joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a6c50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x1801ab040]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rbx, rcx
mov qword [rbp + 0x17], rcx
xor edi, edi
mov dword [rbp - 0x39], edi
movdqa xmm0, xmmword [0x180193540]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x180193550]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm0, xmmword [0x180193560]
movdqa xmmword [rbp - 9], xmm0
mov dword [rbp + 7], 0x6464646c
mov dword [rbp + 0xb], 0x7173710f
mov dword [rbp + 0xf], 0x71737177
mov dword [rbp + 0x13], 0x100717f
mov eax, edi
nop
lea ecx, [rax + 0xb]
xor byte [rbp + rax - 0x29], cl
inc rax
cmp rax, 0x3e
jb 0x1800a6cd0
mov byte [rbp + 0x16], dil
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f], xmm0
mov qword [rbp + 0x2f], rdi
mov qword [rbp + 0x37], rdi
lea rax, [rbp - 0x29]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x1800a6d00
lea rdx, [rbp - 0x29]
lea rcx, [rbp + 0x1f]
call fcn.18000eea0
nop
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov dword [rbp - 0x39], 1
mov edi, 0x10
mov edx, edi
mov rcx, rbx
call fcn.18000de00
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov rsi, qword [rbp + 0x37]
mov r14, qword [rbp + 0x2f]
mov r15, qword [rbp + 0x1f]
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
xor edx, edx
div r14
lea rax, [rbp + 0x1f]
cmp rsi, 0xf
cmova rax, r15
movzx r9d, byte [rax + rdx]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1800a6daa
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x1800a6d9f
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1800a6db2
mov rcx, rbx
call fcn.18000efa0
sub rdi, 1
jne 0x1800a6d60
lea rcx, [rbp + 0x1f]
call fcn.18000e640
mov rax, rbx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1800cac00
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1800a96a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x99], 0
je 0x1800a96c8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x98
jb 0x1800a96b0
mov byte [rcx + 0x99], 0
ret

Function at 0x1800a96d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x68], 0
je 0x1800a96f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x67
jb 0x1800a96e0
mov byte [rcx + 0x68], 0
ret
Function at 0x1800b6d70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1800b6da4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1800b6d90
ret
Function at 0x1800b73c0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1800b746c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x1800b73fa
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x1800b7680
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x1800b743a
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.1800cafcc
mov rcx, rbx
test rbx, rbx
jne 0x1800b7420
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.1800b8fc0
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x1800b7784
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.1800cafcc
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x1800b7790
cmp rbx, rbp
jne 0x1800b7730
cmp qword [rsp + 0x20], r14
jne 0x1800b775d
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x1800b779f
mov qword [r15], r12
mov rax, r12
jmp 0x1800b77a2
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x1800b775d
nop dword [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.1800cafcc
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x1800b7836
cmp rbx, rbp
jne 0x1800b7810
jmp 0x1800b775a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x1800b77b0
jmp 0x1800b775d
Function at 0x1800b74d0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rsi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x1800b7505
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x58], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x20], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.1800b7280
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x1800b7646
mov qword [rsp + 0x50], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rdi
jne 0x1800b75c0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800b7635
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1800b75fd
mov r10, qword [rdx]
cmp r10, rax
je 0x1800b75f7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800b7635
cmp r9, rdx
je 0x1800b7611
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1800b7657
cmp r9, rdx
jne 0x1800b7602
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x1800b7570
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800b7635
Function at 0x1800b7680
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1800b746c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x1800b73fa
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x1800b7680
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x1800b743a
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.1800cafcc
mov rcx, rbx
test rbx, rbx
jne 0x1800b7420
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.1800b8fc0
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x1800b7784
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.1800cafcc
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x1800b7790
cmp rbx, rbp
jne 0x1800b7730
cmp qword [rsp + 0x20], r14
jne 0x1800b775d
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x1800b779f
mov qword [r15], r12
mov rax, r12
jmp 0x1800b77a2
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x1800b775d
nop dword [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.1800cafcc
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x1800b7836
cmp rbx, rbp
jne 0x1800b7810
jmp 0x1800b775a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x1800b77b0
jmp 0x1800b775d
Function at 0x1800bf070
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1800bf13c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x1800bf13c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x1800bf155
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x1800bf12c
cmp byte [rax], 0x5c
jne 0x1800bf126
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x1800bf126
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x1800bf112
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x1800bf123
test r8b, 0x10
jne 0x1800bf126
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x1800bf126
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.1800bbd00
test edi, edi
jne 0x1800bf090
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.1800bbcf0
int3
Function at 0x1800c2f30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1801ab040]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rbp - 0x40], rcx
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r14
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdx + r8], r14b
jne 0x1800c2f80
lea rcx, [rbp - 0x28]
call fcn.18000eea0
nop
mov dword [rbp - 0x40], 0xf1b0222
mov dword [rbp - 0x3c], 0x151903
mov byte [rbp - 0x38], 1
mov rcx, r14
nop dword [rax + rax]
lea eax, [rcx + 0x6b]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 7
jb 0x1800c2fb0
mov byte [rbp - 0x38], 0
lea rcx, [rbp - 0x40]
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1800c2fd0
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rcx, qword [rbp - 0x28]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x40]
mov rdx, qword [rbp - 0x18]
call fcn.180017510
cmp rax, 0xffffffffffffffff
jne 0x1800c301e
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], r14
nop dword [rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1800c3010
mov rdx, rdi
jmp 0x1800c3063
mov dword [rbp - 0x40], 0xf9e9f6
mov byte [rbp - 0x3c], 1
mov rcx, r14
nop dword [rax]
lea eax, [rcx - 0x48]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 3
jb 0x1800c3030
mov byte [rbp - 0x3c], 0
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], r14
lea rax, [rbp - 0x40]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800c3056
lea rdx, [rbp - 0x40]
mov r8, rbx
mov rcx, rsi
call fcn.18000eea0
nop
lea rcx, [rbp - 0x28]
call fcn.18000e640
mov rax, rsi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800cac00
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1800c69f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.1800c6c10
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1800c6af7
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800c6a54
mov rax, qword [0x1801ab008]
cmp qword [rsp + 0x20], rax
ja 0x1800c6a54
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800c6a16
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800c6a83
jmp 0x1800c6af7
cmp dword [rsp + 0x50], 0x10000
jne 0x1800c6ada
cmp qword [rsp + 0x48], 0x10000
jb 0x1800c6ada
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800c6ac8
mov rax, qword [rsp + 0x28]
jmp 0x1800c6af9
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800c6af2
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.1800c6c10
mov qword [rsp + 0x20], rax
jmp 0x1800c6a16
xor eax, eax
add rsp, 0x68
ret

Function at 0x1800c6b00
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1800c6c50
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x1800c6c03
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800c6b5b
mov rax, qword [0x1801ab008]
cmp qword [rsp + 0x20], rax
ja 0x1800c6b5b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800c6b1d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800c6b8a
jmp 0x1800c6c03
cmp dword [rsp + 0x50], 0x10000
jne 0x1800c6be1
cmp qword [rsp + 0x48], 0x10000
jb 0x1800c6be1
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800c6bcf
mov rax, qword [rsp + 0x28]
jmp 0x1800c6c05
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800c6bfe
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1800c6c50
mov qword [rsp + 0x20], rax
jmp 0x1800c6b1d
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800c6ca0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800c7230
mov qword [rsp + 0x28], 0
cmp qword [0x1801ad058], 0
jne 0x1800c6ce8
cmp qword [0x1801ad050], 0
je 0x1800c6ce8
mov rax, qword [0x1801ad050]
mov qword [0x1801ad058], rax
cmp qword [0x1801ad058], 0
je 0x1800c6d8e
mov rax, qword [0x1801ad058]
cmp qword [rax + 0x10], 0
je 0x1800c6d8e
mov rax, qword [0x1801ad058]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800c6d8e
mov rax, qword [0x1801ad058]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800c6d8e
mov rax, qword [0x1801ad058]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x1800c6d54
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x1800c6d5b
xor eax, eax
jmp 0x1800c6f09
mov rax, qword [0x1801ad058]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x1800c6f09
mov rax, qword [0x1801ad050]
mov qword [0x1801ad058], rax
jmp 0x1800c6db0
mov rax, qword [0x1801ad058]
mov rax, qword [rax + 8]
mov qword [0x1801ad058], rax
cmp qword [0x1801ad058], 0
je 0x1800c6dfd
cmp qword [0x1801ad058], 0
je 0x1800c6dfb
mov rax, qword [0x1801ad058]
cmp qword [rax + 0x10], 0
je 0x1800c6dfb
mov rax, qword [0x1801ad058]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800c6dfb
mov rax, qword [0x1801ad058]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800c6dfb
jmp 0x1800c6d2c
jmp 0x1800c6d9e
mov rcx, qword [rsp + 0x60]
call fcn.1800c8e60
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800c6f10
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1800c6f07
mov rax, qword [rsp + 0x48]
mov qword [0x1801ad058], rax
mov rax, qword [0x1801ad058]
mov dword [rax], 0x52727464
mov rax, qword [0x1801ad058]
mov qword [rax + 0x10], 0
mov rax, qword [0x1801ad058]
mov rcx, qword [0x1801ad050]
mov qword [rax + 8], rcx
mov rax, qword [0x1801ad058]
mov qword [0x1801ad050], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x1801ad058]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x1800c6eb8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x1800c6ef2
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x1800c6eae
mov rax, qword [0x1801ad058]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x1800c6d2c
xor eax, eax
add rsp, 0x58
ret
Function at 0x1800ca25c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1800ca296
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1800ca29b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800ca2e4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800d4fa0]
cmp byte [rcx + rax], 0
je 0x1800ca2e4
dec r8
sub rdx, 1
jne 0x1800ca2ca
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14000d980
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
movaps xmm0, xmmword [r8]
lea rbp, [r9 + 5]
mov eax, dword [r8 + 0x10]
lea r15, [r9 + 4]
lea rsi, [r9 + 1]
mov word [r9 + 2], 0
lea rdi, [rcx + 0x5c]
mov byte [rbp], 0
movups xmmword [r9 + 8], xmm0
mov ecx, 1
mov dword [r9 + 0x18], eax
mov rbx, r9
mov byte [r15], 0
mov r13, r8
mov byte [rsi], 0
mov r14, rdx
mov byte [r9], 0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14000da08
lea rax, [rbx + 5]
mov byte [rbx], 1
mov byte [rbp], 0
lea r12, [rbx + 1]
mov qword [rsp + 0x88], rax
lea r15, [rbx + 4]
mov byte [rdi], 0
jmp 0x14000da13
mov r12, rsi
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rsi
mov ecx, 1
mov rsi, rbp
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 8
je 0x14000da47
mov rsi, qword [rsp + 0x88]
mov byte [rbx], 1
mov byte [rbp], 1
mov byte [rdi], 1
mov qword [rsp + 0x90], r12
mov ecx, 2
mov qword [rsp + 0x88], rdi
mov r12, r15
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14000da84
mov rax, qword [rsp + 0x80]
lea r12, [rbx + 4]
add rax, 0x5c
mov byte [rbx + 1], 1
mov byte [rbp], 0
mov qword [rsp + 0x88], rax
mov byte [rdi], 0
mov ecx, 2
mov rbp, rsi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 8
je 0x14000dab6
mov rax, qword [rsp + 0x90]
lea rbp, [rbx + 5]
mov byte [rsi], 1
mov r15, r12
mov byte [rax], 1
mov byte [rdi], 1
mov rdi, qword [rsp + 0x88]
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14000dad2
mov byte [rsi], 0
mov rsi, rbp
mov byte [r15], 1
mov byte [rdi], 0
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 8
je 0x14000daeb
mov byte [r15], 1
mov byte [rsi], 1
mov byte [rdi], 1
mov eax, dword [r13 + 0x10]
cmp eax, 4
jne 0x14000db0e
cmp word [r13 + 0xa], 0
jle 0x14000db05
mov byte [rbx + 2], 1
mov byte [rsi], 1
jmp 0x14000db15
mov byte [rbx + 3], 1
mov byte [rsi], 1
jmp 0x14000db15
test eax, eax
jne 0x14000db15
mov byte [rbx + 6], al
movaps xmm0, xmmword [r13]
movd eax, xmm0
mov dword [r14], 0xffffffff
cmp ax, 2
jne 0x14000db44
movq rcx, xmm0
mov rax, rcx
shr rax, 0x20
shr rcx, 0x30
mov word [r14 + 2], cx
mov word [r14], ax
mov rbx, qword [rsp + 0x98]
mov rax, r14
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret