joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800729e0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x180117630]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x180117658]
js 0x180072784
cvtsi2ss xmm0, rcx
jmp 0x180072799
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x180117620]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x1800ffe68]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1800727cb
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800727cb
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1800727fd
cmp rbx, 0x200
jae 0x1800727fa
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1800727fd
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800729e0
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180072a11
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180117628]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180117638]
lea rdx, [rdi + rdi]
call fcn.180064e30
mov rax, qword [0x180117628]
lea r9, [rdi - 1]
mov qword [0x180117650], r9
mov qword [0x180117658], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180072b84
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180117638]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180072ad0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180072b45
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x180072b0d
mov r10, qword [rdx]
cmp r10, rax
je 0x180072b07
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180072b45
cmp r9, rdx
je 0x180072b21
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180072b59
cmp r9, rdx
jne 0x180072b12
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x180072b7f
mov r9, qword [0x180117650]
jmp 0x180072a81
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180072b45
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180074b00
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x40
mov edi, edx
mov rbx, rcx
movzx r9d, dl
movabs r10, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r11, r8
mov r8, qword [0x180119f58]
xor r9, rax
mov eax, edx
sar eax, 8
movzx edx, al
mov eax, edi
sar eax, 0x10
movzx ecx, al
mov eax, edi
imul r9, r10
sar eax, 0x18
xor rdx, r9
imul rdx, r10
xor rdx, rcx
movzx ecx, al
imul rdx, r10
xor rdx, rcx
mov rcx, qword [0x180119f80]
imul rdx, r10
and rcx, rdx
xor edx, edx
shl rcx, 4
add rcx, qword [0x180119f68]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x180074ba1
mov rcx, qword [rcx]
cmp edi, dword [rax + 0x10]
je 0x180074ba4
cmp rax, rcx
je 0x180074ba1
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x180074b91
jmp 0x180074ba4
mov rax, rdx
test rax, rax
mov rcx, r8
cmovne rcx, rax
cmp rcx, r8
je 0x180074bc2
mov rax, qword [rcx + 0x18]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
movzx eax, byte [rsp + 0x5a]
movzx ecx, byte [rsp + 0x59]
mov r8, qword [0x180117628]
xor rcx, r9
imul rcx, r10
xor rcx, rax
movzx eax, byte [rsp + 0x5b]
imul rcx, r10
xor rcx, rax
imul rcx, r10
and rcx, qword [0x180117650]
shl rcx, 4
add rcx, qword [0x180117638]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x180074c21
mov rcx, qword [rcx]
cmp edi, dword [rax + 0x10]
je 0x180074c1e
cmp rax, rcx
je 0x180074c21
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x180074c10
mov rdx, rax
test rdx, rdx
cmovne r8, rdx
add r8, 0x18
cmp qword [r8 + 0x38], 0xf
lea r9, [r8 + 0x20]
jbe 0x180074c3a
mov r9, qword [r9]
cmp qword [r8 + 0x18], 0xf
jbe 0x180074c44
mov r8, qword [r8]
mov rax, qword [r11]
mov rdx, rbx
mov rcx, r11
mov r10, qword [rax + 0x108]
call r10
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rbx, rax
call fcn.1800756e0
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180074d00
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x40
mov edi, edx
mov rbx, rcx
movzx r9d, dl
movabs r10, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r11, r8
mov r8, qword [0x180119f58]
xor r9, rax
mov eax, edx
sar eax, 8
movzx edx, al
mov eax, edi
sar eax, 0x10
movzx ecx, al
mov eax, edi
imul r9, r10
sar eax, 0x18
xor rdx, r9
imul rdx, r10
xor rdx, rcx
movzx ecx, al
imul rdx, r10
xor rdx, rcx
mov rcx, qword [0x180119f80]
imul rdx, r10
and rcx, rdx
xor edx, edx
shl rcx, 4
add rcx, qword [0x180119f68]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x180074da1
mov rcx, qword [rcx]
cmp edi, dword [rax + 0x10]
je 0x180074da4
cmp rax, rcx
je 0x180074da1
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x180074d91
jmp 0x180074da4
mov rax, rdx
test rax, rax
mov rcx, r8
cmovne rcx, rax
cmp rcx, r8
je 0x180074dc2
mov rax, qword [rcx + 0x18]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
movzx eax, byte [rsp + 0x5a]
movzx ecx, byte [rsp + 0x59]
mov r8, qword [0x180117628]
xor rcx, r9
imul rcx, r10
xor rcx, rax
movzx eax, byte [rsp + 0x5b]
imul rcx, r10
xor rcx, rax
imul rcx, r10
and rcx, qword [0x180117650]
shl rcx, 4
add rcx, qword [0x180117638]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x180074e21
mov rcx, qword [rcx]
cmp edi, dword [rax + 0x10]
je 0x180074e1e
cmp rax, rcx
je 0x180074e21
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x180074e10
mov rdx, rax
test rdx, rdx
cmovne r8, rdx
add r8, 0x18
cmp qword [r8 + 0x38], 0xf
lea r9, [r8 + 0x20]
jbe 0x180074e3a
mov r9, qword [r9]
cmp qword [r8 + 0x18], 0xf
jbe 0x180074e44
mov r8, qword [r8]
mov rax, qword [r11]
mov rdx, rbx
mov rcx, r11
mov r10, qword [rax + 0x388]
call r10
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rbx, rax
call fcn.1800756e0
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180074e80
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x40
mov edi, edx
mov rbx, rcx
movzx r9d, dl
movabs r10, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r11, r8
mov r8, qword [0x180119f98]
xor r9, rax
mov eax, edx
sar eax, 8
movzx edx, al
mov eax, edi
sar eax, 0x10
movzx ecx, al
mov eax, edi
imul r9, r10
sar eax, 0x18
xor rdx, r9
imul rdx, r10
xor rdx, rcx
movzx ecx, al
imul rdx, r10
xor rdx, rcx
mov rcx, qword [0x180119fc0]
imul rdx, r10
and rcx, rdx
xor edx, edx
shl rcx, 4
add rcx, qword [0x180119fa8]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x180074f21
mov rcx, qword [rcx]
cmp edi, dword [rax + 0x10]
je 0x180074f24
cmp rax, rcx
je 0x180074f21
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x180074f11
jmp 0x180074f24
mov rax, rdx
test rax, rax
mov rcx, r8
cmovne rcx, rax
cmp rcx, r8
je 0x180074f42
mov rax, qword [rcx + 0x18]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
movzx eax, byte [rsp + 0x5a]
movzx ecx, byte [rsp + 0x59]
mov r8, qword [0x180117668]
xor rcx, r9
imul rcx, r10
xor rcx, rax
movzx eax, byte [rsp + 0x5b]
imul rcx, r10
xor rcx, rax
imul rcx, r10
and rcx, qword [0x180117690]
shl rcx, 4
add rcx, qword [0x180117678]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x180074fa1
mov rcx, qword [rcx]
cmp edi, dword [rax + 0x10]
je 0x180074f9e
cmp rax, rcx
je 0x180074fa1
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x180074f90
mov rdx, rax
test rdx, rdx
cmovne r8, rdx
add r8, 0x18
cmp qword [r8 + 0x38], 0xf
lea r9, [r8 + 0x20]
jbe 0x180074fba
mov r9, qword [r9]
cmp qword [r8 + 0x18], 0xf
jbe 0x180074fc4
mov r8, qword [r8]
mov rax, qword [r11]
mov rdx, rbx
mov rcx, r11
mov r10, qword [rax + 0x480]
call r10
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rbx, rax
call fcn.180075400
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180075000
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x40
mov edi, edx
mov rbx, rcx
movzx r9d, dl
movabs r10, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r11, r8
mov r8, qword [0x180119f98]
xor r9, rax
mov eax, edx
sar eax, 8
movzx edx, al
mov eax, edi
sar eax, 0x10
movzx ecx, al
mov eax, edi
imul r9, r10
sar eax, 0x18
xor rdx, r9
imul rdx, r10
xor rdx, rcx
movzx ecx, al
imul rdx, r10
xor rdx, rcx
mov rcx, qword [0x180119fc0]
imul rdx, r10
and rcx, rdx
xor edx, edx
shl rcx, 4
add rcx, qword [0x180119fa8]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x1800750a1
mov rcx, qword [rcx]
cmp edi, dword [rax + 0x10]
je 0x1800750a4
cmp rax, rcx
je 0x1800750a1
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x180075091
jmp 0x1800750a4
mov rax, rdx
test rax, rax
mov rcx, r8
cmovne rcx, rax
cmp rcx, r8
je 0x1800750c2
mov rax, qword [rcx + 0x18]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
movzx eax, byte [rsp + 0x5a]
movzx ecx, byte [rsp + 0x59]
mov r8, qword [0x180117668]
xor rcx, r9
imul rcx, r10
xor rcx, rax
movzx eax, byte [rsp + 0x5b]
imul rcx, r10
xor rcx, rax
imul rcx, r10
and rcx, qword [0x180117690]
shl rcx, 4
add rcx, qword [0x180117678]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x180075121
mov rcx, qword [rcx]
cmp edi, dword [rax + 0x10]
je 0x18007511e
cmp rax, rcx
je 0x180075121
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x180075110
mov rdx, rax
test rdx, rdx
cmovne r8, rdx
add r8, 0x18
cmp qword [r8 + 0x38], 0xf
lea r9, [r8 + 0x20]
jbe 0x18007513a
mov r9, qword [r9]
cmp qword [r8 + 0x18], 0xf
jbe 0x180075144
mov r8, qword [r8]
mov rax, qword [r11]
mov rdx, rbx
mov rcx, r11
mov r10, qword [rax + 0x2f0]
call r10
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rbx, rax
call fcn.180075400
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1800759c0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1800759f1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180119f98]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180119fa8]
lea rdx, [rdi + rdi]
call fcn.180064e30
mov rax, qword [0x180119f98]
lea r9, [rdi - 1]
mov qword [0x180119fc0], r9
mov qword [0x180119fc8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180075b64
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180119fa8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180075ab0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180075b25
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x180075aed
mov r10, qword [rdx]
cmp r10, rax
je 0x180075ae7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180075b25
cmp r9, rdx
je 0x180075b01
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180075b39
cmp r9, rdx
jne 0x180075af2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x180075b5f
mov r9, qword [0x180119fc0]
jmp 0x180075a61
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180075b25
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180075b70
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180075ba1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180119f58]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180119f68]
lea rdx, [rdi + rdi]
call fcn.180064e30
mov rax, qword [0x180119f58]
lea r9, [rdi - 1]
mov qword [0x180119f80], r9
mov qword [0x180119f88], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180075d14
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180119f68]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180075c60
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180075cd5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x180075c9d
mov r10, qword [rdx]
cmp r10, rax
je 0x180075c97
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180075cd5
cmp r9, rdx
je 0x180075cb1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180075ce9
cmp r9, rdx
jne 0x180075ca2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x180075d0f
mov r9, qword [0x180119f80]
jmp 0x180075c11
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180075cd5
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18007b4f0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180117040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movss xmm2, dword [0x18011b82c]
mov rbx, rcx
lea rcx, [0x18011a3d0]
call fcn.180066870
subss xmm2, dword [0x18011b828]
xorps xmm1, xmm1
mov eax, eax
xorps xmm0, xmm0
lea rdx, [0x18011b838]
mov rcx, rbx
cvtsi2ss xmm1, rax
subss xmm1, xmm0
addss xmm1, xmm0
mulss xmm1, dword [0x1800ffc40]
mulss xmm1, xmm2
addss xmm1, dword [0x18011b828]
movss dword [0x18011b830], xmm1
call fcn.180079eb0
lea rcx, [rsp + 0x20]
call fcn.180066f20
xorps xmm1, xmm1
mov rcx, qword [rax]
movabs rax, 0x20c49ba5e353f7cf
mov qword [rbx + 0x10], rcx
sub rcx, qword [rbx + 8]
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cvtsi2ss xmm1, rdx
divss xmm1, dword [0x1800ffe50]
movss dword [rbx + 0x1c], xmm1
movss xmm0, dword [0x18011b834]
addss xmm0, dword [0x18011b830]
subss xmm0, xmm1
divss xmm0, dword [0x1800ffe50]
cvtps2pd xmm0, xmm0
call fcn.18007a0a0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x18007b5f0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800bbf40
add rsp, 0x40
pop rbx
ret
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], 0
call qword [sym.imp.USER32.dll_GetCursorPos]
movsxd r9, dword [rsp + 0x2c]
mov edx, 0x201
mov rcx, qword [0x18011a0d8]
mov r8d, 0x1000000
call qword [sym.imp.USER32.dll_PostMessageW]
lea rcx, [rsp + 0x20]
call fcn.180066f20
mov rcx, rbx
mov rdx, qword [rax]
mov qword [rbx + 8], rdx
call fcn.180079cf0
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800bbf40
add rsp, 0x40
pop rbx
ret
Function at 0x18007bd20
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180117040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movss xmm2, dword [0x18011b88c]
mov rbx, rcx
lea rcx, [0x18011a3d0]
call fcn.180066870
subss xmm2, dword [0x18011b888]
xorps xmm1, xmm1
mov eax, eax
xorps xmm0, xmm0
lea rdx, [0x18011b898]
mov rcx, rbx
cvtsi2ss xmm1, rax
subss xmm1, xmm0
addss xmm1, xmm0
mulss xmm1, dword [0x1800ffc40]
mulss xmm1, xmm2
addss xmm1, dword [0x18011b888]
movss dword [0x18011b890], xmm1
call fcn.180079eb0
lea rcx, [rsp + 0x20]
call fcn.180066f20
xorps xmm1, xmm1
mov rcx, qword [rax]
movabs rax, 0x20c49ba5e353f7cf
mov qword [rbx + 0x10], rcx
sub rcx, qword [rbx + 8]
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cvtsi2ss xmm1, rdx
divss xmm1, dword [0x1800ffe50]
movss dword [rbx + 0x1c], xmm1
movss xmm0, dword [0x18011b894]
addss xmm0, dword [0x18011b890]
subss xmm0, xmm1
divss xmm0, dword [0x1800ffe50]
cvtps2pd xmm0, xmm0
call fcn.18007a0a0
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x18007be20
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800bbf40
add rsp, 0x40
pop rbx
ret
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], 0
call qword [sym.imp.USER32.dll_GetCursorPos]
movsxd r9, dword [rsp + 0x2c]
mov edx, 0x204
mov rcx, qword [0x18011a0d8]
mov r8d, 0x2000000
call qword [sym.imp.USER32.dll_PostMessageW]
lea rcx, [rsp + 0x20]
call fcn.180066f20
mov rcx, rbx
mov rdx, qword [rax]
mov qword [rbx + 8], rdx
call fcn.180079cf0
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800bbf40
add rsp, 0x40
pop rbx
ret
Function at 0x18007de30
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x40
mov rax, qword [0x180117040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xfc
mov ecx, dword [0x180119d7c]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
lea r14, [0x1801172dc]
lea r15, str.none
mov rdi, 0xffffffffffffffff
lea rsi, [0x18011ce68]
mov eax, dword [rdx + rax]
cmp dword [0x18011ce60], eax
jle 0x18007df2b
lea rcx, [0x18011ce60]
call fcn.1800bc008
cmp dword [0x18011ce60], edi
jne 0x18007df2b
mov dword [rsp + 0x20], 0
mov edx, dword [0x1801172dc]
lea rcx, [rsp + 0x20]
test edx, edx
cmovns rcx, r14
lea rax, [rsp + 0x28]
cmp edx, 0xfc
cmovle rax, rcx
movsxd rax, dword [rax]
mov rdx, qword [r15 + rax*8]
xorps xmm0, xmm0
movups xmmword [0x18011ce68], xmm0
xorps xmm1, xmm1
movdqu xmmword [0x18011ce78], xmm1
mov r8, rdi
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x18007df00
mov rcx, rsi
call fcn.18006a110
lea rcx, [0x1800c58d0]
call fcn.1800bc624
nop
lea rcx, [0x18011ce60]
call fcn.1800bbf9c
cmp byte [0x18011a369], 0
je 0x18007dfcd
mov qword [rsp + 0x20], 0
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, str._..._
call fcn.1800445f0
xor ebx, ebx
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18007df73
inc ebx
cmp ebx, 0xfc
jb 0x18007df57
jmp 0x18007e013
cmp ebx, 0x1b
cmove ebx, edi
mov dword [0x1801172dc], ebx
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
test ebx, ebx
cmovns rcx, r14
lea rax, [rsp + 0x28]
cmp ebx, 0xfc
cmovle rax, rcx
movsxd rax, dword [rax]
mov rdx, qword [r15 + rax*8]
nop dword [rax + rax]
inc rdi
cmp byte [rdx + rdi], 0
jne 0x18007dfb0
mov r8, rdi
mov rcx, rsi
call fcn.180069560
mov byte [0x18011a369], 0
jmp 0x18007e013
cmp dword [0x1801172dc], 0xffffffff
jne 0x18007dfdf
lea rsi, str._none_
jmp 0x18007dfef
cmp qword [0x18011ce80], 0xf
cmova rsi, qword [0x18011ce68]
mov qword [rsp + 0x20], 0
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1800445f0
test al, al
je 0x18007e013
mov byte [0x18011a369], 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800bbf40
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret
Function at 0x180080300
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x180117040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov eax, 1
xchg byte [rcx + 0x48], al
mov ecx, 0x10
call fcn.1800bc6bc
mov qword [rax], rbx
lea rcx, [0x180080570]
mov qword [rax + 8], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1800933f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180080396
cmp dword [rbx + 0x40], 0
jne 0x18008038f
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x38], xmm1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800bbf40
add rsp, 0x50
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3