joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180035770
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1801b0058]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1801b4960]
mov edi, ecx
cmp byte [rbx + 0x4235], 0
jne 0x1800357d1
cmp byte [rbx + 0x4236], 0
jne 0x1800357d1
movsx r9d, word [rbx + 0x531a]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.180022e00
test dil, 1
je 0x1800358f8
jmp 0x18003585a
movss xmm1, dword [rbx + 0x3890]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1801953a4]
xor eax, eax
mulss xmm1, dword [0x180195388]
addss xmm0, dword [rbx + 0xdf4]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0xdf8]
mov qword [rbx + 0x3fa0], rax
mov dword [rbx + 0x3f8c], 1
movss dword [rbx + 0x3f98], xmm0
movss dword [rbx + 0x3f9c], xmm1
movss xmm0, dword [rbx + 0x38ec]
mulss xmm0, dword [0x180195124]
or dword [rbx + 0x3f88], 0x41
movss dword [rbx + 0x3fe8], xmm0
movsx r9d, word [rbx + 0x531a]
call fcn.180022e00
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1800358b0
lea r11, [0x18015caf0]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x180035893
cmp byte [r8], r9b
jne 0x180035893
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180035880
not ecx
call fcn.18002c5b0
test rax, rax
je 0x1800358f8
cmp byte [rax + 0x96], 0
je 0x1800358f8
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x531a]
mov edx, 0x10
movsx r9d, word [rbx + 0x531a]
call fcn.180022e00
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.18002efa0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800eb930
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x18003bf70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x1801b4960]
cmp byte [rbx + 0x5361], 0
jne 0x18003c0b7
cmp dword [rbx + 0x5388], 0
je 0x18003bfba
mov r8d, 0x2dd4
lea rdx, str.C:UsershajdeSkrivbordClientGClient_masterimguiimgui.cpp
lea rcx, str.g.SettingsWindows.empty__
call fcn.1800fd900
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x18003c0b0
lea rdx, [0x18015c398]
call fcn.180022ff0
mov rdi, rax
test rax, rax
je 0x18003c0b0
mov rcx, rax
call fcn.1800fe450
mov ebp, eax
cmp eax, 0xffffffff
je 0x18003c0a8
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call fcn.1800ff24c
test eax, eax
jne 0x18003c0a8
mov rcx, rdi
call fcn.1800fe450
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x18003c0a8
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call fcn.1800ff24c
test eax, eax
jne 0x18003c0a8
cmp rsi, 0xffffffffffffffff
je 0x18003c0a8
mov rax, qword [0x1801b4960]
test rax, rax
je 0x18003c045
inc dword [rax + 0xec]
mov rcx, rsi
call fcn.180102860
mov rbp, rax
test rax, rax
je 0x18003c0a8
mov r9, rdi
mov r8, rsi
mov edx, 1
mov rcx, rax
call fcn.1800fffd4
mov rcx, rdi
cmp rax, rsi
je 0x18003c077
call fcn.1800feeac
jmp 0x18003c08c
call fcn.1800feeac
test rsi, rsi
je 0x18003c08c
mov rdx, rsi
mov rcx, rbp
call fcn.18003c5b0
mov rax, qword [0x1801b4960]
test rax, rax
je 0x18003c09e
dec dword [rax + 0xec]
mov rcx, rbp
call fcn.1800ffd60
jmp 0x18003c0b0
mov rcx, rdi
call fcn.1800feeac
mov byte [rbx + 0x5361], 1
movss xmm0, dword [rbx + 0x5364]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x18003c144
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5364], xmm0
jb 0x18003c144
mov rdi, qword [rbx + 0x20]
xor ebp, ebp
test rdi, rdi
je 0x18003c137
mov rax, qword [0x1801b4960]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5364], ebp
call fcn.18003c960
lea rdx, [0x18015c39c]
mov rcx, rdi
mov rsi, rax
call fcn.180022ff0
mov rdi, rax
test rax, rax
je 0x18003c13e
mov r8, qword [rsp + 0x30]
lea edx, [rbp + 1]
mov r9, rax
mov rcx, rsi
call fcn.1800ffbe4
mov rcx, rdi
call fcn.1800feeac
jmp 0x18003c13e
mov byte [rbx + 0xd4], 1
mov dword [rbx + 0x5364], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x18003c490
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x1801b4960]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x18003c4f4
lea r10, [0x18015caf0]
cmp r8b, 0x23
jne 0x18003c4d7
cmp byte [rdx], r8b
jne 0x18003c4d7
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x18003c4c4
mov eax, dword [r14 + 0x5378]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x18003c554
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x18003c51a
cmp edi, eax
jl 0x18003c533
mov r8d, 0x6f4
lea rdx, str.C:UsershajdeSkrivbordClientGClient_masterimguiimgui.h
lea rcx, str.i___0__i___Size
call fcn.1800fd900
mov rax, qword [r14 + 0x5380]
cmp dword [rax + rbp + 8], ebx
je 0x18003c571
mov eax, dword [r14 + 0x5378]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x18003c511
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x18003c57e
cmp edi, dword [r14 + 0x5378]
jl 0x18003c597
mov r8d, 0x6f4
lea rdx, str.C:UsershajdeSkrivbordClientGClient_masterimguiimgui.h
lea rcx, str.i___0__i___Size
call fcn.1800fd900
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5380]
lea rax, [rax + rcx*8]
jmp 0x18003c556
Function at 0x180070500
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x210
call fcn.180032e00
cmp byte [rax], 0
je 0x180070584
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180070584
mov rbx, qword [0x1801b4960]
test rbx, rbx
jne 0x180070553
mov r8d, 0xec7
lea rdx, str.C:UsershajdeSkrivbordClientGClient_masterimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.1800fd900
mov rbx, qword [0x1801b4960]
cmp byte [rbx + 0x37a1], 0
je 0x180070570
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.180022570
mov dword [rbx + 0x378], 0x210
mov dword [rbx + 0x938], 0xa0
mov ecx, 0x214
call fcn.180032e00
cmp byte [rax], 0
je 0x180070602
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180070602
mov rbx, qword [0x1801b4960]
test rbx, rbx
jne 0x1800705d1
mov r8d, 0xec7
lea rdx, str.C:UsershajdeSkrivbordClientGClient_masterimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.1800fd900
mov rbx, qword [0x1801b4960]
cmp byte [rbx + 0x37a1], 0
je 0x1800705ee
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.180022570
mov dword [rbx + 0x37c], 0x214
mov dword [rbx + 0x948], 0xa1
mov ecx, 0x212
call fcn.180032e00
cmp byte [rax], 0
je 0x180070680
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180070680
mov rbx, qword [0x1801b4960]
test rbx, rbx
jne 0x18007064f
mov r8d, 0xec7
lea rdx, str.C:UsershajdeSkrivbordClientGClient_masterimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.1800fd900
mov rbx, qword [0x1801b4960]
cmp byte [rbx + 0x37a1], 0
je 0x18007066c
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.180022570
mov dword [rbx + 0x264], 0x212
mov dword [rbx + 0x940], 0x5b
mov ecx, 0x216
call fcn.180032e00
cmp byte [rax], 0
je 0x1800706fe
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1800706fe
mov rbx, qword [0x1801b4960]
test rbx, rbx
jne 0x1800706cd
mov r8d, 0xec7
lea rdx, str.C:UsershajdeSkrivbordClientGClient_masterimguiimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.1800fd900
mov rbx, qword [0x1801b4960]
cmp byte [rbx + 0x37a1], 0
je 0x1800706ea
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.180022570
mov dword [rbx + 0x268], 0x216
mov dword [rbx + 0x950], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x180072da0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, edx
mov qword [0x1801b4ba0], rcx
mov rdi, rcx
call fcn.1800971e0
test ebx, ebx
je 0x180072dfc
cmp ebx, 1
jne 0x180072dec
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x180072e10]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x180075600
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r11d, 0xffffffff
mov r10, rcx
mov eax, r11d
test r9b, r9b
je 0x18007565b
mov qword [rsp], rbx
lea rbx, [0x18015caf0]
cmp r9b, 0x23
jne 0x18007563b
cmp byte [r8], r9b
jne 0x18007563b
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x180075628
mov rbx, qword [rsp]
movsxd rdx, dword [r10 + 0x90]
not eax
mov r9, qword [r10 + 0x98]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x1800756b1
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x1800756a9
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x1800756ac
mov rdx, r8
test rdx, rdx
jne 0x180075680
cmp r9, r10
je 0x1800756c4
cmp dword [r9], eax
jne 0x1800756c4
mov eax, dword [r9 + 8]
add rsp, 8
ret
mov eax, 0xffffffff
add rsp, 8
ret
Function at 0x18008d9b0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1801b1330]
mov rax, qword [0x1801b1338]
movsxd r8, dword [0x1801b4bdc]
sub rax, r9
sar rax, 3
cmp rax, r8
jbe 0x18008dbc6
mov eax, dword [r9 + r8*8 + 4]
cdq
mov qword [rsp + 0x30], rbx
idiv dword [0x1801b0ef0]
mov qword [rsp + 0x20], rdi
mov edi, eax
mov eax, dword [r9 + r8*8]
cdq
idiv dword [0x1801b0ef0]
cmp byte [0x1801b48f0], 0
mov ebx, eax
je 0x18008daf8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
mov edx, 0x202
mov rcx, rax
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_PostMessageW]
cmp dword [0x1801b48ec], 0
jle 0x18008daa1
call fcn.18010297c
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub r8d, ecx
cmp r8d, dword [0x1801b48ec]
jge 0x18008daa1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
mov edx, 0x204
mov rcx, rax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
mov edx, 0x205
mov rcx, rax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_PostMessageW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
mov edx, 0x201
mov rcx, rax
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x18008dbb1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
mov edx, 0x202
mov rcx, rax
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x18008dbb1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
mov edx, 0x201
mov rcx, rax
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x1801b48ec], 0
je 0x18008db8e
call fcn.18010297c
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub r8d, ecx
cmp r8d, dword [0x1801b48ec]
jge 0x18008db8e
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
mov edx, 0x204
mov rcx, rax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
mov edx, 0x205
mov rcx, rax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_PostMessageW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
mov edx, 0x202
mov rcx, rax
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc dword [0x1801b4f78]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
call fcn.18008cf70
int3
Function at 0x18008e450
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x13e8
call fcn.1800ec860
sub rsp, rax
movaps xmmword [rsp + 0x13d0], xmm6
movaps xmmword [rsp + 0x13c0], xmm7
mov rax, qword [0x1801b0058]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
movaps xmm6, xmm1
movaps xmm7, xmm0
call fcn.1800c92f8
mov dword [rsp + 0x24], eax
mov edx, 1
mov r9d, 0x270
mov dword [rsp + 0x13a4], 0xffffffff
nop dword [rax]
nop dword [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, r9
jb 0x18008e4b0
mov dword [rsp + 0x20], r9d
lea r8, [rsp + 0x28]
xorps xmm1, xmm1
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x18008e4e0
mov eax, dword [rsp + 0x20]
subss xmm6, xmm7
xorps xmm0, xmm0
mov ecx, dword [rsp + rax*4 + 0x24]
mov eax, ecx
shr eax, 0xb
and eax, dword [rsp + 0x13a4]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2ss xmm0, rax
subss xmm0, xmm1
addss xmm0, xmm1
mulss xmm0, dword [0x180195088]
mulss xmm0, xmm6
addss xmm0, xmm7
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.1800eb930
movaps xmm6, xmmword [rsp + 0x13d0]
movaps xmm7, xmmword [rsp + 0x13c0]
add rsp, 0x13e8
ret
Function at 0x18008e5a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13c0
call fcn.1800ec860
sub rsp, rax
mov rax, qword [0x1801b0058]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov edi, edx
mov ebx, ecx
call fcn.1800c92f8
mov dword [rsp + 0x24], eax
mov r9d, 1
mov r10d, 0x270
mov dword [rsp + 0x13a4], 0xffffffff
mov r8d, eax
shr r8d, 0x1e
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, r10
jb 0x18008e5f3
lea eax, [rbx - 0x80000000]
mov dword [rsp + 0x20], r10d
mov ebp, 0x80000000
cmp ebx, ebp
lea esi, [rbx + rbp]
cmovae esi, eax
lea ebx, [rdi + rbp]
cmp edi, ebp
lea eax, [rdi - 0x80000000]
cmovae ebx, eax
sub ebx, esi
cmp ebx, 0xffffffff
jne 0x18008e6c0
lea r8, [rsp + 0x28]
nop word [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x18008e650
mov eax, dword [rsp + 0x20]
mov edx, dword [rsp + rax*4 + 0x24]
mov eax, edx
shr eax, 0xb
and eax, dword [rsp + 0x13a4]
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov ecx, edx
shr ecx, 0x12
xor ecx, edx
jmp 0x18008e6fe
lea rcx, [rsp + 0x20]
inc ebx
call fcn.18008e8e0
mov ecx, eax
mov edi, ebx
imul rcx, rdi
cmp ecx, ebx
jae 0x18008e6fa
mov eax, ebx
xor edx, edx
neg eax
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x18008e6fa
lea rcx, [rsp + 0x20]
call fcn.18008e8e0
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jb 0x18008e6e6
shr rcx, 0x20
lea edx, [rsi + rcx]
cmp edx, ebp
lea ecx, [rdx - 0x80000000]
lea eax, [rdx + rbp]
cmovae eax, ecx
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.1800eb930
lea r11, [rsp + 0x13c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18008e8e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x18008e941
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x18008e900
mov ecx, dword [r9]
jmp 0x18008ea28
cmp ecx, 0x4e0
jb 0x18008ea28
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x18008e960
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x18008e9b0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1800971e0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
test edx, edx
je 0x18009734b
cmp edx, 1
je 0x1800971fb
mov eax, 1
add rsp, 0x28
ret
lea rcx, str.OpenGL32.dll
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
jne 0x18009721f
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x180190fe0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180190fd0]
mov rcx, rbx
mov qword [0x1801b49c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.wglSwapBuffers
mov rcx, rbx
mov qword [0x1801b49a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.glOrtho
mov rcx, rbx
mov qword [0x1801b49b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180191018]
mov rcx, rbx
mov qword [0x1801b49c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180191008]
mov rcx, rbx
mov qword [0x1801b49b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1801b49a0], rax
call fcn.1800c2600
call fcn.1800c18c0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.1800c1de0
lea rdx, [0x1800970c0]
lea rcx, [0x1801b49c0]
call fcn.1800c0e70
lea rdx, [0x180097120]
lea rcx, [0x1801b49a8]
call fcn.1800c0e70
lea rdx, [0x180096a20]
lea rcx, [0x1801b49c8]
call fcn.1800c0e70
lea rdx, [0x180096970]
lea rcx, [0x1801b49b8]
call fcn.1800c0e70
lea rdx, [0x180096c60]
lea rcx, [0x1801b49a0]
call fcn.1800c0e70
lea rdx, [0x180096d30]
lea rcx, [0x1801b49b0]
call fcn.1800c0e70
call fcn.1800c1930
mov rbx, qword [rsp + 0x20]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret
call fcn.1800c18c0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.1800c1de0
lea rdx, [0x1800970c0]
lea rcx, [0x1801b49c0]
call fcn.1800c1520
lea rdx, [0x180097120]
lea rcx, [0x1801b49a8]
call fcn.1800c1520
lea rdx, [0x180096a20]
lea rcx, [0x1801b49c8]
call fcn.1800c1520
lea rdx, [0x180096970]
lea rcx, [0x1801b49b8]
call fcn.1800c1520
lea rdx, [0x180096c60]
lea rcx, [0x1801b49a0]
call fcn.1800c1520
lea rdx, [0x180096d30]
lea rcx, [0x1801b49b0]
call fcn.1800c1520
call fcn.1800c1930
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x18009b8b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov esi, 1
nop word [rax + rax]
mov ebx, esi
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18009b8eb
inc ebx
cmp ebx, 0x100
jl 0x18009b8d2
jmp 0x18009b8d0
xor ecx, ecx
cmp ebx, 0x1b
sete cl
xor eax, eax
cmp ebx, 2
sete al
or ecx, eax
cmp ebx, esi
cmove ecx, esi
test ecx, ecx
je 0x18009b91c
mov dword [rdi], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov dword [rdi], ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret