joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180012d10
Capabilities:
Set thread local storage value

Disassembly:
push rbx
mov eax, 0x20
call fcn.180025560
sub rsp, rax
cmp dword [0x180034c84], 1
jbe 0x180012d79
lea rcx, [0x180034dd8]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov ecx, dword [0x180034dd0]
mov rax, qword [0x180034dc8]
mov rbx, qword [rax + rcx*8]
test rbx, rbx
jne 0x180012d59
call fcn.1800129d0
mov ecx, dword [0x180034dd0]
mov rbx, rax
lea eax, [rcx + 1]
xor edx, edx
div dword [0x180034c84]
lea rcx, [0x180034dd8]
mov dword [0x180034dd0], edx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
jmp 0x180012d83
mov rax, qword [0x180034dc8]
mov rbx, qword [rax]
mov ecx, dword [0x180034668]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x180014a10
Capabilities:
Get thread local storage value

Disassembly:
push rbx
mov eax, 0x20
call fcn.180025560
sub rsp, rax
mov rbx, rcx
lfence
cmp rcx, 0xfe000
ja 0x180014a6d
mov ecx, dword [0x180034668]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x180014a44
call fcn.180012d10
lfence
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
cmp rbx, 0x800
ja 0x180014a63
add rsp, 0x20
pop rbx
jmp fcn.180010f10
add rsp, 0x20
pop rbx
jmp fcn.180010e80
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.180014760

Function at 0x180014af0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
mov eax, 0x20
call fcn.180025560
sub rsp, rax
mov rbx, rcx
mov r8, rdx
imul rbx, rdx
test rbx, rbx
jne 0x180014b13
lea ebx, [rax - 0x1f]
jmp 0x180014b42
mov rax, rcx
movabs rdx, 0xffffffff00000000
or rax, r8
test rdx, rax
je 0x180014b39
xor edx, edx
mov rax, rbx
div r8
cmp rax, rcx
je 0x180014b39
xor ebx, ebx
jmp 0x180014b96
cmp rbx, 0xfe000
ja 0x180014b7e
mov ecx, dword [0x180034668]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x180014b58
call fcn.180012d10
lfence
mov r8d, 1
mov rdx, rbx
mov rcx, rax
cmp rbx, 0x800
ja 0x180014b77
call fcn.180010f10
jmp 0x180014b8e
call fcn.180010e80
jmp 0x180014b8e
lfence
mov edx, 1
mov rcx, rbx
call fcn.180014760
mov rbx, rax
test rax, rax
jne 0x180014ba2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0xc
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x180014e30
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, 0x30
call fcn.180025560
sub rsp, rax
mov r12, r9
mov r15, r8
mov r14, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov r9d, 1
mov dword [rsp + 0x20], 0
mov r8, r12
xor edx, edx
mov rcx, rbx
call fcn.180011a10
mov rdi, rax
test rax, rax
jne 0x180011272
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor eax, eax
jmp 0x180011316
mov qword [rsp + 0x58], rsi
lea rax, [r14 - 1]
mov rsi, rdi
and rsi, 0xfffffffffff00000
and rax, rdi
jne 0x1800112a6
mov dword [rsp + 0x28], eax
mov r9, r12
mov r8, rdi
mov qword [rsp + 0x20], r15
mov rdx, rsi
mov rcx, rbx
call fcn.180012920
jmp 0x1800112fd
mov qword [rsp + 0x50], rbp
sub r14, rax
mov rbp, r12
sub rbp, r14
test r14, r14
je 0x1800112d5
lfence
mov r9, r12
mov qword [rsp + 0x20], rbp
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.1800128a0
add rdi, r14
cmp rbp, r15
je 0x1800112f8
mov dword [rsp + 0x28], 0
mov r9, rbp
mov r8, rdi
mov qword [rsp + 0x20], r15
mov rdx, rsi
mov rcx, rbx
call fcn.180012920
mov rbp, qword [rsp + 0x50]
inc qword [rbx + 0x68]
mov rcx, rbx
add qword [rbx + 0x60], r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
push rbx
mov eax, 0x20
call fcn.180025560
sub rsp, rax
test rdx, rdx
mov eax, 8
mov r8d, 1
cmovne r8, rdx
cmp rcx, rax
cmovb rcx, rax
mov rax, rcx
neg rax
lea rbx, [r8 + rcx - 1]
and rbx, rax
cmp rbx, r8
jae 0x180014e73
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp rbx, 0x1000
jbe 0x180014f5f
cmp rcx, 0x1000
ja 0x180014ea0
cmp rbx, 0xfe000
jbe 0x180014f5f
lea rdi, [rcx + 0xfff]
lea rbx, [r8 + 0xfff]
and rdi, 0xfffffffffffff000
and rbx, 0xfffffffffffff000
cmp rbx, r8
jb 0x180014f4d
lea rcx, [rbx + rdi]
cmp rcx, rbx
jb 0x180014f4d
cmp rbx, rdi
lea rax, [rdi + rdi]
cmovb rcx, rax
lea rsi, [rcx - 0x1000]
lfence
cmp rsi, 0xfe000
ja 0x180014f11
call fcn.180012ce0
mov rcx, rax
mov r9, rsi
mov r8, rbx
mov rdx, rdi
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp 0x180011210
mov rcx, rbx
cmp rdi, 0x100000
ja 0x180014f33
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp fcn.180014760
xor r8d, r8d
mov rdx, rdi
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp 0x180014780
mov rsi, qword [rsp + 0x30]
xor eax, eax
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
mov ecx, dword [0x180034668]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x180014f75
call fcn.180012d10
lfence
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
cmp rbx, 0x800
ja 0x180014f9e
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp fcn.180010f10
call fcn.180010e80
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x180015ea0
Capabilities:
Query environment variable

Disassembly:
push rbx
mov eax, 0x20
call fcn.180025560
sub rsp, rax
lea rbx, [0x180034c40]
mov rdx, rbx
lea r8d, [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ecx, ecx
test eax, eax
cmovne rcx, rbx
mov rax, rcx
add rsp, 0x20
pop rbx
ret

Function at 0x180015f80
Capabilities:
Create thread

Disassembly:
mov eax, 0x38
call fcn.180025560
sub rsp, rax
movzx eax, byte [0x180034e58]
test al, al
jne 0x1800160a0
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp qword [0x180034e60], rbx
jne 0x180016051
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x180034e68], rax
test rax, rax
jne 0x180015fe4
lea rcx, str.CreateEvent
call fcn.1800167b0
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x38
ret
lea rcx, [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x180016b90]
xor ecx, ecx
mov dword [rsp + 0x20], ebx
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [0x180034e60], rax
mov rcx, rax
test rax, rax
jne 0x180016041
lea rcx, [0x18002c108]
call fcn.1800167b0
mov rcx, qword [0x180034e68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x180034e68], rbx
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x38
ret
mov eax, dword [rsp + 0x40]
mov dword [0x180034df0], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180034e68]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x180016035
mov rcx, qword [0x180034e68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x180034df8]
mov qword [0x180034e60], rbx
mov qword [0x180034e68], rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rbx, qword [rsp + 0x30]
mov al, 1
mov byte [0x180034e58], 1
add rsp, 0x38
ret
Function at 0x1800172a0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x20
call fcn.180025560
sub rsp, rax
lea rbx, [rax - 0x21]
lea edi, [rax - 0x16]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
sub rax, qword [rsp + 0x38]
imul rcx, rax, 0x3e8
cmp rcx, rbx
cmovae rcx, rbx
mov rbx, rcx
sub edi, 1
je 0x1800172f5
test rcx, rcx
jne 0x1800172ba
test rbx, rbx
mov ecx, 1
cmove rbx, rcx
xor edx, edx
imul rax, rbx, 0xf4240
div qword [0x180034ed8]
test rax, rax
cmove rax, rcx
mov qword [0x180034e80], rax
cmp rcx, rax
je 0x180017347
lea rdx, [rcx + rcx*4]
add rdx, rdx
cmp rdx, rax
ja 0x180017347
mov rcx, rdx
jne 0x180017324
mov qword [0x180034e88], rdx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov qword [0x180034e88], rcx
add rsp, 0x20
pop rdi
ret

Function at 0x180020ab0
Capabilities:
Get system information on windows

Disassembly:
mov eax, 0x58
call fcn.180025560
sub rsp, rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
add rsp, 0x58
ret

Function at 0x180021060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.180025560
sub rsp, rax
xor eax, eax
mov rbp, rdx
mov rsi, rdx
mov rdi, rcx
mov ebx, eax
and rbp, 0xfffffffffffffff8
jbe 0x1800210aa
mov rdx, qword [rbx + rdi]
mov r8d, 8
mov ecx, eax
call fcn.18001d6e0
add rbx, 8
cmp rbx, rbp
jb 0x180021090
cmp rbx, rsi
jae 0x1800210d7
nop dword [rax]
nop word [rax + rax]
nop
movsx ecx, byte [rbx + rdi]
inc rbx
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
cmp rbx, rsi
jb 0x1800210c0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800250b8
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x18000003c]
lea rsi, [0x180000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x180025130
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x180025130
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x180025130
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x180025124
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x180025142
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x180025112
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x180025132
Function at 0x1800042a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
lea rbx, [rcx + 0x58]
lea r9, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
lea rcx, [0x18008d5d0]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x18000439e
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.180012340
mov rdi, rax
cmp rbx, rax
je 0x180004351
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x180004323
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18000431e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180004426
mov rcx, r8
call fcn.18005e87c
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], 7
mov word [rdi], ax
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180004393
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000438e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004426
call fcn.18005e87c
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
call fcn.18005cbac
lea rcx, str.R3nzSkin
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 8
lea r8, [rsp + 0x20]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.180003b50
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180003db0
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180004415
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000440f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004420
call fcn.18005e87c
nop
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
call fcn.18006d94c
int3
call fcn.18006d94c
int3

Function at 0x18001b790
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18001b7ed
lea rbx, [0x180099b50]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18001b7d4
cmp r10, 2
jb 0x18001b7d4
cmp byte [r9], r8b
jne 0x18001b7d4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18001b7b0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18001b82f
lea rbx, [0x180099b50]
cmp r8b, 0x23
jne 0x18001b813
cmp byte [r9], r8b
jne 0x18001b813
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18001b800
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x18001b970
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18001b98a
mov qword [r8], 0
lea rdx, [0x18009ee94]
call fcn.18001b840
mov rbx, rax
test rax, rax
jne 0x18001b9aa
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.18006dfec
mov esi, eax
cmp eax, 0xffffffff
je 0x18001ba78
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.18006d50c
test eax, eax
jne 0x18001ba78
mov rcx, rbx
call fcn.18006dfec
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18001ba78
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.18006d50c
test eax, eax
jne 0x18001ba78
cmp rdi, 0xffffffffffffffff
je 0x18001ba78
mov rax, qword [0x1800b4f48]
test rax, rax
je 0x18001ba1a
inc dword [rax + 0x3b0]
mov rcx, rdi
call fcn.180071018
mov rsi, rax
test rax, rax
je 0x18001ba78
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.18006d13c
mov rcx, rbx
cmp rax, rdi
je 0x18001ba66
call fcn.180069278
mov rax, qword [0x1800b4f48]
test rax, rax
je 0x18001ba5c
dec dword [rax + 0x3b0]
mov rcx, rsi
call fcn.18006cd18
jmp 0x18001ba80
call fcn.180069278
test r14, r14
je 0x18001ba73
mov qword [r14], rdi
mov rax, rsi
jmp 0x18001ba82
mov rcx, rbx
call fcn.180069278
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x180027980
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x1800b4f48]
lea rdx, [0x180099b50]
mov r8, rcx
mov rbx, qword [rax + 0x1c08]
add rbx, 0xc8
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 9]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xa]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xb]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xc]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xd]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xe]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xf]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x180027a81
lea ecx, [r9 + 1]
test r8d, r8d
je 0x180027a6d
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x180027a72
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.18002eed0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800288f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x1800b4f48]
mov edi, edx
cmp byte [rbx + 0x1f75], 0
jne 0x180028941
cmp byte [rbx + 0x1f76], 0
jne 0x180028941
mov r9d, dword [rbx + 0x3054]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.18001b710
test dil, 1
je 0x180028a66
jmp 0x1800289c9
movss xmm1, dword [rbx + 0x1610]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x3054]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1800a0b68]
mulss xmm1, dword [0x1800a0b58]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x128]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1d08], rax
mov dword [rbx + 0x1cf4], 1
movss dword [rbx + 0x1d00], xmm0
movss dword [rbx + 0x1d04], xmm1
movss xmm0, dword [rbx + 0x166c]
mulss xmm0, dword [0x1800a0adc]
or dword [rbx + 0x1cf0], 0x41
movss dword [rbx + 0x1d50], xmm0
call fcn.18001b710
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x180028a20
lea r11, [0x180099b50]
nop dword [rax]
cmp r9b, 0x23
jne 0x180028a03
cmp byte [r8], r9b
jne 0x180028a03
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1800289f0
not ecx
call fcn.180022580
test rax, rax
je 0x180028a66
cmp byte [rax + 0x8e], 0
je 0x180028a66
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3054]
mov edx, 0x10
mov r9d, dword [rbx + 0x3054]
call fcn.18001b710
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.180024ac0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18004f0d0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
test dword [rcx + 0x10], 0x100000
mov r10, rdx
je 0x18004f15b
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x18004f130
lea r10, [0x180099b50]
nop dword [rax]
cmp r9b, 0x23
jne 0x18004f113
cmp byte [r8], r9b
jne 0x18004f113
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r10 + rdx*4]
test r9b, r9b
jne 0x18004f100
mov rcx, qword [0x1800b4f48]
not eax
cmp dword [rcx + 0x1c50], eax
jne 0x18004f147
mov dword [rcx + 0x1c54], eax
cmp dword [rcx + 0x1c90], eax
jne 0x18004f1ad
mov byte [rcx + 0x1c94], 1
add rsp, 0x28
ret
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rbx, qword [0x1800b4f48]
mov rcx, r10
mov r8, qword [rbx + 0x1c08]
movsxd rax, dword [r8 + 0xc8]
mov r8, qword [r8 + 0xd0]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.18001b790
cmp dword [rbx + 0x1c50], eax
jne 0x18004f199
mov dword [rbx + 0x1c54], eax
cmp dword [rbx + 0x1c90], eax
jne 0x18004f1a8
mov byte [rbx + 0x1c94], 1
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x180054790
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, rcx
mov rax, qword [rcx]
mov r9, qword [rax]
movabs r12, 0xcbf29ce484222325
movabs r15, 0x100000001b3
mov r10, qword [0x1800b2cc8]
test r9, r9
je 0x18005484a
cmp dword [r10 + 0xc], 0
jle 0x18005484a
mov rax, qword [0x1800b4f20]
mov r9, qword [r9 + rax + 0x18]
mov r8, r12
nop dword [rax + rax]
movsx rdx, byte [r9]
lea r9, [r9 + 1]
xor r8, rdx
imul r8, r15
test dl, dl
jne 0x1800547f0
mov qword [rsp + 0x50], r8
lea rdx, [rsp + 0x50]
mov rcx, qword [0x1800b2ce0]
call fcn.180054b30
mov rcx, qword [0x1800b2cc8]
movsxd rdx, dword [rcx + 0xc]
lea rcx, [rdx + rdx*2]
add rcx, rcx
mov rax, qword [rax]
mov r9, qword [r14]
mov r8d, dword [rax + rcx*8 - 8]
mov rdx, qword [rax + rcx*8 - 0x30]
mov rcx, qword [r9]
call fcn.180059d70
mov r10, qword [0x1800b2cc8]
mov rax, qword [r14]
mov rcx, qword [rax]
test rcx, rcx
je 0x18005485a
mov ebp, dword [rcx + 0x3c]
jmp 0x18005485f
mov ebp, 0x64
xor esi, esi
mov rax, qword [r14 + 8]
mov rdx, qword [rax]
cmp dword [rdx + 0x10], esi
jbe 0x180054969
movabs r13, 0x96380e6f20703d36
nop dword [rax + rax]
mov rax, qword [rdx + 8]
mov rdi, qword [rax + rsi*8]
mov rax, qword [r14]
cmp rdi, qword [rax]
je 0x180054957
mov rax, qword [0x1800b4f20]
mov r8, qword [rax + rdi + 0x18]
mov rdx, r12
nop dword [rax]
nop word [rax + rax]
movsx rcx, byte [r8]
lea r8, [r8 + 1]
xor rdx, rcx
imul rdx, r15
test cl, cl
jne 0x1800548b0
mov qword [rsp + 0x50], rdx
cmp rdx, r13
je 0x180054957
cmp ebp, dword [rdi + 0x3c]
lea rax, [r10 + 0x38]
jne 0x1800548de
lea rax, [r10 + 0x28]
mov rcx, qword [rax]
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp byte [rax + 0x19], 0
jne 0x180054908
nop
cmp qword [rax + 0x20], rdx
jae 0x1800548fc
mov rax, qword [rax + 0x10]
jmp 0x180054902
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1800548f0
cmp byte [rbx + 0x19], 0
jne 0x180054957
cmp rdx, qword [rbx + 0x20]
jb 0x180054957
cmp rbx, rcx
je 0x180054957
cmp dword [rbx + 0x28], 0
jle 0x180054957
lea rdx, [rsp + 0x50]
mov rcx, qword [0x1800b2ce0]
call fcn.180054b30
movsxd rdx, dword [rbx + 0x28]
lea rdx, [rdx + rdx*2]
add rdx, rdx
mov rax, qword [rax]
mov r8d, dword [rax + rdx*8 - 8]
mov rdx, qword [rax + rdx*8 - 0x30]
mov rcx, rdi
call fcn.180059d70
mov r10, qword [0x1800b2cc8]
inc esi
mov rax, qword [r14 + 8]
mov rdx, qword [rax]
cmp esi, dword [rdx + 0x10]
jb 0x180054880
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x180055050
Capabilities:
Hide thread from debugger

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtSetInformationThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180055096
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
mov rcx, rbx
call rax
test eax, eax
jne 0x180055092
mov al, 1
jmp 0x180055096
jmp 0x180055096
add rsp, 0x20
pop rbx
ret
Function at 0x180059be0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x180059c41
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x180059c00
mov ecx, dword [r9]
jmp 0x180059d28
cmp ecx, 0x4e0
jb 0x180059d28
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x180059c60
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x180059cb0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret