joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a19d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x40
mov r14, qword [rcx + 0x10]
mov r12, r8
mov rsi, rdx
mov r9d, dword [r14 + 4]
cmp r9d, 0x12
ja 0x1400a1a62
mov eax, dword [r14]
lea rbx, [r14 + 0x10]
lea rbp, [rax*4 + 2]
add rbp, rax
lea rbp, [r14 + rbp*8]
cmp rbx, rbp
je 0x1400a1a46
movups xmm0, xmmword [r8]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rsp + 0x28]
mov r14, qword [rsp + 0x20]
mov eax, dword [rbx + 0x20]
cmp rdi, rax
jne 0x1400a1a3d
mov rdx, qword [rbx + 0x18]
mov r8, rdi
mov rcx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400a1a54
add rbx, 0x28
cmp rbx, rbp
jne 0x1400a1a22
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 8], rax
jmp 0x1400a1b6c
xor eax, eax
mov qword [rsi], rbx
mov qword [rsi + 8], rax
jmp 0x1400a1b6c
movups xmm0, xmmword [r8]
mov r8, qword [r14 + 8]
movabs rax, 0x340d631b7bdddcdb
sub r8, rax
movq rdx, xmm0
psrldq xmm0, 8
movq rcx, xmm0
test rcx, rcx
je 0x1400a1ab5
movabs r10, 0x100000001b3
nop word [rax + rax]
movsx rax, byte [rdx]
lea rdx, [rdx + 1]
xor r8, rax
imul r8, r10
sub rcx, 1
jne 0x1400a1aa0
xor edx, edx
mov qword [rsp + 0x70], r13
mov rax, r8
mov qword [rsp + 0x78], r15
div r9
lea rax, [r9 + r9*4]
mov qword [rsp + 0x28], r8
lea rcx, [rdx + rax*2]
mov eax, dword [r14 + rcx*4 + 0x10]
cmp eax, 0xffffffff
je 0x1400a1b53
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x30], xmm0
mov r13, qword [rsp + 0x38]
nop dword [rax]
lea rcx, [rax + rax*4]
mov ebx, dword [r14 + rcx*8 + 0x30]
lea rdi, [r14 + rcx*8]
lea r15, [rdi + 0x10]
cmp rbx, r13
jne 0x1400a1b4b
movups xmm1, xmmword [r12]
mov rcx, qword [rdi + 0x28]
mov r8d, ebx
movdqa xmm0, xmm1
movq rdx, xmm1
psrldq xmm0, 8
movq rbp, xmm0
cmp rbp, rbx
cmovb r8, rbp
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400a1b4b
cmp rbx, rbp
je 0x1400a1b83
mov eax, 1
mov ecx, 0xffffffff
cmovb eax, ecx
test eax, eax
je 0x1400a1b83
mov eax, dword [rdi + 0x34]
cmp eax, 0xffffffff
jne 0x1400a1af0
xor eax, eax
mov qword [rsp + 0x20], rax
movups xmm0, xmmword [rsp + 0x20]
mov r13, qword [rsp + 0x70]
mov r15, qword [rsp + 0x78]
movups xmmword [rsi], xmm0
mov rbx, qword [rsp + 0x80]
mov rax, rsi
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x20], r15
jmp 0x1400a1b5a
Function at 0x1400a2f10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov r9, rdx
mov rbx, rcx
mov eax, 0x7ffffffe
cmp rdx, rax
ja 0x1400a3089
mov r10, qword [rcx + 0x10]
mov edx, dword [r10 + 4]
mov ecx, edx
shr rcx, 1
sub rax, rcx
cmp rdx, rax
ja 0x1400a2f56
lea rax, [rcx + rdx]
cmp rax, r9
cmovb rax, r9
mov r9, rax
mov r8, rbx
mov rdx, qword [r10 + 8]
mov rcx, r9
call fcn.1400a1090
mov rdi, rax
mov rdx, qword [rbx + 0x10]
mov eax, dword [rdx]
test eax, eax
je 0x1400a2f8d
add rdx, 0x10
lea rcx, [rdi + 0x10]
lea r8, [rax + rax*4]
shl r8, 3
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbx + 0x10]
mov eax, dword [rax]
mov dword [rdi], eax
mov r10, qword [rbx + 0x10]
mov ecx, dword [r10 + 4]
test ecx, ecx
je 0x1400a2fe8
mov rdx, qword [rbx]
mov rax, rdx
lea r11, [0x1400ce040]
mov r9d, 8
and rax, 0xfffffffffffffffc
cmp ecx, 0x12
ja 0x1400a2fc8
test rdx, rdx
cmovne r11, rax
imul r8, rcx, 0x2c
add r8, 0x10
jmp 0x1400a2fdb
test rdx, rdx
cmovne r11, rax
lea rdx, [rcx + rcx*4]
lea r8, [rdx*8 + 0x10]
mov rax, qword [r11]
mov rdx, r10
mov rcx, r11
call qword [rax + 0x10]
nop
mov qword [rbx + 0x10], rdi
cmp dword [rdi + 4], 0x12
jbe 0x1400a3079
mov r10d, dword [rdi]
lea rax, [r10 + r10*4]
test r10d, r10d
je 0x1400a3079
lea r9, [rdi + 0x30]
lea r9, [r9 + rax*8]
movabs rsi, 0x340d631b7bdddcdb
movabs rdi, 0x100000001b3
nop
dec r10d
lea r9, [r9 - 0x28]
mov r11, qword [rbx + 0x10]
mov r8, qword [r9 - 8]
mov rax, qword [r11 + 8]
sub rax, rsi
mov edx, dword [r9]
test rdx, rdx
je 0x1400a3055
nop
movsx rcx, byte [r8]
xor rax, rcx
imul rax, rdi
lea r8, [r8 + 1]
sub rdx, 1
jne 0x1400a3040
mov ecx, dword [r11 + 4]
xor edx, edx
div rcx
lea rax, [rcx + rcx*4]
lea rcx, [rdx + rax*2]
mov eax, dword [r11 + rcx*4 + 0x10]
mov dword [r9 + 4], eax
mov dword [r11 + rcx*4 + 0x10], r10d
test r10d, r10d
jne 0x1400a3020
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov dword [rsp + 0x20], 0
lea r9, str.unsigned___int64___cdecl_boost::json::object::growth_unsigned___int64__const
mov r8d, 0x302
lea rdx, str.._boost_json_impl_object.ipp
lea rcx, [rsp + 0x30]
call fcn.1400075c0
mov rdx, rax
lea rcx, str.object_too_large
call fcn.1400a3670
int3
Function at 0x1400f5540
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400f556d
xor al, al
jmp 0x1400f56cf
mov rax, qword [0x1401156c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1401156c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1401156d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1401156d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1401156e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1401156e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1401156f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1401156f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x140115700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1400f56c1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1400f5619
mov r11d, 2
jmp 0x1400f563d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1400f5633
mov r11d, 1
jmp 0x1400f563d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1400f56e5
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400f5682
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1400f569a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1400f56aa
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1400f56b8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1400f5600
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1400f56ca
Function at 0x18000f7c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movsxd rax, dword [rcx + 0x3c]
xor r8d, r8d
mov r11, rdx
mov r9, rcx
mov r10d, dword [rax + rcx + 0x88]
add r10, rcx
mov ebx, dword [r10 + 0x18]
test ebx, ebx
je 0x18000f83b
mov esi, dword [r10 + 0x24]
mov r14d, dword [r10 + 0x20]
movzx ebp, byte [rdx]
lea rax, [rsi + r8*2]
movzx edi, word [rax + r9]
lea rax, [r14 + r8*4]
mov edx, dword [rax + r9]
add rdx, r9
movzx ecx, byte [rdx]
cmp cl, bpl
jne 0x18000f833
mov rax, r11
sub rdx, r11
test cl, cl
je 0x18000f854
movzx ecx, byte [rdx + rax + 1]
inc rax
cmp cl, byte [rax]
je 0x18000f823
inc r8d
cmp r8d, ebx
jb 0x18000f801
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdi*4]
add rax, r9
jmp 0x18000f83d

Function at 0x18000fa50
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rdi, rcx
mov rdx, qword [rax + 0x60]
mov rsi, qword [rdx + 0x18]
add rsi, 0x20
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x18000faf0
movabs rbp, 0x6c00640074006e
nop
cmp rdi, 1
jbe 0x18000fad1
mov rax, qword [0x18006df88]
test rax, rax
jne 0x18000fac0
lea ecx, [rax + 1]
call fcn.18000fa50
mov rcx, rax
lea rdx, str._wcsicmp
call fcn.18000f7c0
mov qword [0x18006df88], rax
mov rdx, qword [rbx + 0x50]
mov rcx, rdi
call rax
test eax, eax
je 0x18000fb07
cmp rdi, 1
jne 0x18000fae3
cmp word [rbx + 0x48], 0x12
jne 0x18000fae8
mov rax, qword [rbx + 0x50]
cmp qword [rax], rbp
jmp 0x18000fae6
test rdi, rdi
je 0x18000fb07
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x18000fa90
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
jmp 0x18000faf2
Function at 0x18002b780
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18002b7d0
lea r11, [0x18005fdc0]
nop dword [rax]
cmp r9b, 0x23
jne 0x18002b7b3
cmp byte [r8], r9b
jne 0x18002b7b3
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18002b7a0
mov rcx, qword [0x18006e0a0]
not eax
movsxd rdx, dword [rcx + 0x1ad8]
mov r9, qword [rcx + 0x1ae0]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x18002b831
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x18002b829
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18002b82c
mov rdx, r8
test rdx, rdx
jne 0x18002b800
cmp r9, r10
je 0x18002b840
cmp dword [r9], eax
jne 0x18002b840
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret

Function at 0x18002c3f0
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0xc8]
mov r9, r8
movsxd r8, dword [rcx + 0xc0]
mov r10, rdx
xor ecx, ecx
mov rdx, r9
sub rdx, r10
test r9, r9
mov r8d, dword [rax + r8*4 - 4]
cmove rdx, rcx
mov rcx, r10
jmp fcn.18002cc90

Function at 0x18002cc90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18002cced
lea rbx, [0x18005fdc0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18002ccd4
cmp r10, 2
jb 0x18002ccd4
cmp byte [r9], r8b
jne 0x18002ccd4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18002ccb0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18002cd2f
lea rbx, [0x18005fdc0]
cmp r8b, 0x23
jne 0x18002cd13
cmp byte [r9], r8b
jne 0x18002cd13
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18002cd00
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x18002d880
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
xor eax, eax
lea r8, [0x180060365]
mov dword [rsp + 0x2c], eax
lea r11, [0x18005fdc0]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, str.Window
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov edx, r10d
mov r9b, 0x57
nop
cmp r9b, 0x23
jne 0x18002d8d3
cmp byte [r8], r9b
jne 0x18002d8d3
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x18002d8c0
mov ecx, dword [rbx + 0x2fec]
lea rax, [0x180037980]
mov edi, dword [rbx + 0x2fe8]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x1800378b0]
mov qword [rsp + 0x38], rax
lea rax, [0x180037a30]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x18002d9e3
inc edi
test ecx, ecx
je 0x18002d93f
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x18002d944
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x18002d9e3
mov rax, qword [0x18006e0a0]
mov qword [rsp + 0x60], rsi
test rax, rax
je 0x18002d968
inc dword [rax + 0x3bc]
mov rdx, qword [0x18006e0b0]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call qword [0x18006d2e0]
mov rdx, qword [rbx + 0x2ff0]
mov rsi, rax
test rdx, rdx
je 0x18002d9d1
movsxd rcx, dword [rbx + 0x2fe8]
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0x2ff0]
test rcx, rcx
je 0x18002d9c4
mov rax, qword [0x18006e0a0]
test rax, rax
je 0x18002d9c4
dec dword [rax + 0x3bc]
mov rdx, qword [0x18006e0b0]
call qword [0x18006d2e8]
mov qword [rbx + 0x2ff0], rsi
mov rsi, qword [rsp + 0x60]
mov dword [rbx + 0x2fec], edi
movsxd rax, dword [rbx + 0x2fe8]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2ff0]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2fe8]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x18002e2b0
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push r13
sub rsp, 0x38
mov r13, qword [0x18006e0a0]
mov qword [rsp + 0x50], rbx
mov rbx, rdx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
mov rdi, rcx
mov qword [rsp + 0x30], r12
test rdx, rdx
jne 0x18002e2ee
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x18002e2e5
test r13, r13
je 0x18002e2fa
inc dword [r13 + 0x3bc]
mov rdx, qword [0x18006e0b0]
lea rcx, [rbx + 1]
call qword [0x18006d2e0]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x58], rax
mov rsi, rax
lea r12, [rax + rbx]
call sub.VCRUNTIME140.dll_memcpy
xor ebp, ebp
mov byte [r12], 0
xor edi, edi
mov rcx, rsi
cmp rsi, r12
jae 0x18002e4d3
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
movzx eax, byte [rcx]
cmp al, 0xa
je 0x18002e51e
cmp al, 0xd
je 0x18002e51e
mov rbx, rcx
cmp rcx, r12
jae 0x18002e373
nop
movzx eax, byte [rbx]
cmp al, 0xa
je 0x18002e373
cmp al, 0xd
je 0x18002e373
inc rbx
cmp rbx, r12
jb 0x18002e360
mov byte [rbx], 0
movzx eax, byte [rcx]
cmp al, 0x3b
je 0x18002e4b7
cmp al, 0x5b
jne 0x18002e49e
cmp rbx, rcx
jbe 0x18002e49e
cmp byte [rbx - 1], 0x5d
lea rsi, [rbx - 1]
jne 0x18002e49e
lea r14, [rcx + 1]
mov byte [rsi], 0
mov r8, rsi
mov rcx, r14
sub r8, r14
mov edx, 0x5d
call sub.VCRUNTIME140.dll_memchr
mov r15, rax
test rax, rax
je 0x18002e4b7
lea rcx, [rax + 1]
mov edx, 0x5b
sub rsi, rcx
mov r8, rsi
call sub.VCRUNTIME140.dll_memchr
mov r11, rax
test rax, rax
je 0x18002e4b7
mov byte [r15], 0
lea r8, [r14 + 1]
movzx r9d, byte [r14]
mov esi, 0xffffffff
mov r10, qword [0x18006e0a0]
mov ecx, esi
test r9b, r9b
je 0x18002e43a
cmp r9b, 0x23
jne 0x18002e417
cmp byte [r8], r9b
jne 0x18002e417
cmp byte [r8 + 1], r9b
cmove ecx, esi
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
lea rax, [0x18005fdc0]
inc r8
xor ecx, dword [rax + rdx*4]
test r9b, r9b
jne 0x18002e405
movsxd rax, dword [r10 + 0x2fe8]
xor r8d, r8d
xor edx, edx
not ecx
test eax, eax
jle 0x18002e473
mov r10, qword [r10 + 0x2ff0]
mov r9, rax
lea rax, [r10 + 8]
nop word [rax + rax]
cmp dword [rax], ecx
je 0x18002e479
inc r8d
inc rdx
add rax, 0x30
cmp rdx, r9
jl 0x18002e460
xor edi, edi
xor ebp, ebp
jmp 0x18002e4b7
movsxd rax, r8d
lea rdi, [rax + rax*2]
shl rdi, 4
add rdi, r10
je 0x18002e475
mov rax, qword [rdi + 0x10]
lea r8, [r11 + 1]
mov rdx, rdi
mov rcx, r13
call rax
mov rbp, rax
jmp 0x18002e4b7
test rdi, rdi
je 0x18002e4b7
test rbp, rbp
je 0x18002e4b7
mov r9, rcx
mov r8, rbp
mov rcx, r13
mov rdx, rdi
call qword [rdi + 0x18]
lea rcx, [rbx + 1]
cmp rcx, r12
jb 0x18002e344
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
test rsi, rsi
je 0x18002e4fe
mov rax, qword [0x18006e0a0]
test rax, rax
je 0x18002e4fe
dec dword [rax + 0x3bc]
mov rdx, qword [0x18006e0b0]
mov rcx, rsi
call qword [0x18006d2e8]
mov byte [r13 + 0x2fd0], 1
add rsp, 0x38
pop r13
pop rsi
ret
inc rcx
jmp 0x18002e344
Function at 0x18002e6b0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x18006e0a0]
cmp byte [rbx + 0x3008], 0
je 0x18002e795
cmp qword [rbx + 0x3010], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x3018]
je 0x18002e77d
mov ecx, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test ecx, ecx
jns 0x18002e722
mov eax, ecx
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, ecx
mov rcx, rdi
test eax, eax
cmovg edx, eax
call fcn.180038220
mov dword [rdi], ebp
mov r8, rsi
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
call fcn.180037cf0
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x3010]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x3020]
cmove ecx, ebp
test rax, rax
movsxd r8, ecx
lea rcx, [0x18006e0a8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.180037cf0
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
Function at 0x1800354c0
Capabilities:
Write file on windows

Disassembly:
push r14
push r15
sub rsp, 0x28
mov rax, qword [0x18006e0a0]
xor r15d, r15d
mov r14, rcx
mov dword [rax + 0x2fd4], r15d
test rcx, rcx
je 0x1800355f0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x20], rdi
mov rdi, qword [0x18006e0a0]
lea rbx, [rdi + 0x2fd8]
mov dword [rdi + 0x2fd4], r15d
mov ecx, dword [rbx + 4]
test ecx, ecx
jns 0x18003552e
mov eax, ecx
cdq
sub eax, edx
mov edx, r15d
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.180038220
mov dword [rbx], r15d
cmp dword [rbx + 4], r15d
jne 0x180035544
mov edx, 8
mov rcx, rbx
call fcn.180038220
movsxd rcx, dword [rbx]
mov ebp, r15d
mov rax, qword [rbx + 8]
mov byte [rcx + rax], r15b
inc dword [rbx]
cmp dword [rdi + 0x2fe8], r15d
jle 0x180035585
mov rsi, r15
mov r9, qword [rdi + 0x2ff0]
mov r8, rbx
add r9, rsi
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add rsi, 0x30
cmp ebp, dword [rdi + 0x2fe8]
jl 0x180035560
mov eax, dword [rbx]
lea rdx, [0x18006042c]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x2fe0]
cmove ecx, r15d
lea rdi, [0x18006e0a8]
test rax, rax
movsxd rsi, ecx
mov rcx, r14
cmovne rdi, rax
call fcn.18002ca00
mov rbp, qword [rsp + 0x48]
mov rbx, rax
test rax, rax
je 0x1800355e1
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
pop r15
pop r14
ret
Function at 0x18003aa80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x18003ac11
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x18003aaf0
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.18003da80
mov r8d, dword [rbx + 0x80]
mov r9d, edi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.180038950
mov dword [rbx + 0x80], 0
jmp 0x18003abfd
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.18003dfa0
movzx edx, word [rbx + 0x4c]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rsi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rsi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], edi
movsd xmm0, qword [rsi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], edi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x4c], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180047360
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
call fcn.18002c420
mov rcx, qword [0x18006e178]
lea rdx, [rsp + 0x20]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rsp + 0x28]
sub ecx, dword [rsp + 0x20]
movd xmm1, ecx
mov ecx, dword [rsp + 0x2c]
sub ecx, dword [rsp + 0x24]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rsp + 0x50]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x50]
xorps xmm1, xmm1
sub rax, qword [0x18006e180]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x18006e188]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rsp + 0x50]
mov qword [0x18006e180], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rdi + 0x140], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rdi + 0x141], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x143], 0
mov byte [rdi + 0x142], al
call fcn.18002c420
cmp byte [rax + 0x39b], 0
lea rbx, [rax + 0x128]
je 0x18004747e
cvttss2si ecx, dword [rbx]
lea rdx, [rsp + 0x40]
cvttss2si eax, dword [rax + 0x12c]
mov dword [rsp + 0x40], ecx
mov rcx, qword [0x18006e178]
mov dword [rsp + 0x44], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx], 0xff7fffff
mov dword [rbx + 4], 0xff7fffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x1800474ef
mov rdx, qword [0x18006e178]
cmp rax, rdx
je 0x1800474af
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x1800474ef
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1800474ef
mov rcx, qword [0x18006e178]
lea rdx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1800474ef
movd xmm0, dword [rsp + 0x48]
movd xmm1, dword [rsp + 0x4c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc0], 0
je 0x1800474ff
mov eax, 0xffffffff
jmp 0x180047504
call fcn.18002c4a0
cmp dword [0x18006d4b0], eax
je 0x180047517
mov dword [0x18006d4b0], eax
call fcn.180047530
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret