joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180017ac0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov r9d, 1
bsr r8, rax
mov rsi, rcx
shlx rax, r9, r8
cmp rdx, rax
jbe 0x180017af5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, r9
bsr rcx, rax
mov qword [rsp + 0x40], rdi
mov r8, rbx
inc ecx
mov qword [rsp + 0x48], r14
shlx rdi, r9, rcx
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1800089c0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180017c74
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180017bec
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180017c63
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x180017c29
mov r10, qword [rdx]
cmp r10, rax
je 0x180017c23
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180017c63
cmp r9, rdx
je 0x180017c3f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x180017c89
cmp r9, rdx
jne 0x180017c30
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x180017b70
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180017c63
Function at 0x180018020
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
test cl, cl
je 0x180018068
mov qword [rsp + 0x20], rbx
call fcn.180035790
mov ecx, eax
call fcn.180035410
mov ebx, eax
call fcn.180035790
mov edx, ebx
mov ecx, eax
call fcn.180035450
call fcn.180035790
mov ecx, eax
mov edx, 0xc8
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp 0x1800353c0
add rsp, 0x28
ret
xor eax, eax
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0xcea04d83135264cc
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x1800180f0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
test cl, cl
je 0x18001812b
mov qword [rsp + 0x20], rbx
mov ebx, dword [0x180237e7c]
call fcn.1800354a0
mov edx, ebx
mov ecx, eax
call fcn.1800351a0
call fcn.1800354a0
mov ecx, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.180035150
add rsp, 0x28
ret

Function at 0x180018260
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
test cl, cl
je 0x180018289
call fcn.180035790
mov ecx, eax
mov edx, 0xfbab5776
call fcn.180034cb0
call fcn.1800354a0
mov ecx, eax
add rsp, 0x28
jmp fcn.180034c80
add rsp, 0x28
ret

Function at 0x180018330
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
test cl, cl
je 0x180018365
call fcn.180035790
mov ecx, eax
mov edx, 0xfbab5776
call fcn.180034cb0
call fcn.1800354a0
mov ecx, eax
call fcn.180034c80
call fcn.1800354a0
mov ecx, eax
add rsp, 0x28
jmp 0x180034b50
add rsp, 0x28
ret
xor eax, eax
movabs rdx, 0x438822c279b73b93
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
inc dword [0x1802145a8]
jmp fcn.180017460
Function at 0x1800183f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rsp + 0x88], rax
vmovdqu xmm0, xmmword [0x1801e4ee0]
movzx ebx, cl
mov word [rsp + 0x80], 0
lea rcx, [rsp + 0x70]
vmovdqu xmmword [rsp + 0x70], xmm0
call fcn.180035590
mov edi, eax
test bl, bl
je 0x180018668
vmovaps xmmword [rsp + 0xa0], xmm6
call fcn.180035790
mov ecx, eax
xor edx, edx
call fcn.180035070
call fcn.180035790
mov ecx, eax
xor edx, edx
call fcn.180035020
call fcn.180035790
mov r9d, 1
mov ecx, eax
mov r8d, r9d
mov edx, edi
call fcn.1800356c0
call fcn.180035790
vmovss xmm0, dword [0x1801e46f8]
vxorps xmm6, xmm6, xmm6
vmovss dword [rsp + 0x38], xmm6
vmovss dword [rsp + 0x30], xmm0
mov edx, 1
mov ecx, eax
vmovss dword [rsp + 0x28], xmm6
xor r9d, r9d
mov r8d, edx
vmovss dword [rsp + 0x20], xmm6
call fcn.180034d00
call fcn.180035790
mov ecx, eax
call fcn.1800349d0
test eax, eax
je 0x18001865f
call fcn.180035790
mov ecx, eax
call fcn.180034990
test eax, eax
jne 0x18001865f
lea rdx, [0x1801cdef0]
lea rcx, str.grcWindow
vmovaps xmmword [rsp + 0x90], xmm7
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
vmovss xmm7, dword [0x1801e4738]
xor edi, edi
cmp rax, rbx
jne 0x180018566
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180018566
call fcn.180035790
mov dword [rsp + 0x68], 1
mov ecx, eax
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x40], edi
vmovss dword [rsp + 0x38], xmm6
vmovss dword [rsp + 0x30], xmm6
vmovss dword [rsp + 0x28], xmm6
vmovaps xmm3, xmm7
vxorps xmm2, xmm2, xmm2
vmovss dword [rsp + 0x20], xmm6
call fcn.1800347d0
lea rdx, [0x1801cdef0]
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rbx
jne 0x1800185e0
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1800185e0
call fcn.180035790
vmovss xmm3, dword [0x1801e481c]
mov dword [rsp + 0x68], 1
mov ecx, eax
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x40], edi
vmovss dword [rsp + 0x38], xmm6
vmovss dword [rsp + 0x30], xmm6
vmovss dword [rsp + 0x28], xmm6
vxorps xmm2, xmm2, xmm2
vmovss dword [rsp + 0x20], xmm6
call fcn.1800347d0
lea rdx, [0x1801cdef0]
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rbx
jne 0x180018656
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180018656
call fcn.180035790
mov dword [rsp + 0x68], 1
mov ecx, eax
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x40], edi
vmovss dword [rsp + 0x38], xmm6
vmovss dword [rsp + 0x30], xmm6
vmovss dword [rsp + 0x28], xmm6
vxorps xmm3, xmm3, xmm3
vxorps xmm2, xmm2, xmm2
vmovss dword [rsp + 0x20], xmm7
call fcn.1800347d0
vmovaps xmm7, xmmword [rsp + 0x90]
vmovaps xmm6, xmmword [rsp + 0xa0]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.18016cc50
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rdi
ret
Function at 0x180018790
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
test cl, cl
je 0x18001883a
call fcn.180035790
mov ecx, eax
call fcn.1800346b0
test eax, eax
je 0x18001883a
call fcn.180035790
mov ecx, eax
xor r8d, r8d
mov edx, 0x41
call fcn.180034ec0
call fcn.180035790
mov ecx, eax
xor r8d, r8d
mov edx, 0x42
call fcn.180034ec0
call fcn.180035790
mov ecx, eax
xor r8d, r8d
mov edx, 0xa8
call fcn.180034ec0
call fcn.180035790
mov ecx, eax
mov edx, 0x3c
mov r8d, 1
call fcn.180034ec0
call fcn.180035790
mov ecx, eax
mov edx, 0x3d
mov r8d, 1
call fcn.180034ec0
call fcn.180035790
mov ecx, eax
call fcn.180035330
test eax, eax
je 0x18001883a
call fcn.180035790
mov ecx, eax
add rsp, 0x28
jmp fcn.180034680
add rsp, 0x28
ret
Function at 0x180018df0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbp
push rsi
sub rsp, 0x80
mov qword [rax + 0x10], rdi
mov esi, r9d
mov qword [rax + 0x18], r14
mov rbp, rdx
movzx r14d, r8b
mov rdi, rcx
call fcn.1800342b0
mov rcx, rdi
call fcn.180034280
mov rcx, rdi
call fcn.180034240
test eax, eax
jne 0x180018e88
mov qword [rsp + 0x90], rbx
mov rcx, rdi
call fcn.1800342b0
mov rax, qword gs:[0x20]
lea rcx, [rsp + 0x70]
mov rbx, qword [rax]
call fcn.180027590
mov rax, qword [rax]
add rax, 0x4c4b40
cmp byte [rbx + 0x20], 0
jne 0x180018e66
mov byte [rbx + 0x20], 1
mov qword [rbx + 0x18], rax
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov rcx, rdi
call fcn.180034240
test eax, eax
je 0x180018e35
mov rbx, qword [rsp + 0x90]
lea rdx, str.Self_HandTrails_Rainbow
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
mov rdi, qword [rsp + 0x98]
test al, al
je 0x180018f0a
mov edx, dword [0x180211704]
mov ecx, dword [0x180211700]
test edx, edx
jle 0x180018ed4
test ecx, ecx
jne 0x180018ed4
mov eax, dword [0x180237e74]
dec edx
inc eax
mov dword [0x180211704], edx
mov dword [0x180237e74], eax
jmp 0x180018eda
mov eax, dword [0x180237e74]
test eax, eax
jle 0x180018ef2
test edx, edx
jne 0x180018ef2
dec eax
inc ecx
mov dword [0x180237e74], eax
mov dword [0x180211700], ecx
test ecx, ecx
jle 0x180018f0a
test eax, eax
jne 0x180018f0a
inc edx
dec ecx
mov dword [0x180211704], edx
mov dword [0x180211700], ecx
test r14b, r14b
mov r14, qword [rsp + 0xa0]
je 0x180018f2c
call fcn.180035790
mov edx, eax
mov dword [rsp + 0x40], esi
mov rcx, rbp
call fcn.180034020
jmp 0x180018f3f
call fcn.180035790
mov edx, eax
mov dword [rsp + 0x40], esi
mov rcx, rbp
call fcn.180033e90
vxorps xmm2, xmm2, xmm2
vcvtsi2ss xmm2, xmm2, dword [0x180211700]
vxorps xmm1, xmm1, xmm1
vcvtsi2ss xmm1, xmm1, dword [0x180237e74]
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, dword [0x180211704]
call fcn.180033e20
mov rbp, qword [rsp + 0xa8]
add rsp, 0x80
pop rsi
jmp 0x180033df0
xor eax, eax
movabs rdx, 0x77168d722c58b2fc
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], 0x437f0000
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180019650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x14], 0x6e6f69
mov dword [rbp - 0x20], 0x666c6553
mov dword [rbp - 0x1c], 0x6f6c535f
mov dword [rbp - 0x18], 0x746f4d77
mov byte [rbp - 0x10], 0
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
vmovss xmm2, dword [0x1801e46f8]
movzx eax, al
xor ecx, ecx
vmovd xmm0, eax
vmovd xmm1, ecx
vpcmpeqd xmm3, xmm0, xmm1
vmovss xmm0, dword [0x1801e46e0]
vblendvps xmm0, xmm0, xmm2, xmm3
call fcn.180033ac0
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x657461
mov dword [rbp - 0x20], 0x73696548
mov dword [rbp - 0x1c], 0x636f4c74
mov byte [rbp - 0x14], 0
call fcn.180033a20
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18016cc50
add rsp, 0x40
pop rbp
ret
Function at 0x1800197d0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
vmovaps xmmword [rsp + 0x20], xmm6
call fcn.1800354a0
mov ecx, eax
xor edx, edx
call fcn.1800354d0
mov ecx, 5
call fcn.180035240
xor edi, edi
xor ecx, ecx
mov dword [0x180237e80], edi
call fcn.180035210
call fcn.1800354a0
mov ecx, eax
xor edx, edx
call fcn.1800351a0
call fcn.1800354a0
mov ecx, eax
call fcn.180035150
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
mov edx, 1
call fcn.180035100
call fcn.180035790
mov ecx, eax
mov edx, 1
call fcn.180035070
call fcn.180035790
mov ecx, eax
mov edx, 1
call fcn.180035020
mov ebx, edi
nop dword [rax]
call fcn.180035790
mov ecx, eax
mov edx, ebx
call fcn.180034f80
inc ebx
cmp ebx, 0x11
jl 0x180019860
call fcn.180035790
mov ecx, eax
xor edx, edx
call fcn.180034f30
call fcn.180035790
mov ecx, eax
xor r8d, r8d
mov edx, 0x21
call fcn.180034ec0
call fcn.1800354a0
vmovss xmm6, dword [0x1801e46f8]
vmovaps xmm1, xmm6
mov ecx, eax
call fcn.180034b00
call fcn.1800354a0
mov ecx, eax
vmovaps xmm1, xmm6
call fcn.180034ab0
call fcn.180035790
mov ecx, eax
xor r8d, r8d
mov edx, 0x41
call fcn.180034ec0
call fcn.180035790
mov ecx, eax
xor r8d, r8d
mov edx, 5
call fcn.180034ec0
call fcn.180035790
mov ecx, eax
mov edx, 1
call fcn.180035070
call fcn.180035790
mov ecx, eax
mov edx, 1
call fcn.180035020
call fcn.180035790
mov ecx, eax
call fcn.180034460
xor ecx, ecx
call fcn.180033dc0
mov dword [0x1802116fc], 0x1e
mov dword [0x1802116f8], 0xf
mov dword [0x1802116f4], 0x46
call fcn.180033d20
call fcn.180035790
mov ecx, eax
mov edx, 1
call fcn.180033cb0
call fcn.180035790
mov ecx, eax
mov edx, 0xff
call fcn.180033c40
xor ecx, ecx
call fcn.180033c10
lea rdx, str.Self_DeadEyeMotion
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
vmovss xmm2, dword [0x1801e46f0]
movzx eax, al
vmovd xmm0, eax
vmovd xmm1, edi
vpcmpeqd xmm3, xmm0, xmm1
vblendvps xmm0, xmm2, xmm6, xmm3
call fcn.180033ac0
call fcn.180019650
xor ecx, ecx
call fcn.1800339f0
call fcn.180035790
mov ecx, eax
xor r8d, r8d
mov edx, 0xdf
call fcn.180034ec0
call fcn.180035790
mov ecx, eax
xor edx, edx
call fcn.180033950
call fcn.180035790
mov ecx, eax
vmovaps xmm1, xmm6
mov rbx, qword [rsp + 0x40]
vmovaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rdi
jmp fcn.180034780
Function at 0x18001b0d0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035790
mov edx, eax
xor ecx, ecx
call fcn.180033450
call fcn.180035790
mov edx, eax
xor ecx, ecx
call fcn.180033400
add rsp, 0x28
jmp fcn.1800333e0
Function at 0x18001b750
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
call fcn.180035790
mov ecx, eax
xor edx, edx
call fcn.180032df0
call fcn.180035790
mov ecx, eax
call fcn.180032db0
mov ebx, eax
call fcn.180035790
mov r8d, ebx
xor edx, edx
mov ecx, eax
call fcn.180032d40
call fcn.180035790
mov ecx, eax
call fcn.180032ce0
mov ecx, eax
mov edx, 1
call fcn.180033cb0
call fcn.180035790
mov ecx, eax
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.180035650
Function at 0x18001c510
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
test cl, cl
je 0x18001c546
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
call fcn.180031e30
test eax, eax
je 0x18001c546
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
add rsp, 0x28
jmp 0x180031e00
add rsp, 0x28
ret
xor eax, eax
movabs rdx, 0x7f0dd2ebbb651aff
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x18001c570
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
test cl, cl
je 0x18001c5b9
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
call fcn.180031d70
test eax, eax
je 0x18001c5b9
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
call fcn.1800326a0
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
add rsp, 0x28
jmp fcn.1800326d0
add rsp, 0x28
ret

Function at 0x18001c800
Capabilities:
Hash data using fnv

Disassembly:
test cl, cl
je 0x18001c8dc
push rbx
sub rsp, 0x30
movzx ebx, dl
vmovaps xmmword [rsp + 0x20], xmm6
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
call fcn.180031880
mov edx, 0x56
mov ecx, 2
vmovaps xmm6, xmm0
call fcn.180032940
test eax, eax
je 0x18001c8d1
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
call fcn.180017ec0
test bl, bl
je 0x18001c8b2
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
mov edx, 1
call fcn.180031830
vaddss xmm6, xmm6, dword [0x1802116d8]
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
vmovaps xmm1, xmm6
mov ecx, eax
call fcn.180032ef0
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
xor edx, edx
vmovaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
jmp fcn.180031830
vaddss xmm6, xmm6, dword [0x1802116d8]
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
vmovaps xmm1, xmm6
mov ecx, eax
call fcn.180032ef0
vmovaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
ret

Function at 0x18001c970
Capabilities:
Hash data using fnv
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
test cl, cl
je 0x18001c9d0
lea rdx, [0x1801cdef0]
mov qword [rsp + 0x20], rbx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rbx
mov rbx, qword [rsp + 0x20]
jne 0x18001c9d0
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18001c9d0
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
mov edx, 1
add rsp, 0x28
jmp fcn.180031610
add rsp, 0x28
ret

Function at 0x18001ca60
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
test cl, cl
je 0x18001ca9d
mov qword [rsp + 0x20], rbx
call fcn.180035790
mov ecx, eax
call fcn.180031510
mov ebx, eax
call fcn.180035790
mov r8d, 0xffffffff
mov edx, ebx
mov ecx, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.180035520
add rsp, 0x28
ret
Function at 0x18001caf0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
test cl, cl
je 0x18001cb1e
call fcn.180035790
mov ecx, eax
xor r8d, r8d
mov edx, 0x20
call fcn.180034ec0
call fcn.180035790
mov ecx, eax
xor edx, edx
add rsp, 0x28
jmp 0x180031420
add rsp, 0x28
ret
xor eax, eax
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0x7a6535691b477c48
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x18001cb60
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
cmp byte [rcx], 0
je 0x18001cb98
mov qword [rsp + 0x20], rbx
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ebx, eax
call fcn.1800354a0
mov edx, ebx
mov ecx, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp 0x180031390
add rsp, 0x28
ret
xor eax, eax
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0x480142959d337d00
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], 0x42c80000
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], 2
inc dword [0x1802145a8]
jmp fcn.180017460
Function at 0x18001cba0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
xor edx, edx
call fcn.180031f60
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
xor edx, edx
call fcn.180031f10
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
mov edx, 1
call fcn.180031ec0
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
mov edx, 1
call fcn.180031e70
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
mov edx, 1
call fcn.180033cb0
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
xor edx, edx
call fcn.180031cd0
xor ecx, ecx
call fcn.180031c50
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
xor edx, edx
call fcn.180031db0
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
mov edx, 1
call fcn.180031c00
mov dword [0x1802116e0], 1
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
vmovss xmm1, dword [0x1801e46f8]
mov ecx, eax
call fcn.180031bb0
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
xor edx, edx
call fcn.180031b60
xor ecx, ecx
call fcn.180031b30
xor ecx, ecx
call fcn.180031b00
xor ecx, ecx
call fcn.180031aa0
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
xor edx, edx
call fcn.180031a50
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
mov edx, 1
call fcn.180031a00
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
mov edx, 1
call fcn.1800319b0
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
xor edx, edx
call fcn.180031960
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
xor edx, edx
call fcn.180031910
call fcn.180031810
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
mov edx, 1
call fcn.1800317a0
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
xor edx, edx
call fcn.1800316b0
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
xor edx, edx
call fcn.180031610
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
mov edx, 1
call fcn.1800315a0
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
mov edx, 1
call fcn.180032e40
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
xor edx, edx
call fcn.180031550
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
mov edx, 1
call fcn.1800314c0
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
xor edx, edx
call fcn.180031470
call fcn.180035790
mov ecx, eax
mov edx, 0x20
mov r8d, 1
call fcn.180034ec0
call fcn.180035790
mov ecx, eax
mov edx, 1
add rsp, 0x28
jmp 0x180031420
Function at 0x18001e3e0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
test cl, cl
je 0x18001e408
call fcn.180030e90
call fcn.180035790
mov ecx, eax
xor edx, edx
call fcn.1800331d0
test eax, eax
je 0x18001e408
add rsp, 0x28
jmp 0x180030e70
add rsp, 0x28
ret
xor eax, eax
movabs rdx, 0x9e4cfff989258472
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
jmp fcn.180017460

Function at 0x18001e410
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
test cl, cl
je 0x18001e45a
mov qword [rsp + 0x20], rbx
xor ebx, ebx
nop
mov ecx, ebx
call fcn.180030dd0
inc ebx
cmp ebx, 0x16
jl 0x18001e420
mov rbx, qword [rsp + 0x20]
call fcn.180030db0
call fcn.180030d90
call fcn.180030d70
call fcn.180030d50
call fcn.180030d30
call fcn.180030e90
add rsp, 0x28
jmp 0x180030e70
add rsp, 0x28
ret

Function at 0x18001e470
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
cmp byte [rcx], 0
je 0x18001e4ae
call fcn.180030cc0
mov ecx, 1
call fcn.180030d00
call fcn.180030c90
call fcn.180030c60
lea rcx, str.MP_LEADERBOARD_SCENE
call fcn.180030c30
lea rcx, str.MP_MISSION_NAME_SCENE
add rsp, 0x28
jmp fcn.180030c30
add rsp, 0x28
ret

Function at 0x18001e700
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
xor ecx, ecx
call fcn.180031130
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
mov edx, 1
call fcn.180030b70
xor ebx, ebx
mov ecx, ebx
call fcn.180030ae0
mov rcx, rax
xor edx, edx
call fcn.180030b20
inc ebx
cmp ebx, 0x1e
jl 0x18001e727
mov ecx, 1
call fcn.180030d00
xor ecx, ecx
call fcn.180030ab0
xor ecx, ecx
call fcn.180030a80
xor ecx, ecx
call fcn.180030a50
call fcn.1800333e0
xor ecx, ecx
call fcn.180030950
call fcn.180035790
mov ecx, eax
xor edx, edx
call fcn.180030900
vxorps xmm0, xmm0, xmm0
vmovss dword [0x180237e58], xmm0
call fcn.1800308d0
call fcn.180030880
vmovss xmm0, dword [0x1801e46f8]
call fcn.180030820
vmovss xmm0, dword [0x1801e46f8]
add rsp, 0x20
pop rbx
jmp fcn.1800307f0