rax*8], rbx
jmp 0x180005228
cmp qword [rcx + rax*8 + 8], r8
jne 0x180005228
mov qword [rcx + rax*8 + 8], rbx
mov qword [rdi], rbx
mov byte [rdi + 8], 1
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x180005250
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [0x1801b6080]
mov esi, 1
add rcx, rsi
xorps xmm1, xmm1
js 0x18000527a
cvtsi2ss xmm1, rcx
jmp 0x18000528f
mov rax, rcx
and rcx, rsi
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm1, dword [0x1801b6070]
cvttss2si ecx, xmm1
cmp ecx, 0x80000000
je 0x1800052c2
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm1
je 0x1800052c2
unpcklps xmm1, xmm1
movmskps eax, xmm1
and eax, esi
xor eax, esi
add ecx, eax
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movss xmm0, dword [0x180163224]
xor ecx, ecx
comiss xmm1, xmm0
jb 0x1800052e7
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x1800052e7
movabs rax, 0x8000000000000000
mov rcx, rax
mov rdx, qword [0x1801b60a8]
cvttss2si rax, xmm1
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x18000531c
cmp rdx, 0x200
jae 0x180005319
shl rdx, 3
cmp rdx, rcx
jae 0x18000531c
mov rdx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov rax, rsi
shl rax, cl
cmp rdx, rax
jbe 0x180005343
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rbx, qword [0x1801b6078]
lea rax, [rdx - 1]
or rax, rsi
mov rdi, rsi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1801b6088]
lea rdx, [rdi + rdi]
call fcn.180004c90
mov rax, qword [0x1801b6078]
lea r9, [rdi - 1]
mov qword [0x1801b60a0], r9
mov qword [0x1801b60a8], rdi
mov rax, qword [rax]
mov rdx, rax
cmp rax, rbx
je 0x18000548f
mov rdx, qword [rdx]
movabs r11, 0xcbf29ce484222325
xor r8d, r8d
movzx ecx, byte [r8 + rax + 0x10]
movabs r10, 0x100000001b3
xor r11, rcx
add r8, rsi
imul r11, r10
cmp r8, 8
jb 0x1800053a8
mov rdi, qword [0x1801b6088]
and r11, r9
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x1800053e6
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x180005455
mov rcx, qword [rdi + r11*8 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rcx + 0x10]
jne 0x18000542a
mov r8, qword [rcx]
cmp r8, rax
je 0x1800053df
mov r10, qword [rax + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rcx, qword [r8 + 8]
mov qword [rcx], rax
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rax + 8], rcx
jmp 0x1800053df
mov rcx, qword [rcx + 8]
cmp r8, qword [rcx + 0x10]
je 0x180005469
cmp qword [rdi + r11*8], rcx
jne 0x180005420
mov r10, qword [rax + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], rax
mov qword [rcx + 8], r9
mov qword [rdx + 8], r10
mov qword [rax + 8], r8
mov qword [rdi + r11*8], rax
mov rax, rdx
cmp rdx, rbx
je 0x18000548f
mov r9, qword [0x1801b60a0]
jmp 0x180005398
mov r10, qword [rcx]
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rcx, qword [r10 + 8]
mov qword [rcx], rax
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
jmp 0x180005455
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800054a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [0x1801b60c0]
mov esi, 1
add rcx, rsi
xorps xmm1, xmm1
js 0x1800054ca
cvtsi2ss xmm1, rcx
jmp 0x1800054df
mov rax, rcx
and rcx, rsi
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm1, dword [0x1801b60b0]
cvttss2si ecx, xmm1
cmp ecx, 0x80000000
je 0x180005512
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm1
je 0x180005512
unpcklps xmm1, xmm1
movmskps eax, xmm1
and eax, esi
xor eax, esi
add ecx, eax
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movss xmm0, dword [0x180163224]
xor ecx, ecx
comiss xmm1, xmm0
jb 0x180005537
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x180005537
movabs rax, 0x8000000000000000
mov rcx, rax
mov rdx, qword [0x1801b60e8]
cvttss2si rax, xmm1
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x18000556c
cmp rdx, 0x200
jae 0x180005569
shl rdx, 3
cmp rdx, rcx
jae 0x18000556c
mov rdx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov rax, rsi
shl rax, cl
cmp rdx, rax
jbe 0x180005593
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rbx, qword [0x1801b60b8]
lea rax, [rdx - 1]
or rax, rsi
mov rdi, rsi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1801b60c8]
lea rdx, [rdi + rdi]
call fcn.180004c90
mov rax, qword [0x1801b60b8]
lea r9, [rdi - 1]
mov qword [0x1801b60e0], r9
mov qword [0x1801b60e8], rdi
mov rax, qword [rax]
mov rdx, rax
cmp rax, rbx
je 0x1800056df
mov rdx, qword [rdx]
movabs r11, 0xcbf29ce484222325
xor r8d, r8d
movzx ecx, byte [r8 + rax + 0x10]
movabs r10, 0x100000001b3
xor r11, rcx
add r8, rsi
imul r11, r10
cmp r8, 8
jb 0x1800055f8
mov rdi, qword [0x1801b60c8]
and r11, r9
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x180005636
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x1800056a5
mov rcx, qword [rdi + r11*8 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rcx + 0x10]
jne 0x18000567a
mov r8, qword [rcx]
cmp r8, rax
je 0x18000562f
mov r10, qword [rax + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rcx, qword [r8 + 8]
mov qword [rcx], rax
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rax + 8], rcx
jmp 0x18000562f
mov rcx, qword [rcx + 8]
cmp r8, qword [rcx + 0x10]
je 0x1800056b9
cmp qword [rdi + r11*8], rcx
jne 0x180005670
mov r10, qword [rax + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], rax
mov qword [rcx + 8], r9
mov qword [rdx + 8], r10
mov qword [rax + 8], r8
mov qword [rdi + r11*8], rax
mov rax, rdx
cmp rdx, rbx
je 0x1800056df
mov r9, qword [0x1801b60e0]
jmp 0x1800055e8
mov r10, qword [rcx]
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rcx, qword [r10 + 8]
mov qword [rcx], rax
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
jmp 0x1800056a5
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18000da68
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x18000db31
call fcn.18000d1d0
cmp qword [rax], 0
je 0x18000db31
mov rcx, rbx
call fcn.18000d1d0
mov rdi, qword [rax]
test rdi, rdi
je 0x18000db31
mov rax, qword gs:[0x58]
or rbx, 0xffffffffffffffff
mov ecx, dword [0x1801b5354]
mov r8d, 4
mov rdx, qword [rax + rcx*8]
mov eax, dword [r8 + rdx]
cmp dword [0x1801b6330], eax
jg 0x18000db3e
mov rax, qword [0x1801b62e8]
mov rcx, rdi
call rax
test rax, rax
je 0x18000db31
mov rax, qword [rax]
test rax, rax
je 0x18000db31
mov r9, qword [rax + 0x10]
or r8d, 0xffffffff
inc rbx
cmp byte [r9 + rbx], 0
jne 0x18000daeb
test ebx, ebx
je 0x18000db31
mov r10d, ebx
movsx ecx, byte [r9]
mov eax, r8d
xor rcx, rax
shr r8d, 8
movzx edx, cl
inc r9
lea rcx, [0x180158d00]
xor r8d, dword [rcx + rdx*4]
sub r10, 1
jne 0x18000dafc
not r8d
cmp r8d, 0xafa91f9a
jne 0x18000db31
mov al, 1
jmp 0x18000db33
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x1801b6330]
call fcn.18006fb50
cmp dword [0x1801b6330], ebx
jne 0x18000daca
mov ecx, 0x99c155f5
call fcn.180007704
lea rcx, [0x1801b6330]
mov rdx, qword [rax]
mov qword [0x1801b62e8], rdx
call fcn.18006faf0
jmp 0x18000daca

Function at 0x18000eb94
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], rcx
lea rcx, [0x1801b5988]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rcx, qword [0x1801b5988]
mov r8d, dword [0x1801b598c]
test ax, ax
je 0x18000ec44
movss xmm3, dword [0x1801755b0]
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm3
jbe 0x18000ec44
movss xmm4, dword [0x1801755b4]
movd xmm2, r8d
cvtdq2ps xmm2, xmm2
comiss xmm2, xmm4
jbe 0x18000ec44
movss xmm0, dword [rsp + 0x20]
addss xmm0, xmm3
comiss xmm1, xmm0
jae 0x18000ec44
movss xmm0, dword [rsp + 0x24]
addss xmm0, xmm4
comiss xmm2, xmm0
jae 0x18000ec44
cmp byte [0x1801b5979], 0
mov dl, 1
mov byte [0x1801b5978], dl
jne 0x18000ec4e
subss xmm1, xmm3
mov byte [0x1801b5979], dl
subss xmm2, xmm4
cvttss2si eax, xmm1
mov dword [0x1801b5980], eax
cvttss2si eax, xmm2
mov dword [0x1801b5984], eax
jmp 0x18000ec4a
mov dl, byte [0x1801b5978]
test dl, dl
je 0x18000ec7a
sub ecx, dword [0x1801b5980]
sub r8d, dword [0x1801b5984]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movss dword [0x1801755b0], xmm0
movd xmm0, r8d
cvtdq2ps xmm0, xmm0
movss dword [0x1801755b4], xmm0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x18000ec96
mov byte [0x1801b5978], al
mov byte [0x1801b5979], al
add rsp, 0x38
ret
Function at 0x18002c180
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov r8, qword [0x1801755d0]
xor ebx, ebx
mov qword [rbp + 0x17], rbx
or rcx, 0xffffffffffffffff
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x2f], 0xf
inc rcx
cmp byte [rdx + rcx], bl
jne 0x18002c1af
movabs rax, 0x7fffffffffffffff
sub rax, r8
cmp rax, rcx
jb 0x18002c34b
cmp qword [0x1801755d8], 0x10
lea r9, [0x1801755c0]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x37]
cmovae r9, qword [0x1801755c0]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r8
call fcn.18000432c
mov rcx, qword [rbp + 0x47]
mov edx, 4
mov rax, qword [rbp + 0x4f]
sub rax, rcx
cmp rax, rdx
jb 0x18002c238
cmp qword [rbp + 0x4f], 0x10
lea rax, [rcx + 4]
mov qword [rbp + 0x47], rax
lea rax, [rbp + 0x37]
cmovae rax, qword [rbp + 0x37]
mov dword [rax + rcx], 0x6766632e
mov byte [rax + rcx + 4], bl
lea rax, [rbp + 0x37]
jmp 0x18002c24d
lea r9, str..cfg
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x37]
call fcn.180002244
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rbx
mov byte [rax], bl
mov ebx, 0x1000
mov qword [rax + 0x18], 0xf
mov rdx, qword [rbp + 0x2f]
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm1
cmp rdx, 0x10
jb 0x18002c2aa
mov rcx, qword [rbp + 0x17]
inc rdx
mov rax, rcx
cmp rdx, rbx
jb 0x18002c29d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002c2e0
call fcn.18006f9bc
movups xmm0, xmmword [rbp - 9]
movups xmm1, xmmword [rbp + 7]
mov rdx, qword [rbp + 0x4f]
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm1
cmp rdx, 0x10
jb 0x18002c2ec
mov rcx, qword [rbp + 0x37]
inc rdx
mov rax, rcx
cmp rdx, rbx
jb 0x18002c2e7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002c2e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18006f9bc
cmp qword [rbp + 0x2f], 0x10
lea rcx, [rbp + 0x17]
cmovae rcx, qword [rbp + 0x17]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0x10
jb 0x18002c33a
mov rcx, qword [rbp + 0x17]
inc rdx
mov rax, rcx
cmp rdx, rbx
jb 0x18002c335
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002c335
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18006f9bc
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret
call fcn.180001c44
int3