joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11f60
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x308
mov rax, qword [0x00018100]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
cmp qword [0x000194d8], 0
je 0x11f8a
xor eax, eax
jmp 0x12241
mov qword [0x000194d8], 0xffffffffffffffff
movabs rax, 0xfffff78000000014
mov rax, qword [rax]
mov qword [rsp + 0x288], rax
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x288]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
movsx r11d, word [rsp + 0x2a4]
movsx ecx, word [rsp + 0x2a2]
movsx eax, word [rsp + 0x2a0]
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
lea r9, [0x00015fe0]
lea r8, [0x00015ff0]
mov edx, 0x200
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe__snwprintf]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x2b0], 0x30
mov qword [rsp + 0x2b8], 0
mov dword [rsp + 0x2c8], 0x200
lea rax, [rsp + 0x60]
mov qword [rsp + 0x2c0], rax
mov qword [rsp + 0x2d0], 0
mov qword [rsp + 0x2d8], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2e0]
lea r8, [rsp + 0x2b0]
mov edx, 0x100
lea rcx, [rsp + 0x298]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [rsp + 0x280], eax
cmp dword [rsp + 0x280], 0
jge 0x120f7
mov r8d, dword [rsp + 0x280]
lea rdx, [rsp + 0x80]
lea rcx, [0x00016020]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x280]
jmp 0x12241
movsx eax, word [rsp + 0x2a8]
movsx r9d, word [rsp + 0x2a6]
mov dword [rsp + 0x20], eax
lea r8, [0x00016050]
mov edx, 0x200
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe__snwprintf]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x80]
lea rcx, [0x00016070]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x2b0], 0x30
mov rax, qword [rsp + 0x298]
mov qword [rsp + 0x2b8], rax
mov dword [rsp + 0x2c8], 0x200
lea rax, [rsp + 0x60]
mov qword [rsp + 0x2c0], rax
mov qword [rsp + 0x2d0], 0
mov qword [rsp + 0x2d8], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2e0]
lea r8, [rsp + 0x2b0]
mov edx, 0x40100000
lea rcx, [0x000194d8]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [rsp + 0x280], eax
cmp dword [rsp + 0x280], 0
jge 0x1222c
mov r8d, dword [rsp + 0x280]
lea rdx, [rsp + 0x80]
lea rcx, [0x00016090]
call sub.ntoskrnl.exe_DbgPrint
mov qword [0x000194d8], 0xffffffffffffffff
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x280]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.00015740
add rsp, 0x308
ret
Function at 0x12260
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rsi
push rdi
sub rsp, 0x498
mov rax, qword [0x00018100]
xor rax, rsp
mov qword [rsp + 0x480], rax
lea rax, [rsp + 0x4b8]
mov qword [rsp + 0x50], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x4b0]
mov edx, 0x400
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe__vsnprintf]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
jge 0x122e1
mov byte [rsp + 0x46f], 0
lea r8, [rsp + 0x70]
mov edx, dword [rsp + 0x58]
lea rcx, [0x000160b0]
call sub.ntoskrnl.exe_DbgPrint
cmp qword [0x000194d8], 0
jne 0x1231c
call fcn.00011f60
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
jge 0x1231c
mov edx, dword [rsp + 0x58]
lea rcx, [0x000160d0]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rsp + 0x70]
lea rcx, [0x000160f0]
call sub.ntoskrnl.exe_DbgPrint
cmp qword [0x000194d8], 0xffffffffffffffff
jne 0x12339
lea rdx, [rsp + 0x70]
lea rcx, [0x000160f0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x123b8
lea rdi, [rsp + 0x70]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
sub rdi, 1
lea rsi, [0x00016100]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x70]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], ecx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x470]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x000194d8]
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov dword [rsp + 0x58], eax
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.00015740
add rsp, 0x498
pop rdi
pop rsi
ret

Function at 0x125a0
Capabilities:
Register minifilter driver

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
lea r8, [0x000194d0]
lea rdx, [0x000173b0]
mov rcx, qword [rsp + 0x30]
call sub.FLTMGR.SYS_FltRegisterFilter
add rsp, 0x28
ret
Function at 0x136d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xa8
mov byte [rsp + 0x9c], 1
mov rdx, qword [rsp + 0xc0]
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x40], 0x30
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x58], 0x240
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
lea r8, [rsp + 0x40]
mov edx, 0xf003f
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [rsp + 0x98], eax
cmp dword [rsp + 0x98], 0
jl 0x138de
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [rsp + 0x98], eax
cmp dword [rsp + 0x98], 0xc0000034
je 0x138d3
cmp dword [rsp + 0x98], 0
je 0x137f5
cmp dword [rsp + 0x98], 0x80000005
je 0x137f5
cmp dword [rsp + 0x98], 0xc0000023
je 0x137f5
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov byte [rsp + 0x9c], 0
movzx eax, byte [rsp + 0x9c]
test eax, eax
je 0x138d3
movsxd rdx, dword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x90], 0
je 0x138d3
movsxd rcx, dword [rsp + 0x30]
mov rdi, qword [rsp + 0x90]
xor eax, eax
rep stosb byte [rdi], al
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x90]
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [rsp + 0x98], eax
cmp dword [rsp + 0x98], 0
jl 0x138c3
mov rcx, qword [rsp + 0x90]
add rcx, 0xc
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x138c3
mov rax, qword [rsp + 0x90]
cmp dword [rax + 8], 0
jbe 0x138c3
mov rax, qword [rsp + 0x90]
mov ecx, dword [rax + 8]
mov rsi, qword [rsp + 0x90]
add rsi, 0xc
mov rdi, qword [rsp + 0xd0]
rep movsb byte [rdi], byte [rsi]
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x152c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov byte [rsp + 0x30], 0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x38], rax
xor eax, eax
cmp eax, 1
je 0x153ab
mov rcx, qword [rsp + 0x38]
add rcx, 0x10
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0x38]
cmp dword [rax + 0x54], 0
jge 0x1532c
xor r9d, r9d
mov r8d, 0x3cc
lea rdx, [0x00016650]
lea rcx, [0x00016690]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov dword [rsp + 0x44], 0
jmp 0x15334
mov dword [rsp + 0x44], 1
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 0x54]
mov eax, dword [rdx + 0x50]
or eax, ecx
test eax, eax
jne 0x15354
mov dword [rsp + 0x48], 1
jmp 0x1535c
mov dword [rsp + 0x48], 0
movzx eax, byte [rsp + 0x48]
mov byte [rsp + 0x30], al
mov rcx, qword [rsp + 0x38]
add rcx, 0x10
movzx edx, byte [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
movzx eax, byte [rsp + 0x30]
test eax, eax
jne 0x153a4
mov rcx, qword [rsp + 0x38]
add rcx, 0x18
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
jmp 0x153a6
jmp 0x153ab
jmp 0x152dc
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x30]
and eax, 1
test eax, eax
je 0x153dd
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.ntoskrnl.exe_IoDetachDevice]
mov r11, qword [rsp + 0x38]
mov ecx, dword [r11 + 0x30]
and ecx, 0xfffffffe
mov rax, qword [rsp + 0x38]
mov dword [rax + 0x30], ecx
mov rax, qword [rsp + 0x38]
mov dword [rax], 0
mov rax, qword [rsp + 0x38]
mov dword [rax + 4], 0
mov rax, qword [rsp + 0x38]
cmp qword [rax + 0x40], 0
je 0x1540f
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, qword [rsp + 0x38]
mov qword [rax + 0x40], 0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
movzx r11d, byte [0x00019501]
test r11d, r11d
je 0x15440
lea rcx, [0x000166f0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x15442
add rsp, 0x58
ret
Function at 0x15450
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, 0x160
mov rax, qword [0x00018100]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rdi, [rsp + 0x30]
xor eax, eax
mov ecx, 0x11c
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0x11c
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
je 0x15497
xor eax, eax
jmp 0x1559a
cmp dword [rsp + 0x34], 5
jne 0x154b4
cmp dword [rsp + 0x38], 0
jne 0x154b4
mov eax, 1
jmp 0x1559a
cmp dword [rsp + 0x34], 5
jne 0x154d1
cmp dword [rsp + 0x38], 1
jne 0x154d1
mov eax, 2
jmp 0x1559a
cmp dword [rsp + 0x34], 5
jne 0x15506
cmp dword [rsp + 0x38], 2
jne 0x15506
movzx eax, word [rsp + 0x144]
test eax, eax
jne 0x154f7
mov eax, 3
jmp 0x1559a
mov eax, 4
jmp 0x1559a
cmp dword [rsp + 0x34], 6
jne 0x1551d
cmp dword [rsp + 0x38], 0
jne 0x1551d
mov eax, 5
jmp 0x1559a
cmp dword [rsp + 0x34], 6
jne 0x1553e
cmp dword [rsp + 0x38], 0
jne 0x1553e
cmp dword [rsp + 0x3c], 0x1771
jne 0x1553e
mov eax, 6
jmp 0x1559a
cmp dword [rsp + 0x34], 6
jne 0x15555
cmp dword [rsp + 0x38], 1
jne 0x15555
mov eax, 7
jmp 0x1559a
cmp dword [rsp + 0x34], 6
jne 0x1556c
cmp dword [rsp + 0x38], 2
jne 0x1556c
mov eax, 8
jmp 0x1559a
cmp dword [rsp + 0x34], 6
jne 0x15583
cmp dword [rsp + 0x38], 3
jne 0x15583
mov eax, 9
jmp 0x1559a
cmp dword [rsp + 0x34], 6
jne 0x15598
cmp dword [rsp + 0x38], 4
jne 0x15598
mov eax, 0xa
jmp 0x1559a
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.00015740
add rsp, 0x160
pop rdi
ret

Function at 0x1b064
Capabilities:
Create thread
Print debug messages

Disassembly:
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.0001b008
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp fcn.00011330
Function at 0x180001760
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x70
mov rdi, rcx
cmp edx, 1
jne 0x18000183c
lea rax, vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
mov qword [r11 - 0x48], rax
lea rax, [0x180001340]
mov qword [r11 - 0x40], rax
lea rax, [r11 - 0x48]
mov qword [r11 - 0x10], rax
lea rax, [r11 - 0x48]
mov qword [r11 + 0x20], rax
lea rdx, [r11 - 0x48]
call fcn.180033d00
mov ecx, 7
call fcn.180033eb0
test eax, eax
jne 0x1800017fc
lea rcx, [0x180040688]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1800017cb
xor ebx, ebx
jmp 0x1800017de
lea rdx, str.wglSwapBuffers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
cmp dword [0x180048cb8], 0
je 0x1800017fc
mov rcx, rbx
call fcn.1800363b0
test eax, eax
jne 0x1800017fc
mov rcx, rbx
call fcn.1800366a0
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x180001817
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x180001720]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x180003ba0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180003bfd
lea rbx, [0x18003ade0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180003be4
cmp r10, 2
jb 0x180003be4
cmp byte [r9], r8b
jne 0x180003be4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180003bc0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180003c3f
lea rbx, [0x18003ade0]
cmp r8b, 0x23
jne 0x180003c23
cmp byte [r9], r8b
jne 0x180003c23
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180003c10
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x180003e00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x180003e1e
mov qword [r8], r14
lea rdx, [0x18003a910]
call fcn.180003c50
mov rbx, rax
test rax, rax
jne 0x180003e43
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x180003f6d
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180003f6d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180003f6d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180003f6d
cmp rdi, 0xffffffffffffffff
je 0x180003f6d
mov rcx, rdi
call fcn.180007040
mov rbp, rax
test rax, rax
je 0x180003f6d
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x180003f5a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x180048a20]
test r8, r8
je 0x180003f4f
movsx rdx, word [r8 + 0x60f0]
lea rcx, [r8 + 0x60f4]
mov r9d, dword [r8 + 0x3f58]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x180003f44
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rcx, [r8 + 0x60f4]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x60ec]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180003f76
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x180003f68
mov qword [rsi], rdi
mov rax, rbp
jmp 0x180003f78
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1800069b0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x100]
lea r11, [0x18003ade0]
mov rax, qword [rcx + 0x108]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x404c], ebx
jne 0x180006a46
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.18001a160
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x18000a170
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18000a1c0
lea r11, [0x18003ade0]
nop dword [rax]
cmp r9b, 0x23
jne 0x18000a1a3
cmp byte [r8], r9b
jne 0x18000a1a3
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18000a190
mov rcx, qword [0x180048a20]
not eax
movsxd rdx, dword [rcx + 0x3fe0]
mov r9, qword [rcx + 0x3fe8]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x18000a221
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x18000a219
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18000a21c
mov rdx, r8
test rdx, rdx
jne 0x18000a1f0
cmp r9, r10
je 0x18000a230
cmp dword [r9], eax
jne 0x18000a230
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x180018c00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x6010], 0
lea rbx, [rcx + 0x6018]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180018ca7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x180018c5a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18001b0a0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1800043f0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x6010]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x6020]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x180048a11]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x180018caf
mov rcx, rbx
call fcn.1800043f0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180018f10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x180048a20]
xor ebp, ebp
cmp byte [rbx + 0x5f68], bpl
jne 0x180018fef
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x180018fe8
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.180003e00
mov rsi, rax
test rax, rax
je 0x180018fe8
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x180018f74
mov rcx, rax
call fcn.180019140
mov r8, qword [0x180048a20]
test r8, r8
je 0x180018fdf
movsx rdx, word [r8 + 0x60f0]
lea rcx, [r8 + 0x60f4]
mov r9d, dword [r8 + 0x3f58]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x180018fd4
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rcx, [r8 + 0x60f4]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x60ec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x5f68], 1
movss xmm0, dword [rbx + 0x5f6c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x18001907e
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5f6c], xmm0
jb 0x18001907e
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x180019071
mov rax, qword [0x180048a20]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5f6c], ebp
call fcn.1800193a0
lea rdx, [0x18003a914]
mov rcx, rdi
mov rsi, rax
call fcn.180003c50
mov rdi, rax
test rax, rax
je 0x180019078
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x180019078
mov byte [rbx + 0xce], 1
mov dword [rbx + 0x5f6c], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1800190a0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x180048a20]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x180019103
mov qword [rsp], rbx
lea rbx, [0x18003ade0]
nop dword [rax]
cmp r9b, 0x23
jne 0x1800190e3
cmp byte [r8], r9b
jne 0x1800190e3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1800190d0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f80]
not eax
mov r8, qword [r10 + 0x5f88]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x18001912f
cmp dword [r8 + 8], eax
je 0x180019136
add r8, 0x48
cmp r8, rcx
jne 0x180019120
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x18002d020
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x180048010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x180048a20]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x18002d23e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x18002d23e
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x180048a20]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x18002d0f4
movsx rdx, word [r8 + 0x60f0]
lea rax, [r8 + 0x60f4]
mov r9d, dword [r8 + 0x3f58]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x18002d0e9
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rax, [rax*8 + 0x60f4]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x60e8]
test rdi, rdi
je 0x18002d111
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x18002d114
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, str.imgui_impl_win32
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x18002d157
mov rsi, qword [r8 + 0x90]
jmp 0x18002d15a
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x18002d185
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x180048a20]
mov rcx, qword [rax + 0x4b10]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x18002d1fe
inc rbx
cmp rbx, 5
jl 0x18002d1e0
jmp 0x18002d22a
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x18002d240
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180036c40
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret