joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005b50
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180005b97
xor al, al
jmp 0x180005c39
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x180005bc1
xor al, al
jmp 0x180005c39
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x180005c31
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x180005c31
mov al, 1
jmp 0x180005c39
jmp 0x180005c37
xor al, al
add rsp, 0x78
ret

Function at 0x180005f40
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x18001faa0]
mov qword [rsp + 0x28], rax
jmp 0x180005f60
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180005f8f
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x180005f8d
call sub.KERNEL32.dll_GetLastError
jmp 0x180005f91
jmp 0x180005f52
xor eax, eax
add rsp, 0x38
ret
Function at 0x180006620
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x20], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x18001fab8], eax
je 0x18000664d
mov eax, 0x10dd
jmp 0x180006866
cmp dword [0x18001fabc], 0
je 0x180006661
mov eax, dword [0x18001fabc]
jmp 0x180006866
cmp qword [rsp + 0x78], 0
jne 0x180006673
mov eax, 0x57
jmp 0x180006866
cmp qword [rsp + 0x70], 0
jne 0x180006685
mov eax, 6
jmp 0x180006866
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x1800066b7
mov dword [rsp + 0x20], 6
mov eax, dword [rsp + 0x20]
mov dword [0x18001fabc], eax
mov rax, qword [rsp + 0x70]
mov qword [0x18001fac0], rax
mov eax, dword [rsp + 0x20]
jmp 0x180006866
mov ecx, 0x30
call fcn.18000840c
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x180006729
mov dword [rsp + 0x20], 8
mov eax, dword [rsp + 0x20]
mov dword [0x18001fabc], eax
cmp qword [rsp + 0x30], 0
je 0x180006714
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x50]
call fcn.180008404
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x70]
mov qword [0x18001fac0], rax
mov eax, dword [rsp + 0x20]
jmp 0x180006866
xor edx, edx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call fcn.1800065f0
mov qword [rsp + 0x38], rax
xor edx, edx
mov rcx, qword [rsp + 0x78]
call fcn.1800065f0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 0x3e]
mov dword [rsp + 0x24], eax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp dword [rsp + 0x24], 0
je 0x180006786
movsxd rax, dword [rsp + 0x24]
cmp rax, 0x1e
jbe 0x1800067a3
mov dword [rsp + 0x20], 9
cmp dword [0x18001fab0], 0
je 0x18000679e
jmp 0x1800066ea
jmp 0x1800066e0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x78]
cmp qword [rax + 0x50], rcx
je 0x1800067d0
mov dword [rsp + 0x20], 9
cmp dword [0x18001fab0], 0
je 0x1800067cb
jmp 0x1800066ea
jmp 0x1800066e0
mov dword [rsp + 0x28], 0
movsxd rax, dword [rsp + 0x24]
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x180006807
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x1800066e0
mov rax, qword [rsp + 0x30]
mov dword [rax + 8], 1
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x28]
mov dword [rax + 0x28], ecx
mov rax, qword [rsp + 0x30]
mov rcx, qword [0x18001fad0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
mov qword [0x18001fad0], rax
xor eax, eax
add rsp, 0x68
ret
Function at 0x180006870
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x18001fab8], eax
je 0x18000688b
mov eax, 0x10dd
jmp 0x1800069b0
mov rax, qword [0x18001fad0]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180006935
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x180006900
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x180006900
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.1800052a0
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.180008404
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x180006897
mov qword [0x18001fad0], 0
call fcn.180005d00
mov rax, qword [0x18001fac8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180006999
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
call fcn.180008404
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x180006951
mov qword [0x18001fac8], 0
mov dword [0x18001fab8], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x180006ee0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x18001fabc], 0
je 0x180006efd
mov eax, dword [0x18001fabc]
jmp 0x180006fc3
call sub.KERNEL32.dll_GetCurrentThread
cmp qword [rsp + 0x50], rax
jne 0x180006f10
xor eax, eax
jmp 0x180006fc3
mov ecx, 0x10
call fcn.18000840c
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x180006f7e
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x180006f63
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x38]
call fcn.180008404
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x18001fabc], eax
mov qword [0x18001fac0], 0
mov eax, dword [rsp + 0x20]
jmp 0x180006fc3
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x180006f98
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x180006f39
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x18001fac8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x18001fac8], rax
xor eax, eax
add rsp, 0x48
ret

Function at 0x180008fa0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x180000000], ax
jne 0x18000902b
movsxd rcx, dword [0x18000003c]
lea rdx, [0x180000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x18000902b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18000902b
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x180009027
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x180009021
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jae 0x180009021
test rdx, rdx
je 0x180009027
cmp dword [rdx + 0x24], 0
jge 0x18000901d
xor al, al
jmp 0x180009031
mov al, 1
jmp 0x180009031
add rdx, 0x28
jmp 0x180008ff3
xor al, al
jmp 0x180009031
xor al, al
jmp 0x180009031
add rsp, 0x18
ret
Function at 0x140005104
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140012e60], eax
call fcn.1400056f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012e60], 0
jne case.default.0x14000515a
mov ecx, 1
call fcn.1400056f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
sti
mov ebp, 0x5a567be4
cmp eax, 0x820547e3
out 0x2c, al
fnsave dword [r10 + 0x7c3ff93b]
hlt
adc ecx, dword [rbp - 0x73c62ddf]
loope 0x14001ac3d
xor esp, dword [rdi]
in eax, dx
or eax, 0x28ef714b
loop 0x14001acf9
mov bh, byte [rax - 0xa48e949]
enter 0x7bd2, 0xa
mov edi, 0x8940aaad
loop 0x14001ac3c
lodsd eax, dword [rsi]
stosb byte [rdi], al
mov edx, esp
xchg edi, eax
jae 0x14001ac9f
ja 0x14001acd5
pop rdx
invalid
jle 0x14001ad0c
std
jmp 0x14001ac82
in al, 0x49
jmp 0x14001acb7
invalid
mov ah, 0xd9
movabs byte [0xc6fd92fe912eea89], al
invalid
invalid
movabs rdi, 0x9737788b6585362c
fadd qword [rdi + 0x252233bd]
jg 0x14001acbc
push 0x7b
jle 0x14001ad27
sbb eax, 0x7a316927
cmpsd dword [rsi], dword [rdi]
xchg esp, eax
enter 0x14de, 0x68
invalid
jnp 0x14001acf3
jl 0x14001acef
invalid
Function at 0x180019fec
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
sub rsp, 0x118
mov rax, qword [0x1800d2070]
xor rax, rsp
mov qword [rsp + 0x100], rax
or r9d, 0xffffffff
mov dword [rsp + 0x28], 0x64
lea rax, [rsp + 0x30]
mov r8, rcx
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea edx, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
jmp 0x18001a066
mov rcx, qword [rax + 0x60]
lea r8, [rsp + 0x30]
sub r8, rcx
movzx edx, word [rcx]
movzx r9d, word [rcx + r8]
sub edx, r9d
jne 0x18001a05f
add rcx, 2
test r9d, r9d
jne 0x18001a049
test edx, edx
je 0x18001a087
mov rax, qword [rax]
cmp qword [rax + 0x30], 0
jne 0x18001a03d
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.180072690
add rsp, 0x118
ret
mov rax, qword [rax + 0x30]
jmp 0x18001a06f

Function at 0x18001a090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800d2070]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov dword [rbp - 0x30], 0x64616f4c
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x2c], 0x7262694c
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x28], 0x41797261
mov byte [rbp - 0x24], 0
mov dword [rbp - 0x20], 0x4e52454b
mov dword [rbp - 0x1c], 0x41424c45
mov dword [rbp - 0x18], 0x642e4553
mov word [rbp - 0x14], 0x6c6c
mov byte [rbp - 0x12], 0
call fcn.18001a110
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180072690
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x18001a150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x1800d2070]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor r12d, r12d
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x18001a2c8
movsxd rax, dword [rcx + 0x3c]
mov r9d, dword [rax + rcx + 0x88]
mov r11d, dword [rax + rcx + 0x8c]
lea r8, [rcx + r9]
test r11d, r11d
je 0x18001a2c8
lea r13d, [r12 + 1]
cmp rdx, 0xffff
ja 0x18001a277
mov ecx, dword [r8 + 0x1c]
movzx eax, bp
sub ax, word [r8 + 0x10]
add rcx, rbx
add ax, r13w
movzx edx, ax
mov edi, dword [rcx + rdx*4]
cmp edi, r9d
jb 0x18001a277
lea eax, [r9 + r11]
cmp edi, eax
jae 0x18001a277
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800754b0
lea rdx, [rbx + rdi]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r12b
jne 0x18001a206
test r8, r8
je 0x18001a2c8
lea rcx, [rsp + 0x20]
call fcn.180074e00
mov edx, 0x2e
lea rcx, [rsp + 0x20]
call fcn.180074d44
lea rdi, [rax + r13]
mov byte [rax], r12b
cmp byte [rdi], 0x23
jne 0x18001a249
lea rcx, [rdi + 1]
call fcn.18007ffb4
movzx edi, ax
lea rcx, [rsp + 0x20]
call fcn.18001a090
mov rsi, rax
cmp rax, rbx
jne 0x18001a26a
mov rdx, rbp
mov rcx, rdi
call fcn.18007f048
test eax, eax
je 0x18001a2c8
mov rdx, rdi
mov rcx, rsi
call fcn.18001a150
jmp 0x18001a2ca
mov ecx, dword [r8 + 0x18]
mov edi, r12d
mov r15d, dword [r8 + 0x20]
sub ecx, r13d
lea r10d, [rdi + rcx]
mov rsi, rbp
shr r10d, 1
lea rax, [r15 + r10*4]
mov edx, dword [rax + rbx]
add rdx, rbx
sub rsi, rdx
mov al, byte [rdx]
cmp al, byte [rdx + rsi]
jne 0x18001a2af
add rdx, r13
test al, al
jne 0x18001a29c
mov eax, r12d
jmp 0x18001a2b4
sbb eax, eax
or eax, r13d
test eax, eax
jns 0x18001a2be
lea edi, [r10 + 1]
jmp 0x18001a2c4
jle 0x18001a2f5
lea ecx, [r10 - 1]
cmp edi, ecx
jbe 0x18001a285
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180072690
mov rbx, qword [rsp + 0x190]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [r8 + 0x24]
add rcx, rbx
cmp word [rcx + r10*2], r12w
je 0x18001a2c8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r8 + 0x1c]
add rcx, rbx
mov edi, dword [rcx + rdx*4]
cmp edi, r9d
jb 0x18001a347
lea eax, [r9 + r11]
cmp edi, eax
jae 0x18001a347
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800754b0
lea rdx, [rbx + rdi]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r12b
jne 0x18001a339
jmp 0x18001a20f
lea rax, [rbx + rdi]
jmp 0x18001a2ca
Function at 0x18001c794
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800d2070]
xor rax, rsp
mov qword [rbp - 8], rax
mov rcx, qword [0x1800ed810]
lea rdx, [rbp - 0x28]
mov rdi, qword [0x1800ed1b0]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp - 0x20]
lea rcx, [rbp - 0x10]
sub eax, dword [rbp - 0x28]
movd xmm1, eax
mov eax, dword [rbp - 0x1c]
sub eax, dword [rbp - 0x24]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x10], xmm1
movss dword [rdi + 0x14], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp - 0x10]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [0x1800ed818]
cvtsi2ss xmm0, qword [0x1800ed820]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x18], xmm1
mov qword [0x1800ed818], rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov ecx, 0x10
mov byte [rdi + 0x148], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, bl
mov byte [rdi + 0x149], al
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, qword [0x1800ed1b0]
shr eax, 0xf
and al, bl
mov byte [rdi + 0x14b], 0
mov byte [rdi + 0x14a], al
cmp byte [rcx + 0x3a3], 0
lea rbx, [rcx + 0x130]
je 0x18001c8bd
cvttss2si eax, dword [rbx]
lea rdx, [rbp - 0x18]
mov dword [rbp - 0x18], eax
cvttss2si eax, dword [rcx + 0x134]
mov rcx, qword [0x1800ed810]
mov dword [rbp - 0x14], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x14]
mov ecx, dword [rbp - 0x18]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, 0xff7fffff
mov dword [rbx], eax
mov dword [rbx + 4], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x18001c927
mov rdx, qword [0x1800ed810]
cmp rax, rdx
je 0x18001c8eb
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x18001c927
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x18001c927
mov rcx, qword [0x1800ed810]
lea rdx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x18001c927
movd xmm0, dword [rbp - 0x30]
movd xmm1, dword [rbp - 0x2c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x18001c935
or eax, 0xffffffff
jmp 0x18001c942
mov rax, qword [0x1800ed1b0]
mov eax, dword [rax + 0x1fb8]
cmp dword [0x1800ea608], eax
je 0x18001c955
mov dword [0x1800ea608], eax
call fcn.18001c738
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180072690
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x18001e014
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x18001e06e
mov r11b, 0x23
lea rdi, [0x1800bacd0]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x18001e058
cmp rdx, 2
jb 0x18001e058
cmp byte [r10], r11b
jne 0x18001e058
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x18001e036
jmp 0x18001e0af
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x18001e0af
mov r11b, 0x23
lea rdi, [0x1800bacd0]
cmp dl, r11b
jne 0x18001e093
cmp byte [r10], r11b
jne 0x18001e093
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x18001e081
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x18001e1e4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x18001e204
and qword [r8], 0
lea rdx, [0x1800bfb10]
call fcn.18001e0c0
mov rbx, rax
test rax, rax
je 0x18001e2eb
mov rcx, rax
call fcn.180080684
mov ebp, eax
cmp eax, 0xffffffff
je 0x18001e2e3
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.180080fa8
test eax, eax
jne 0x18001e2e3
mov rcx, rbx
call fcn.180080684
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18001e2e3
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call fcn.180080fa8
test eax, eax
jne 0x18001e2e3
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x18001e2e3
mov rax, qword [0x1800ed1b0]
test rax, rax
je 0x18001e285
inc dword [rax + 0x3bc]
mov rcx, rbp
call fcn.180087358
mov rdi, rax
test rax, rax
je 0x18001e2e3
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call fcn.180081dd0
mov rcx, rbx
cmp rax, rbp
je 0x18001e2d1
call fcn.180080c28
mov rax, qword [0x1800ed1b0]
test rax, rax
je 0x18001e2c7
dec dword [rax + 0x3bc]
mov rcx, rdi
call fcn.18007ef5c
jmp 0x18001e2eb
call fcn.180080c28
test rsi, rsi
je 0x18001e2de
mov qword [rsi], rbp
mov rax, rdi
jmp 0x18001e2ed
mov rcx, rbx
call fcn.180080c28
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18001fe0c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x28
movsxd rdx, dword [rcx + 0xc0]
mov r9d, 4
mov rax, qword [rcx + 0xc8]
mov r8d, dword [rax + rdx*4 - 4]
lea rdx, [rsp + 0x38]
not r8d
movzx eax, byte [rdx]
inc rdx
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x1800bacd0]
xor r8d, dword [rax + rcx*4]
sub r9, 1
jne 0x18001fe35
not r8d
mov ecx, r8d
call fcn.180020020
mov eax, r8d
add rsp, 0x28
ret
Function at 0x18001fe6c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1800d2070]
xor rax, rsp
mov qword [rsp + 0x30], rax
movss xmm0, dword [rdx]
mov r8, rcx
subss xmm0, dword [rcx + 0x10]
movss xmm1, dword [rdx + 8]
mov r9d, 0x10
subss xmm1, dword [rcx + 0x10]
cvttss2si eax, xmm0
movss xmm0, dword [rdx + 4]
subss xmm0, dword [rcx + 0x14]
mov dword [rsp + 0x20], eax
cvttss2si eax, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm0, dword [rcx + 0x14]
movsxd rcx, dword [rcx + 0xc0]
mov dword [rsp + 0x24], eax
cvttss2si eax, xmm1
mov dword [rsp + 0x28], eax
cvttss2si eax, xmm0
mov dword [rsp + 0x2c], eax
mov rax, qword [r8 + 0xc8]
lea r8, [rsp + 0x20]
mov edx, dword [rax + rcx*4 - 4]
not edx
movzx eax, byte [r8]
inc r8
movzx ecx, dl
xor rcx, rax
shr edx, 8
lea rax, [0x1800bacd0]
xor edx, dword [rax + rcx*4]
sub r9, 1
jne 0x18001fee8
not edx
mov ecx, edx
call fcn.180020020
mov eax, edx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180072690
add rsp, 0x48
ret
Function at 0x180027e40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1800d2070]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [0x1800ed1b0]
mov r10d, 8
mov qword [rsp + 0x20], rcx
mov r9, qword [rax + 0x1aa0]
movsxd rcx, dword [r9 + 0xc0]
mov rax, qword [r9 + 0xc8]
mov r8d, dword [rax + rcx*4 - 4]
lea rcx, [rsp + 0x20]
not r8d
movzx eax, byte [rcx]
inc rcx
movzx edx, r8b
xor rdx, rax
shr r8d, 8
lea rax, [0x1800bacd0]
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x180027e87
not r8d
lea rdx, [rsp + 0x20]
lea rcx, [r9 + 0xc0]
mov dword [rsp + 0x20], r8d
call fcn.18002e260
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180072690
add rsp, 0x38
ret

Function at 0x180027ed4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1800d2070]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [0x1800ed1b0]
mov r10d, 4
mov dword [rsp + 0x20], ecx
mov r9, qword [rax + 0x1aa0]
movsxd rcx, dword [r9 + 0xc0]
mov rax, qword [r9 + 0xc8]
mov r8d, dword [rax + rcx*4 - 4]
lea rcx, [rsp + 0x20]
not r8d
movzx eax, byte [rcx]
inc rcx
movzx edx, r8b
xor rdx, rax
shr r8d, 8
lea rax, [0x1800bacd0]
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x180027f1a
not r8d
lea rdx, [rsp + 0x20]
lea rcx, [r9 + 0xc0]
mov dword [rsp + 0x20], r8d
call fcn.18002e260
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180072690
add rsp, 0x38
ret