joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d7e6c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d7eea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d7ee1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d7ee1
mov rax, qword [rbp - 8]
jmp 0x2fc4d7eff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d7eb4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc53dd70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc53ee50
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc53e772
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc561108]
test eax, eax
je 0x2fc53e80a
lea rax, [0x2fc5610e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc561110]
mov qword [rbp - 8], rax
jmp 0x2fc53e7ee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc53e7e2
cmp qword [rbp - 0x10], 0
je 0x2fc53e7e2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc53e7a8
lea rax, [0x2fc5610e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc53e80b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc53e910
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc53e938
mov eax, 0
jmp 0x2fc53e986
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc53e961
mov eax, 0
jmp 0x2fc53e986
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc53e981
mov eax, 0
jmp 0x2fc53e986
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc53e98c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc53ea0a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc53ea01
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc53ea01
mov rax, qword [rbp - 8]
jmp 0x2fc53ea1f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc53e9d4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1800b7690
Capabilities:
Create thread

Disassembly:
jmp 0x18020c590
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x1802c8f40]
xor rax, rbp
mov qword [rbp + 0x120], rax
lea rcx, [0x1802e36b3]
call fcn.1800ba5bb
mov edx, 8
lea rcx, [rbp + 8]
call fcn.1800b9c42
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 0x108]
call fcn.1800ba9fd
mov qword [rbp + 0x118], rax
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.1800b9774
nop
lea rcx, [rbp + 0x108]
call fcn.1800b81b7
lea rax, [0x1800b8c0c]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x150]
add rax, 8
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 8]
call fcn.1800b83ec
mov rcx, qword [rbp + 0x118]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x150]
mov qword [rcx], rax
mov rax, qword [rbp + 0x150]
cmp qword [rax], 0
je 0x18020c690
lea rcx, [rbp + 8]
call fcn.1800b83f1
jmp 0x18020c6a9
mov rax, qword [rbp + 0x150]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1800b7bbd
nop
lea rcx, [rbp + 8]
call fcn.1800b81b7
lea rcx, [rbp - 0x30]
lea rdx, [0x1802a8dd0]
call fcn.1800b9c88
mov rcx, qword [rbp + 0x120]
xor rcx, rbp
call fcn.1800b8932
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x1800b791a
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x180218570
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1802e3671]
call fcn.1800ba5bb
mov qword [rbp + 8], 0
jmp 0x1802185ae
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x180218604
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x1802185a3
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1800b83e2
Capabilities:
Get graphical window text

Disassembly:
jmp 0x1802146f0
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rcx, [0x1802e36bc]
call fcn.1800ba5bb
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetTopWindow]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x180214823
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jle 0x18021480b
mov eax, dword [rbp + 0x24]
inc eax
cdqe
mov rcx, rax
call fcn.1800b86a3
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x48], rax
mov eax, dword [rbp + 0x24]
inc eax
mov r8d, eax
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rdx, str.nProtect_GameGuard_Launcher
mov rcx, qword [rbp + 0x48]
call fcn.1800b878e
test rax, rax
je 0x1802147ca
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x148], rax
mov rcx, qword [rbp + 0x148]
call fcn.1800b8900
cmp qword [rbp + 0x148], 0
jne 0x1802147b3
mov qword [rbp + 0x178], 0
jmp 0x1802147c6
mov qword [rbp + 0x48], 0x8123
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x178], rax
mov al, 1
jmp 0x180214825
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x168], rax
mov rcx, qword [rbp + 0x168]
call fcn.1800b8900
cmp qword [rbp + 0x168], 0
jne 0x1802147f8
mov qword [rbp + 0x178], 0
jmp 0x18021480b
mov qword [rbp + 0x48], 0x8123
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x178], rax
mov edx, 2
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [rbp + 8], rax
jmp 0x180214717
xor al, al
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret

Function at 0x1800b89b4
Capabilities:
Create thread

Disassembly:
jmp 0x1800c1580
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x1802e30a0]
call fcn.1800ba5bb
cmp dword [rbp + 0xe8], 1
jne 0x1800c15e3
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1800b8f8b]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1800b8d56
Capabilities:
Terminate process

Disassembly:
jmp 0x180225760
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1800b8ddd
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x180213760
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1802e36a9]
call fcn.1800ba5bb
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, qword [rbp + 0xe8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1800b91f2
Capabilities:
Write file on windows

Disassembly:
jmp 0x1800fee70
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1802e34d6]
call fcn.1800ba5bb
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1800b934b
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x180215350
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x128]
mov rax, qword [0x1802c8f40]
xor rax, rbp
mov qword [rbp + 0xd8], rax
lea rcx, [0x1802e36a9]
call fcn.1800ba5bb
mov eax, dword [rbp + 0x108]
lea r9, [rbp + 4]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rbp + 0x108]
mov r8d, eax
mov edx, 0x90
mov rcx, qword [rbp + 0x100]
call fcn.1800b9878
mov eax, dword [rbp + 0x108]
lea r9, [rbp + 4]
mov r8d, dword [rbp + 4]
mov edx, eax
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp - 0x20]
lea rdx, [0x1802a6d40]
call fcn.1800b9c88
mov rcx, qword [rbp + 0xd8]
xor rcx, rbp
call fcn.1800b8932
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x1800b93be
Capabilities:
Read file on windows

Disassembly:
jmp 0x1800fee00
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1802e34d6]
call fcn.1800ba5bb
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1800b93d7
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x180100be0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x1802e34d6]
call fcn.1800ba5bb
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x18025a5f0]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x180100d18
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x180100c79
mov dword [rbp + 0x160], 1
jmp 0x180100c83
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x180100d13
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x64], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x180100ced
cmp qword [rbp + 0x198], 2
jb 0x180100ced
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180100ced
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180100ced
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x180100c44
jmp 0x180100da5
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x84], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x180100da5
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x180100d7c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180100d7c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180100d7c
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x180100d18
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1800b9602
Capabilities:
Create thread

Disassembly:
jmp 0x18020c3f0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x1802c8f40]
xor rax, rbp
mov qword [rbp + 0x120], rax
lea rcx, [0x1802e36b3]
call fcn.1800ba5bb
mov edx, 8
lea rcx, [rbp + 8]
call fcn.1800b94a9
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 0x108]
call fcn.1800b7852
mov qword [rbp + 0x118], rax
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.1800ba700
nop
lea rcx, [rbp + 0x108]
call fcn.1800b9e1d
lea rax, [0x1800b9efe]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x150]
add rax, 8
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 8]
call fcn.1800b96ed
mov rcx, qword [rbp + 0x118]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x150]
mov qword [rcx], rax
mov rax, qword [rbp + 0x150]
cmp qword [rax], 0
je 0x18020c4f0
lea rcx, [rbp + 8]
call fcn.1800ba084
jmp 0x18020c509
mov rax, qword [rbp + 0x150]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1800b7bbd
nop
lea rcx, [rbp + 8]
call fcn.1800b9e1d
lea rcx, [rbp - 0x30]
lea rdx, [0x1802a8e50]
call fcn.1800b9c88
mov rcx, qword [rbp + 0x120]
xor rcx, rbp
call fcn.1800b8932
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1800ba1a1
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x180100ad0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x1802e34d6]
call fcn.1800ba5bb
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x18025a5f0]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x180100b4f
mov dword [rbp + 0x120], 1
jmp 0x180100b59
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x180100b93
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
jmp 0x180100b1a
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x1800ba3ea
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x180215450
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x128]
mov rax, qword [0x1802c8f40]
xor rax, rbp
mov qword [rbp + 0xd8], rax
lea rcx, [0x1802e36a9]
call fcn.1800ba5bb
mov eax, dword [rbp + 0x110]
lea r9, [rbp + 4]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rbp + 0x110]
mov r8d, eax
mov rdx, qword [rbp + 0x108]
mov rcx, qword [rbp + 0x100]
call fcn.1800b894b
mov eax, dword [rbp + 0x110]
lea r9, [rbp + 4]
mov r8d, dword [rbp + 4]
mov edx, eax
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp - 0x20]
lea rdx, [0x1802a6dc0]
call fcn.1800b9c88
mov rcx, qword [rbp + 0xd8]
xor rcx, rbp
call fcn.1800b8932
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x1800d02a0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rcx, [0x1802e343f]
call fcn.1800ba5bb
call fcn.1800ce700
mov qword [rbp + 8], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
mov dword [rbp + 0x44], eax
mov rax, qword [rbp + 8]
add rax, 0x2c
mov r9d, 4
mov r8, rax
mov edx, 0x20001004
mov ecx, dword [rbp + 0x44]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1800d0312
mov rax, qword [rbp + 8]
mov dword [rax + 0x2c], 0
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x180222440
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1c8]
mov rax, qword [0x1802c8f40]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x1802e39f4]
call fcn.1800ba5bb
mov eax, dword [rbp + 0x1a0]
imul rax, rax, 0x38
mov rcx, qword [0x1802d1ea0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov qword [rbp + 0x48], 5
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1802224e2
mov rax, qword [rbp + 0x68]
sub rax, 5
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
add rax, 2
mov qword [rbp + 0x48], rax
lea r9, [rbp + 0x24]
mov r8d, 0x40
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180222508
mov eax, 0xa
jmp 0x180222637
cmp dword [rbp + 0x1a8], 0
je 0x18022257c
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov byte [rax], 0xe9
mov rax, qword [rbp + 0x68]
add rax, 5
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x88]
mov dword [rcx + 1], eax
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18022257a
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov byte [rax], 0xeb
mov rax, qword [rbp + 0xa8]
mov byte [rax + 1], 0xf9
jmp 0x1802225c3
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1802225a9
mov rax, qword [rbp + 8]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rbp + 0x68]
call fcn.1800b894b
jmp 0x1802225c3
mov rax, qword [rbp + 8]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rbp + 0x68]
call fcn.1800b894b
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rbp + 0x1a8]
and al, 1
shl al, 1
mov rcx, qword [rbp + 8]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rbp + 8]
mov byte [rcx + 0x20], al
movzx eax, byte [rbp + 0x1a8]
and al, 1
shl al, 2
mov rcx, qword [rbp + 8]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rbp + 8]
mov byte [rcx + 0x20], al
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1802aafb0]
call fcn.1800b9c88
mov rax, rdi
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.1800b8932
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret