joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18011ba80
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x18025ed68]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.1800b0f40
mov rcx, qword [0x18026a0e8]
lea rdx, [rsp + 0x38]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rsp + 0x40]
sub ecx, dword [rsp + 0x38]
movd xmm1, ecx
mov ecx, dword [rsp + 0x44]
sub ecx, dword [rsp + 0x3c]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rsp + 0x30]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
xorps xmm1, xmm1
sub rax, qword [0x18026a0f0]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x18026a0f8]
mov ecx, reloc.WS2_32.dll_recvfrom
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rsp + 0x30]
mov qword [0x18026a0f0], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, reloc.WS2_32.dll_recv
and al, 1
mov byte [rdi + 0x140], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, send
and al, 1
mov byte [rdi + 0x141], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x143], 0
mov byte [rdi + 0x142], al
call fcn.1800b0f40
mov rbx, rax
cmp byte [rax + 0x39b], 0
je 0x180110cad
cvttss2si ecx, dword [rax + 0x128]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], ecx
cvttss2si ecx, dword [rax + 0x12c]
mov dword [rsp + 0x24], ecx
mov rcx, qword [0x18026a0e8]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx + 0x128], 0xff7fffff
mov dword [rbx + 0x12c], 0xff7fffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x180110d2c
mov rdx, qword [0x18026a0e8]
cmp rax, rdx
je 0x180110ce5
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x180110d2c
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x180110d2c
mov rcx, qword [0x18026a0e8]
lea rdx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x180110d2c
movd xmm0, dword [rsp + 0x28]
movd xmm1, dword [rsp + 0x2c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0x128], xmm0
movss dword [rbx + 0x12c], xmm1
cmp byte [rdi + 0xc0], 0
je 0x180110d3c
mov eax, 0xffffffff
jmp 0x180110d41
call fcn.1800ba760
cmp dword [reloc.WS2_32.dll_htons], eax
je 0x180110d54
mov dword [reloc.WS2_32.dll_htons], eax
call fcn.1801111a0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18015d5d0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x29], 0
mov rdi, rdx
mov rbx, rcx
jne 0x18011babf
mov rcx, rdx
call fcn.180110a40
lea r8, [0x18011b710]
mov qword [rbx + 0x30], rdi
mov edx, 0xfffffffc
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov qword [rbx + 0x38], rax
mov byte [rbx + 0x29], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180110b80
Function at 0x1801609d0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1801609e3
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.180160fe4
lea rdx, [0x1802296c8]
lea rcx, [rsp + 0x20]
call fcn.18017a840
int3

Function at 0x18016b170
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x180270ef8]
xor edx, edx
jmp fcn.1801609d0

Function at 0x18016bae4
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x180270ef8]
jmp fcn.1801609d0

Function at 0x180177278
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x180177334]
mov r9, qword [r9 + 8]
jmp fcn.180168b88

Function at 0x18017730c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x180177344]
mov r9, qword [r9 + 8]
jmp fcn.180168b88

Function at 0x18019fffc
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1801a001c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180184720
or eax, 0xffffffff
jmp 0x1801a001e
xor eax, eax
add rsp, 0x28
ret
Function at 0x18001eb10
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1800c33b0]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov eax, 8
imul rax, rax, 0
lea rcx, [0x1800c33e0]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x60], 0x48
mov byte [rsp + 0x61], 0xb8
mov byte [rsp + 0x62], 0x9f
mov byte [rsp + 0x63], __WSAFDIsSet
mov byte [rsp + 0x64], 0x5f
mov byte [rsp + 0x65], 0x48
mov byte [rsp + 0x66], 0x26
mov byte [rsp + 0x67], 0xb3
mov byte [rsp + 0x68], 0xbb
mov byte [rsp + 0x69], 0x23
mov byte [rsp + 0x70], 0x48
mov byte [rsp + 0x71], 0xb8
mov byte [rsp + 0x72], WSAGetLastError
mov byte [rsp + 0x73], 0xe4
mov byte [rsp + 0x74], 0x24
mov byte [rsp + 0x75], 0x7e
mov byte [rsp + 0x76], 0x8d
mov byte [rsp + 0x77], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x78], 0x33
mov byte [rsp + 0x79], 0xc9
movabs rax, 0xc8144be069ab930e
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x20], 0
mov r8d, 0xa
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18001ec11
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
jmp 0x18001ebe9
mov r8d, 0xa
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18001ec39
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
jmp 0x18001ec11
mov rax, qword [rsp + 0x28]
add rax, 0x11
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], 0x40
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x30]
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x34]
mov edx, eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
jmp 0x18001eca7
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x48], rax
je 0x18001ece9
mov eax, dword [rsp + 0x20]
movzx eax, byte [rsp + rax + 0x80]
mov rcx, qword [rsp + 0x48]
movzx ecx, byte [rcx]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x48]
mov byte [rcx], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 7
mov dword [rsp + 0x20], eax
jmp 0x18001ec9a
mov eax, dword [rsp + 0x30]
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x38]
mov edx, eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180084a40
add rsp, 0x98
ret
Function at 0x140001040
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov edx, 0x47
lea rcx, [entry0]
mov al, byte [rcx + rdx]
xor al, 0x98
add al, 0xe7
xor al, 0xa6
mov byte [rcx + rdx], al
inc rdx
cmp rdx, 0x2d9
jl 0x140001068
lahf
scasd eax, dword [rdi]
cli
jbe 0x1400010f9
popfq
jl 0x140001090
adc eax, 0x4b86ab90
invalid
adc eax, edi
sbb rax, qword [rdi - 0x65]
sar byte [rdx + rcx + 0x5a], 1
xchg edx, eax
adc bl, byte fs:[rdi + 0x44c264d0]
lahf
fisub word [rbx]
add al, 0x37
invalid
Function at 0x180023ac8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180023af8
xor eax, eax
jmp 0x180023bbb
mov rbp, rbx
cmp word [rax], si
je 0x180023b1d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180023b04
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180023b00
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800239e8
movsxd r14, eax
test eax, eax
jne 0x180023b5b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180023af1
mov rcx, r14
call fcn.180021c74
mov rdi, rax
test rax, rax
jne 0x180023b74
xor ecx, ecx
call fcn.180021fe0
jmp 0x180023b50
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800239e8
test eax, eax
jne 0x180023ba5
mov rcx, rdi
call fcn.180021fe0
jmp 0x180023baf
xor ecx, ecx
call fcn.180021fe0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180029090
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800290b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800290b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180001a10
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1800e2040]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [0x1801ce410], 0
jne 0x180001a38
call fcn.18002c580
mov rcx, qword [0x1801ce448]
lea rdx, [rsp + 0x28]
mov rdi, qword [0x1801ce360]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x40]
sub eax, dword [rsp + 0x28]
movd xmm1, eax
mov eax, dword [rsp + 0x34]
sub eax, dword [rsp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x10], xmm1
movss dword [rdi + 0x14], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x40]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [0x1801ce450]
cvtsi2ss xmm0, qword [0x1801ce458]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x18], xmm1
mov qword [0x1801ce450], rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rdi + 0x148], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rdi + 0x149], al
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, qword [0x1801ce360]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x14b], 0
mov byte [rdi + 0x14a], al
cmp byte [rcx + 0x3a3], 0
lea rbx, [rcx + 0x130]
je 0x180001b4b
cvttss2si eax, dword [rbx]
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], eax
cvttss2si eax, dword [rcx + 0x134]
mov rcx, qword [0x1801ce448]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx], 0xff7fffff
mov dword [rbx + 4], 0xff7fffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x180001bbc
mov rdx, qword [0x1801ce448]
cmp rax, rdx
je 0x180001b7c
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x180001bbc
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x180001bbc
mov rcx, qword [0x1801ce448]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x180001bbc
movd xmm0, dword [rsp + 0x20]
movd xmm1, dword [rsp + 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x180001bcc
mov eax, 0xffffffff
jmp 0x180001bd9
mov rax, qword [0x1801ce360]
mov eax, dword [rax + 0x1e90]
cmp dword [0x1801cbc28], eax
je 0x180001bec
mov dword [0x1801cbc28], eax
call fcn.18002c9e0
call fcn.18000e2e0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180047000
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180001fa0
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180002096
mov edx, 0x1f4
mov qword [rsp + 0x40], rbx
mov ecx, edx
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_Beep]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002057
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002057
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180002052
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180002030
cmp r8d, 0x8fb39146
je 0x18000205c
test r9d, r9d
jne 0x180002010
mov rax, qword [rax]
jmp 0x180001fe0
mov ecx, dword [rbx + 0x24]
lea r8, [0x180001e90]
add rcx, r10
movzx edx, word [rcx + r9*2]
xor r9d, r9d
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
mov qword [rsp + 0x28], rcx
add rax, r10
xor edx, edx
mov dword [rsp + 0x20], ecx
call rax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x38
ret
Function at 0x1800051c0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x48
mov ecx, dword [0x1801ce358]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x180005245
mov ecx, dword [0x1801ce3c8]
lea rdx, [0x1801ce3b8]
xorps xmm0, xmm0
movups xmmword [0x1801ce3b8], xmm0
call qword [sym.imp.XINPUT1_4.dll_Ordinal_2]
test eax, eax
jne 0x180005239
movzx eax, word [0x1801ce3bc]
mov ecx, 0x5806
test cx, ax
jne 0x180005245
mov ecx, 0x5816
test cx, ax
je 0x180005239
mov ecx, dword [0x1801ce3c8]
lea rdx, [0x1801ce3b8]
xorps xmm0, xmm0
movups xmmword [0x1801ce3b8], xmm0
call qword [sym.imp.XINPUT1_4.dll_Ordinal_2]
test byte [0x1801ce3bf], 7
jne 0x180005245
mov byte [0x1801ce2d6], 0
add rsp, 0x48
ret
movss xmm0, dword [0x1800e30a0]
ucomiss xmm0, dword [0x1800d2f70]
jp 0x18000525c
je 0x1800053a1
mov rcx, qword [0x1801ce348]
xorps xmm3, xmm3
movaps xmmword [rsp + 0x30], xmm6
xorps xmm4, xmm4
movss xmm6, dword [0x1801ce3b0]
xorps xmm2, xmm2
mov eax, dword [rcx + 8]
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov eax, dword [rcx + 0xc]
mov ecx, dword [0x1800e30a4]
cdq
sub eax, edx
sar eax, 1
ucomiss xmm6, xmm3
mov edx, eax
jp 0x18000529b
je 0x1800052fe
movd xmm5, r8d
cvtdq2ps xmm5, xmm5
comiss xmm6, xmm5
jbe 0x1800052db
movaps xmm4, xmm5
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
lea eax, [r8 + r8]
subss xmm4, xmm6
movaps xmm1, xmm5
xorps xmm4, xmmword [0x1800d3110]
divss xmm4, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
addss xmm1, xmm4
comiss xmm1, xmm0
jbe 0x1800052db
xorps xmm4, xmm4
comiss xmm5, xmm6
jbe 0x1800052fe
movd xmm0, ecx
movaps xmm4, xmm6
subss xmm4, xmm5
cvtdq2ps xmm0, xmm0
divss xmm4, xmm0
addss xmm5, xmm4
comiss xmm3, xmm5
jbe 0x1800052fe
xorps xmm4, xmm4
movss xmm6, dword [0x1801ce3b4]
ucomiss xmm6, xmm3
jp 0x18000530d
je 0x18000536e
movd xmm5, edx
cvtdq2ps xmm5, xmm5
comiss xmm6, xmm5
jbe 0x18000534b
movaps xmm2, xmm5
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
lea eax, [rdx + rdx]
subss xmm2, xmm6
movaps xmm1, xmm5
xorps xmm2, xmmword [0x1800d3110]
divss xmm2, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
addss xmm1, xmm2
comiss xmm1, xmm0
jbe 0x18000534b
xorps xmm2, xmm2
comiss xmm5, xmm6
jbe 0x18000536e
movd xmm0, ecx
movaps xmm2, xmm6
subss xmm2, xmm5
cvtdq2ps xmm0, xmm0
divss xmm2, xmm0
addss xmm5, xmm2
comiss xmm3, xmm5
jbe 0x18000536e
xorps xmm2, xmm2
ucomiss xmm4, xmm3
movaps xmm6, xmmword [rsp + 0x30]
jp 0x18000537a
je 0x1800053a1
ucomiss xmm2, xmm3
jp 0x180005381
je 0x1800053a1
xor r9d, r9d
mov qword [rsp + 0x20], 0
cvttss2si r8, xmm2
lea ecx, [r9 + 1]
cvttss2si rdx, xmm4
call qword [sym.imp.USER32.dll_mouse_event]
add rsp, 0x48
ret
Function at 0x18000a600
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18000a65d
lea rbx, [0x1800d13d0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18000a644
cmp r10, 2
jb 0x18000a644
cmp byte [r9], r8b
jne 0x18000a644
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18000a620
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18000a69f
lea rbx, [0x1800d13d0]
cmp r8b, 0x23
jne 0x18000a683
cmp byte [r9], r8b
jne 0x18000a683
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18000a670
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x18000a880
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18000a89a
mov qword [r8], 0
lea rdx, [0x1800d2608]
call fcn.18000a6b0
mov rbx, rax
test rax, rax
jne 0x18000a8ba
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.18006a060
mov esi, eax
cmp eax, 0xffffffff
je 0x18000a988
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.18006b8f0
test eax, eax
jne 0x18000a988
mov rcx, rbx
call fcn.18006a060
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18000a988
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.18006b8f0
test eax, eax
jne 0x18000a988
cmp rdi, 0xffffffffffffffff
je 0x18000a988
mov rax, qword [0x1801ce360]
test rax, rax
je 0x18000a92a
inc dword [rax + 0x3bc]
mov rcx, rdi
call fcn.180076c70
mov rsi, rax
test rax, rax
je 0x18000a988
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.18006d9d0
mov rcx, rbx
cmp rax, rdi
je 0x18000a976
call fcn.18005a3b0
mov rax, qword [0x1801ce360]
test rax, rax
je 0x18000a96c
dec dword [rax + 0x3bc]
mov rcx, rsi
call fcn.180068a10
jmp 0x18000a990
call fcn.18005a3b0
test r14, r14
je 0x18000a983
mov qword [r14], rdi
mov rax, rsi
jmp 0x18000a992
mov rcx, rbx
call fcn.18005a3b0
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x18000ed60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
xor eax, eax
lea r8, [0x1800d252d]
mov dword [rsp + 0x2c], eax
lea r11, [0x1800d13d0]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, str.Window
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov edx, r10d
mov r9b, 0x57
nop
cmp r9b, 0x23
jne 0x18000edb3
cmp byte [r8], r9b
jne 0x18000edb3
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x18000eda0
mov ecx, dword [rbx + 0x2f14]
lea rax, [0x18001b5e0]
mov edi, dword [rbx + 0x2f10]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x18001b690]
mov qword [rsp + 0x38], rax
lea rax, [0x18001b770]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x18000eeb3
inc edi
test ecx, ecx
je 0x18000ee1f
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x18000ee24
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x18000eeb3
mov rax, qword [0x1801ce360]
mov qword [rsp + 0x60], rsi
test rax, rax
je 0x18000ee48
inc dword [rax + 0x3bc]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call fcn.180076c70
mov rdx, qword [rbx + 0x2f18]
mov rsi, rax
test rdx, rdx
je 0x18000eea1
movsxd rcx, dword [rbx + 0x2f10]
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call fcn.1800b46a0
mov rcx, qword [rbx + 0x2f18]
test rcx, rcx
je 0x18000ee9c
mov rax, qword [0x1801ce360]
test rax, rax
je 0x18000ee9c
dec dword [rax + 0x3bc]
call fcn.180068a10
mov qword [rbx + 0x2f18], rsi
mov rsi, qword [rsp + 0x60]
mov dword [rbx + 0x2f14], edi
movsxd rax, dword [rbx + 0x2f10]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2f18]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2f10]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x180010380
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x1800103d0
lea r11, [0x1800d13d0]
nop dword [rax]
cmp r9b, 0x23
jne 0x1800103b3
cmp byte [r8], r9b
jne 0x1800103b3
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1800103a0
mov rcx, qword [0x1801ce360]
not eax
movsxd rdx, dword [rcx + 0x1a00]
mov r9, qword [rcx + 0x1a08]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x180010431
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x180010429
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18001042c
mov rdx, r8
test rdx, rdx
jne 0x180010400
cmp r9, r10
je 0x180010440
cmp dword [r9], eax
jne 0x180010440
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret