joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402db0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x402dc0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x402dd0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402e11
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402e08
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x402e13
add rax, 0x28
cmp rax, r9
jne 0x402df4
xor eax, eax
ret

Function at 0x402eb0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00406440]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x402f1d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402f1d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x402f1d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402f14
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402f1f
add rax, 0x28
cmp rax, r9
jne 0x402f00
xor eax, eax
add rsp, 0x28
ret

Function at 0x403020
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00406440]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x403040
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x403038
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40309d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x403094
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4030a4
add rax, 0x28
cmp rax, r9
jne 0x403080
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x4030c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x00406440]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x40312e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x40312e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x40312e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x40312e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x403125
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x403135
add rcx, 0x28
cmp rcx, rax
jne 0x403110
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x403148
jmp 0x40312e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x403156
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x40312e
test r9d, r9d
jg 0x403140
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x4041b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x18000ea48
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
cmp qword [rcx + 0x20], 0
mov ebp, edx
mov rdi, rcx
je 0x18000eb5b
lea rdx, str.CreateInterface
call fcn.18000eb70
mov qword [rsp + 0x70], rax
test rax, rax
je 0x18000eb5b
cmp qword [rdi + 0x48], 0
jne 0x18000eb0c
mov edx, 3
lea rcx, [rsp + 0x70]
call fcn.18000f448
mov rcx, rax
call fcn.18000f478
xor esi, esi
mov r14, qword [rax]
test r14, r14
je 0x18000eb0c
mov rcx, qword [r14 + 8]
mov edx, 0x811c9dc5
jmp 0x18000eac7
movzx eax, al
xor eax, edx
imul edx, eax, 0x1000193
inc rcx
mov al, byte [rcx]
test al, al
jne 0x18000eab9
mov dword [rsp + 0x60], edx
call qword [r14]
lea r8, [rsp + 0x60]
mov rbx, rax
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x38]
call fcn.18000ee70
mov rcx, qword [rax]
mov qword [rcx + 0x18], rbx
cmp dword [rsp + 0x60], ebp
mov r14, qword [r14 + 0x10]
cmove rsi, rbx
test r14, r14
jne 0x18000eaae
test rsi, rsi
je 0x18000eb0c
mov rax, rsi
jmp 0x18000eb5d
lea rcx, [rsp + 0x68]
call fcn.18000f3fc
mov rcx, qword [rdi + 0x50]
mov r10, rax
and r10, qword [rdi + 0x68]
add r10, r10
mov rax, qword [rcx + r10*8 + 8]
cmp rax, qword [rdi + 0x40]
je 0x18000eb45
mov rcx, qword [rcx + r10*8]
jmp 0x18000eb3e
cmp rax, rcx
je 0x18000eb45
mov rax, qword [rax + 8]
cmp ebp, dword [rax + 0x10]
jne 0x18000eb35
jmp 0x18000eb47
xor eax, eax
test rax, rax
cmove rax, qword [rdi + 0x40]
cmp rax, qword [rdi + 0x40]
je 0x18000eb5b
mov rax, qword [rax + 0x18]
jmp 0x18000eb5d
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000f3fc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rcx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [rdx + r8]
movabs r9, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, r9
cmp r8, 4
jb 0x18000f3d9
mov rax, rcx
ret
mov rdx, rcx
jmp 0x18000f3cc

Function at 0x180011b98
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rdx, str.mp_teammates_are_enemies
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov ebp, 0x811c9dc5
mov al, 0x6d
movzx eax, al
inc rdx
xor eax, ebp
imul ebp, eax, 0x1000193
mov al, byte [rdx]
test al, al
jne 0x180011bbf
call fcn.180011aa0
mov rdi, rax
mov rdx, rdi
mov rcx, rsi
call fcn.180011b40
mov rbx, rax
test rax, rax
je 0x180011c10
mov rcx, qword [rax]
mov edx, 0x811c9dc5
jmp 0x180011c06
movzx eax, al
xor eax, edx
imul edx, eax, 0x1000193
inc rcx
mov al, byte [rcx]
test al, al
jne 0x180011bf8
cmp edx, ebp
je 0x180011c44
mov rdx, rdi
mov rcx, rsi
call fcn.180011ae8
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180011bdb
lea rdx, [rsp + 0x48]
lea rcx, str._cvar__Couldnt_find_cvar_named_.
call fcn.180002658
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
lea r8, [rsp + 0x50]
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x48]
lea rcx, str._cvar______
call fcn.180011c64
mov rax, rbx
jmp 0x180011c37
Function at 0x18001214c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r9, qword [rcx + 0x80]
mov r10d, 0x811c9dc5
mov al, byte [r9]
test al, al
je 0x18001219d
movzx eax, al
inc r9
xor eax, r10d
imul r10d, eax, 0x1000193
mov al, byte [r9]
test al, al
jne 0x180012160
cmp r10d, 0xf102793d
jne 0x18001219d
test dl, dl
je 0x180012193
mov eax, 0x1f4
cmp word [rcx + 0x10], ax
setae r8b
jmp 0x180012199
mov r8d, 1
mov al, r8b
ret
xor al, al
ret

Function at 0x1800121a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r9, qword [rcx + 0x80]
mov r11b, dl
mov r10d, 0x811c9dc5
mov al, byte [r9]
test al, al
je 0x1800121fe
mov r8d, 1
movzx eax, al
add r9, r8
xor eax, r10d
imul r10d, eax, 0x1000193
mov al, byte [r9]
test al, al
jne 0x1800121bd
cmp r10d, 0x1c826fb7
jne 0x1800121fe
movzx ecx, word [rcx + 0x10]
mov eax, 0x13a4
sub cx, ax
cmp cx, r8w
seta cl
test r11b, r11b
movzx edx, cl
cmovne r8d, edx
mov al, r8b
ret
xor al, al
ret

Function at 0x180016824
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
test rdx, rdx
je 0x180016958
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rcx, rdx
mov rbx, rdx
call fcn.18000fe48
mov rcx, rax
test rax, rax
je 0x18001694e
mov al, byte [rax]
mov edx, 0x811c9dc5
test al, al
je 0x18001694e
movzx eax, al
inc rcx
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [rcx]
test al, al
jne 0x180016862
cmp edx, 0xa6abe875
jne 0x18001694e
call fcn.1800138e8
mov rcx, rax
call fcn.18001309c
test rax, rax
je 0x18001694e
mov eax, dword [rax + 8]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], eax
call fcn.180012bb8
test rax, rax
je 0x18001694e
mov rcx, rax
call fcn.180013b5c
mov rcx, rax
call fcn.180012bb8
test rax, rax
je 0x18001694e
mov rcx, rax
call fcn.1800117ec
test rax, rax
je 0x18001694e
mov rcx, rax
call fcn.18000f5fc
test rax, rax
je 0x18001694e
mov rcx, rax
call fcn.18000f554
mov rdi, rax
test rax, rax
je 0x18001694e
mov r8d, 0xd
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.180017e24
mov r8, qword [rax]
test r8, r8
je 0x180016949
mov rcx, rdi
call r8
test rax, rax
je 0x18001694e
mov dl, 1
mov rcx, rax
call fcn.18001214c
test al, al
je 0x18001694e
lea rdx, str.attacker
mov rcx, rbx
call fcn.18000fe90
lea rdx, str.userid
mov rcx, rbx
call fcn.18000fe90
jmp 0x18001694e
call fcn.18000f48c
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800177f4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
lea rbp, [rax - 0x57]
sub rsp, 0x90
mov rsi, r9
mov rbx, r8
mov rdi, rdx
call fcn.1800128a4
mov rdx, rbx
mov rcx, rax
call fcn.180012920
test rax, rax
jne 0x180017844
lea rdx, [rbp + 0x6f]
lea rcx, str._schemamgr__No_type_scope_found_for_.
call fcn.180002658
jmp 0x1800179a0
mov rdx, rsi
mov rcx, rax
call fcn.18001297c
mov rdx, rax
test rax, rax
jne 0x18001786b
lea r8, [rbp + 0x6f]
lea rdx, [rbp + 0x77]
lea rcx, str._schemamgr__No_binding_named__has_been_found_in_module_.
jmp 0x18001799b
mov r11d, 0x811c9dc5
mov r8d, r11d
mov rcx, qword [rbp + 0x7f]
cmp byte [rcx], 0
je 0x180017895
mov al, byte [rcx]
movzx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
inc rcx
mov al, byte [rcx]
test al, al
jne 0x18001787f
xor ecx, ecx
mov rbx, qword [rdx + 0x28]
test rbx, rbx
je 0x18001798c
movzx r10d, byte [rdx + 0x1c]
cmp ecx, r10d
jge 0x18001798c
mov rdx, qword [rbx]
mov r9d, r11d
jmp 0x1800178ca
movzx eax, al
xor eax, r9d
imul r9d, eax, 0x1000193
inc rdx
mov al, byte [rdx]
test al, al
jne 0x1800178ba
cmp r9d, r8d
je 0x1800178dd
inc ecx
add rbx, 0x20
jmp 0x1800178a9
call fcn.1800023c0
lea r9, [rbx + 0x10]
lea r8, [rbp + 0x7f]
lea rdx, [rbp + 0x77]
lea rcx, [rbp + 0xf]
call fcn.1800179bc
mov qword [rbp - 0x31], 3
mov qword [rbp - 0x29], rax
lea rax, str._schemamgr__::_offset_is_0x:x.
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], 0x26
movaps xmm0, xmmword [rbp - 0x31]
movdqa xmmword [rbp - 0x31], xmm0
movaps xmm1, xmmword [rbp - 0x21]
movdqa xmmword [rbp - 0x21], xmm1
lea r8, [rbp - 0x31]
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x11]
call fcn.1800028c8
nop
mov rdx, rax
call fcn.180052e30
nop
mov rdx, qword [rbp + 7]
cmp rdx, 0xf
jbe 0x180017981
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001797c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001797c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800579d0
mov eax, dword [rbx + 0x10]
mov dword [rdi], eax
mov byte [rdi + 4], 1
jmp 0x1800179a4
lea r8, [rbp + 0x77]
lea rdx, [rbp + 0x7f]
lea rcx, str._schemamgr__No_field_named__has_been_found_in_binding_.
call fcn.180002724
mov byte [rdi + 4], 0
mov rax, rdi
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001cd08
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xc0
mov rdi, rdx
mov rbp, rcx
mov rcx, r8
mov rax, 0xfffffffffffff000
and rcx, rax
mov rsi, r8
mov qword [rdx], rcx
mov rdx, r8
sub rdx, rcx
lea r9, [rdi + 0x10]
add rdx, 0x1004
mov r8d, 0x40
and rdx, rax
mov qword [rdi + 8], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18001cd88
mov r9, qword [rdi + 8]
lea rdx, str.__unprotect_memory__p__size_llu______p__size_llu__n
mov r8, qword [rdi]
mov rcx, rbp
mov qword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
call fcn.18001bea4
xor eax, eax
jmp 0x18001cdd5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [rsp + 0x40]
call fcn.18001c5a0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, qword [rdi + 8]
lea rdx, str.Failed_to_unprotect_memory__p__size_llu______p__size_llu__error_lu__s__
mov r8, qword [rdi]
mov rcx, rbp
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
call fcn.18001becc
mov eax, 9
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18001efe0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
not r8d
movzx eax, byte [rcx]
inc rcx
movzx r9d, r8b
xor r9, rax
shr r8d, 8
lea rax, [0x180084f80]
xor r8d, dword [rax + r9*4]
sub rdx, 1
jne 0x18001efe3
not r8d
mov eax, r8d
ret

Function at 0x18001f00c
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x18001f066
mov r11b, 0x23
lea rbx, [0x180084f80]
movzx edi, byte [r10]
dec rdx
inc r10
cmp dil, r11b
jne 0x18001f050
cmp rdx, 2
jb 0x18001f050
cmp byte [r10], r11b
jne 0x18001f050
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rdi
shr r9d, 8
xor r9d, dword [rbx + rcx*4]
test rdx, rdx
jne 0x18001f02e
jmp 0x18001f0a7
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x18001f0a7
mov r11b, 0x23
lea rbx, [0x180084f80]
cmp dl, r11b
jne 0x18001f08b
cmp byte [r10], r11b
jne 0x18001f08b
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rbx + rcx*4]
test dl, dl
jne 0x18001f079
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x180021d30
Capabilities:
Hash data with crc32

Disassembly:
movsxd rax, dword [rcx + 0x100]
mov r9, rdx
mov r8, qword [rcx + 0x108]
xor edx, edx
mov rcx, r9
mov r8d, dword [r8 + rax*4 - 4]
jmp fcn.18001f00c

Function at 0x180029d34
Capabilities:
Hash data with crc32

Disassembly:
mov rdx, rcx
mov rcx, qword [0x180097860]
mov rcx, qword [rcx + 0x12c0]
jmp fcn.180021d30
Function at 0x18003fa78
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, rdx
mov eax, 0x5e6ea9af
mul r8d
mov r11d, r8d
xor r9d, r9d
shr edx, 0xb
mov r10d, 1
imul eax, edx, 0x15b0
sub r11d, eax
test r8d, r8d
je 0x18003fb67
xor ecx, ecx
cmp r11d, 7
jbe 0x18003fb12
lea edx, [rcx + 7]
movzx eax, byte [rbx]
add ecx, 8
add r10d, eax
add edx, 8
movzx eax, byte [rbx + 1]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 2]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 3]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 4]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 5]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 6]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 7]
add r9d, r10d
add r10d, eax
add rbx, 8
add r9d, r10d
cmp edx, r11d
jb 0x18003fab4
cmp ecx, r11d
jae 0x18003fb30
mov eax, r11d
sub eax, ecx
mov ecx, eax
movzx eax, byte [rbx]
inc rbx
add r10d, eax
add r9d, r10d
sub rcx, 1
jne 0x18003fb1e
mov eax, 0x80078071
mul r10d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r10d, eax
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul ecx, edx, 0xffff000f
add r9d, ecx
sub r8d, r11d
mov r11d, 0x15b0
jne 0x18003faa9
mov rbx, qword [rsp + 8]
shl r9d, 0x10
lea eax, [r10 + r9]
ret
Function at 0x180041284
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
call fcn.180041260
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rbx + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1800412bd
and dword [rbx + 0x2c], eax
add rsp, 0x20
pop rbx
ret

Function at 0x18004150c
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret

Function at 0x180044694
Capabilities:
Hash data with crc32

Disassembly:
mov eax, edx
lea r8, str.SCROLLX
test eax, eax
lea rdx, str.SCROLLY
cmove rdx, r8
jmp fcn.180021d30

Function at 0x180050e98
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x180050edb
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
and qword [rsp + 0x28], 0
lea r8, [0x180050ef4]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180050ee9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180050ee9
test edx, edx
jne 0x180050ee9
test r8, r8
jne 0x180050ee9
call fcn.180052c9c
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x180051be0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
lea rax, str.void___cdecl_CInputHooks::Initialize_void_
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, str._prologue__
call fcn.180002658
lea rcx, [0x180098578]
add rsp, 0x28
jmp 0x180051df4
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
lea rax, str.void___cdecl_CWndProcHooks::Initialize_void_
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x10]
lea rcx, str._prologue__
call fcn.180002658
mov rdx, rbx
lea rcx, [0x180051d84]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbx]
test rax, rax
jne 0x180051e48
lea rcx, str._wndproc__EnumWindows___returned_nullptr_
call fcn.1800025ac
jmp 0x180051f04
mov qword [rbp + 0x10], rax
call fcn.1800023c0
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x30]
call fcn.180051fe8
mov qword [rbp - 0x50], 1
mov qword [rbp - 0x48], rax
lea rax, str._wndproc__CWndProcHooks::m_Window____
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 0x27
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm0
movaps xmm1, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm1
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.1800028c8
nop
mov rdx, rax
call fcn.180052e30
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x180051ee8
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180051ee3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180051ee3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800579d0
lea r8, [0x180051c50]
mov edx, 0xfffffffc
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov qword [0x180097ff0], rax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rbp
ret
Function at 0x180051df4
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
lea rax, str.void___cdecl_CInputHooks::Initialize_void_
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, str._prologue__
call fcn.180002658
lea rcx, [0x180098578]
add rsp, 0x28
jmp 0x180051df4
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
lea rax, str.void___cdecl_CWndProcHooks::Initialize_void_
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x10]
lea rcx, str._prologue__
call fcn.180002658
mov rdx, rbx
lea rcx, [0x180051d84]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbx]
test rax, rax
jne 0x180051e48
lea rcx, str._wndproc__EnumWindows___returned_nullptr_
call fcn.1800025ac
jmp 0x180051f04
mov qword [rbp + 0x10], rax
call fcn.1800023c0
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x30]
call fcn.180051fe8
mov qword [rbp - 0x50], 1
mov qword [rbp - 0x48], rax
lea rax, str._wndproc__CWndProcHooks::m_Window____
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 0x27
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm0
movaps xmm1, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm1
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.1800028c8
nop
mov rdx, rax
call fcn.180052e30
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x180051ee8
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180051ee3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180051ee3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800579d0
lea r8, [0x180051c50]
mov edx, 0xfffffffc
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov qword [0x180097ff0], rax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rbp
ret

Function at 0x180052d44
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
lea rax, str.void___cdecl_CInstance::FreeLibrary_void_
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
lea rcx, str._prologue__
call fcn.180002658
and qword [rsp + 0x28], 0
lea r9, [0x180000000]
and dword [rsp + 0x20], 0
lea r8, [0x180052db0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180052d9b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret

Function at 0x180052de8
Capabilities:
Set console window title

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_AllocConsole]
lea rcx, str.cs2_sdk_console
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea r8, [0x18008b028]
mov rcx, rbx
mov r9, rax
lea rdx, str.CONOUT_
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]