joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180029790
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov edx, dword [0x1800c5164]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x1800c6890], edx
jle 0x180029813
lea rcx, [0x1800c6890]
call fcn.180083c78
cmp dword [0x1800c6890], 0xffffffff
jne 0x180029813
mov edx, 2
lea rsi, [0x1800c68a0]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180087e40]
call fcn.180083bb8
lea rcx, [0x1800c6890]
call fcn.180083c0c
jmp 0x18002981a
lea rsi, [0x1800c68a0]
mov qword [rsp + 0x60], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x180029838
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800c68ec], 0x7fffffff
jne 0x18002985a
mov dword [0x1800c68ec], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18002986b
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x1800298a3
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180029890
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.18001c5d0
cmp qword [rax + 8], 0
je 0x1800298ce
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x1800298ff
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1800298db
mov rdx, qword [rdi]
mov rcx, qword [0x1800c64e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x180029953
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
lea rdx, [0x1800c21c0]
lea rcx, [0x180025fb0]
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x18002995c
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180029970
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
mov r8d, dword [0x1800c5164]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov r8d, dword [rcx + rax]
cmp dword [0x1800c6678], r8d
jle 0x1800299f2
lea rcx, [0x1800c6678]
call fcn.180083c78
cmp dword [0x1800c6678], 0xffffffff
jne 0x1800299f2
mov edx, 2
lea rsi, [0x1800c6740]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180087e30]
call fcn.180083bb8
lea rcx, [0x1800c6678]
call fcn.180083c0c
jmp 0x1800299f9
lea rsi, [0x1800c6740]
mov qword [rsp + 0x70], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x180029a17
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800c678c], 0x7fffffff
jne 0x180029a39
mov dword [0x1800c678c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180029a4a
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180029a83
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180029a70
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.18001c5d0
cmp qword [rax + 8], 0
je 0x180029aae
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x180029adf
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180029abb
mov rdx, qword [rdi]
mov rcx, qword [0x1800c64e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x180029b25
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
mov rcx, r14
call rdx
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, ebx
jmp 0x180029b2e
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x180029b40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800c5164]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x1800c6674], r9d
jle 0x180029bcb
lea rcx, [0x1800c6674]
call fcn.180083c78
cmp dword [0x1800c6674], 0xffffffff
jne 0x180029bcb
mov edx, 2
lea rsi, [0x1800c6680]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180087e20]
call fcn.180083bb8
lea rcx, [0x1800c6674]
call fcn.180083c0c
jmp 0x180029bd2
lea rsi, [0x1800c6680]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x180029bf0
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800c66cc], 0x7fffffff
jne 0x180029c12
mov dword [0x1800c66cc], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180029c23
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180029c53
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180029c40
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.18001c5d0
cmp qword [rax + 8], 0
je 0x180029c7e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x180029caf
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180029c8b
mov rdx, qword [rdi]
mov rcx, qword [0x1800c64e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x180029cfb
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov edx, r14d
mov rcx, r15
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x180029d04
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180029d20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800c5164]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x1800c66d4], r9d
jle 0x180029dab
lea rcx, [0x1800c66d4]
call fcn.180083c78
cmp dword [0x1800c66d4], 0xffffffff
jne 0x180029dab
mov edx, 2
lea rsi, [0x1800c6620]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180087e10]
call fcn.180083bb8
lea rcx, [0x1800c66d4]
call fcn.180083c0c
jmp 0x180029db2
lea rsi, [0x1800c6620]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x180029dd0
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800c666c], 0x7fffffff
jne 0x180029df2
mov dword [0x1800c666c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180029e03
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180029e33
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180029e20
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.18001c5d0
cmp qword [rax + 8], 0
je 0x180029e5e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x180029e8f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180029e6b
mov rdx, qword [rdi]
mov rcx, qword [0x1800c64e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x180029edb
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x180029ee4
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180029f00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
mov r8d, dword [0x1800c5164]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov r8d, dword [rcx + rax]
cmp dword [0x1800c6670], r8d
jle 0x180029f82
lea rcx, [0x1800c6670]
call fcn.180083c78
cmp dword [0x1800c6670], 0xffffffff
jne 0x180029f82
mov edx, 2
lea rsi, [0x1800c67a0]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180087e00]
call fcn.180083bb8
lea rcx, [0x1800c6670]
call fcn.180083c0c
jmp 0x180029f89
lea rsi, [0x1800c67a0]
mov qword [rsp + 0x70], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x180029fa7
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800c67ec], 0x7fffffff
jne 0x180029fc9
mov dword [0x1800c67ec], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180029fda
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18002a013
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18002a000
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.18001c5d0
cmp qword [rax + 8], 0
je 0x18002a03e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18002a06f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18002a04b
mov rdx, qword [rdi]
mov rcx, qword [0x1800c64e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18002a0b5
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
mov rcx, r14
call rdx
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, ebx
jmp 0x18002a0be
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x18002a0d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800c5164]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x1800c65c0], r9d
jle 0x18002a15b
lea rcx, [0x1800c65c0]
call fcn.180083c78
cmp dword [0x1800c65c0], 0xffffffff
jne 0x18002a15b
mov edx, 2
lea rsi, [0x1800c68f0]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180087df0]
call fcn.180083bb8
lea rcx, [0x1800c65c0]
call fcn.180083c0c
jmp 0x18002a162
lea rsi, [0x1800c68f0]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18002a180
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800c693c], 0x7fffffff
jne 0x18002a1a2
mov dword [0x1800c693c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18002a1b3
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18002a1e3
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18002a1d0
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.18001c5d0
cmp qword [rax + 8], 0
je 0x18002a20e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18002a23f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18002a21b
mov rdx, qword [rdi]
mov rcx, qword [0x1800c64e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18002a289
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, ebx
jmp 0x18002a292
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18002a2b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800c5164]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x1800c667c], r9d
jle 0x18002a33b
lea rcx, [0x1800c667c]
call fcn.180083c78
cmp dword [0x1800c667c], 0xffffffff
jne 0x18002a33b
mov edx, 2
lea rsi, [0x1800c67f0]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180087de0]
call fcn.180083bb8
lea rcx, [0x1800c667c]
call fcn.180083c0c
jmp 0x18002a342
lea rsi, [0x1800c67f0]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18002a360
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800c683c], 0x7fffffff
jne 0x18002a382
mov dword [0x1800c683c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18002a393
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18002a3c3
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18002a3b0
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.18001c5d0
cmp qword [rax + 8], 0
je 0x18002a3ee
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18002a41f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18002a3fb
mov rdx, qword [rdi]
mov rcx, qword [0x1800c64e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18002a46b
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov edx, r14d
mov rcx, r15
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x18002a474
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18002a490
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800c5164]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x1800c66d0], r9d
jle 0x18002a51b
lea rcx, [0x1800c66d0]
call fcn.180083c78
cmp dword [0x1800c66d0], 0xffffffff
jne 0x18002a51b
mov edx, 2
lea rsi, [0x1800c6570]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180087dd0]
call fcn.180083bb8
lea rcx, [0x1800c66d0]
call fcn.180083c0c
jmp 0x18002a522
lea rsi, [0x1800c6570]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18002a540
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800c65bc], 0x7fffffff
jne 0x18002a562
mov dword [0x1800c65bc], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18002a573
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18002a5a3
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18002a590
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.18001c5d0
cmp qword [rax + 8], 0
je 0x18002a5ce
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18002a5ff
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18002a5db
mov rdx, qword [rdi]
mov rcx, qword [0x1800c64e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18002a646
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18001bfd0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
nop
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
jmp 0x18002a64f
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180031a20
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x1800c5164]
mov rax, qword gs:[0x58]
mov rdi, qword [rdx]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1800c6c50], ecx
jle 0x180031a82
lea rcx, [0x1800c6c50]
call fcn.180083c78
cmp dword [0x1800c6c50], 0xffffffff
jne 0x180031a82
lea rcx, [0x180087ec0]
call fcn.180083bb8
lea rcx, [0x1800c6c50]
call fcn.180083c0c
mov rax, qword [0x1800c52d8]
xor esi, esi
test rax, rax
je 0x180031a99
mov rcx, qword [rax + 0xa0]
jmp 0x180031a9c
mov rcx, rsi
cmp qword [rcx + 0x48], rsi
jne 0x180031aa7
call fcn.1800339f0
call fcn.180035390
call fcn.18003de90
call fcn.180031190
cmp byte [0x1800c2178], sil
je 0x180031acb
lea rcx, [0x1800c2160]
call fcn.18002ba80
xor edx, edx
lea rcx, str.UnityWndClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rbx
jne 0x180031b05
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x180031b05
cmp byte [0x1800c2178], sil
sete byte [0x1800c2178]
call fcn.1800401a0
call fcn.1800405a0
mov rax, qword [rdi]
lea r8, [0x1800c52d0]
xor r9d, r9d
mov rcx, rdi
lea edx, [r9 + 1]
call qword [rax + pe_nt_image_headers64]
mov rax, qword [0x1800c52d8]
mov rcx, qword [rax + 0x4210]
mov rcx, qword [rcx]
add rcx, 0xa8
cmp byte [rcx], sil
cmove rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.180032f80
Function at 0x180032bb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x180032c11
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x180032bd0
mov ecx, dword [r9]
jmp 0x180032cf8
cmp ecx, 0x4e0
jb 0x180032cf8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x180032c30
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x180032c80
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret