joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000ce70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
mov r8d, dword [0x180099544]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov r8d, dword [rcx + rax]
cmp dword [0x180099854], r8d
jle 0x18000cef2
lea rcx, [0x180099854]
call fcn.180064738
cmp dword [0x180099854], 0xffffffff
jne 0x18000cef2
mov edx, 2
lea rsi, [0x180099ae0]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180066e80]
call fcn.180064678
lea rcx, [0x180099854]
call fcn.1800646cc
jmp 0x18000cef9
lea rsi, [0x180099ae0]
mov qword [rsp + 0x70], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000cf17
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x180099b2c], 0x7fffffff
jne 0x18000cf39
mov dword [0x180099b2c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000cf4a
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000cf83
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000cf70
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010280
cmp qword [rax + 8], 0
je 0x18000cfae
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000cfdf
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000cfbb
mov rdx, qword [rdi]
mov rcx, qword [0x180099910]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000d027
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
mov rcx, r14
call rdx
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x18000d030
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x18000d040
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov edx, dword [0x180099544]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x180099b30], edx
jle 0x18000d0c3
lea rcx, [0x180099b30]
call fcn.180064738
cmp dword [0x180099b30], 0xffffffff
jne 0x18000d0c3
mov edx, 2
lea rsi, [0x180099b40]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180066e70]
call fcn.180064678
lea rcx, [0x180099b30]
call fcn.1800646cc
jmp 0x18000d0ca
lea rsi, [0x180099b40]
mov qword [rsp + 0x60], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000d0e8
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x180099b8c], 0x7fffffff
jne 0x18000d10a
mov dword [0x180099b8c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000d11b
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000d153
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000d140
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010280
cmp qword [rax + 8], 0
je 0x18000d17e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000d1af
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000d18b
mov rdx, qword [rdi]
mov rcx, qword [0x180099910]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000d203
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
lea rdx, [0x180098210]
lea rcx, [0x1800083d0]
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x18000d20c
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18000d220
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
mov r8d, dword [0x180099544]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov r8d, dword [rcx + rax]
cmp dword [0x180099918], r8d
jle 0x18000d2a2
lea rcx, [0x180099918]
call fcn.180064738
cmp dword [0x180099918], 0xffffffff
jne 0x18000d2a2
mov edx, 2
lea rsi, [0x1800999e0]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180066e60]
call fcn.180064678
lea rcx, [0x180099918]
call fcn.1800646cc
jmp 0x18000d2a9
lea rsi, [0x1800999e0]
mov qword [rsp + 0x70], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000d2c7
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x180099a2c], 0x7fffffff
jne 0x18000d2e9
mov dword [0x180099a2c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000d2fa
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000d333
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000d320
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010280
cmp qword [rax + 8], 0
je 0x18000d35e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000d38f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000d36b
mov rdx, qword [rdi]
mov rcx, qword [0x180099910]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000d3d5
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
mov rcx, r14
call rdx
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, ebx
jmp 0x18000d3de
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x18000d3f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x180099544]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x180099904], r9d
jle 0x18000d47b
lea rcx, [0x180099904]
call fcn.180064738
cmp dword [0x180099904], 0xffffffff
jne 0x18000d47b
mov edx, 2
lea rsi, [0x180099920]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180066e50]
call fcn.180064678
lea rcx, [0x180099904]
call fcn.1800646cc
jmp 0x18000d482
lea rsi, [0x180099920]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000d4a0
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x18009996c], 0x7fffffff
jne 0x18000d4c2
mov dword [0x18009996c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000d4d3
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000d503
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000d4f0
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010280
cmp qword [rax + 8], 0
je 0x18000d52e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000d55f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000d53b
mov rdx, qword [rdi]
mov rcx, qword [0x180099910]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000d5ab
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov edx, r14d
mov rcx, r15
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x18000d5b4
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18000d5d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x180099544]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x180099974], r9d
jle 0x18000d65b
lea rcx, [0x180099974]
call fcn.180064738
cmp dword [0x180099974], 0xffffffff
jne 0x18000d65b
mov edx, 2
lea rsi, [0x1800998b0]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180066e40]
call fcn.180064678
lea rcx, [0x180099974]
call fcn.1800646cc
jmp 0x18000d662
lea rsi, [0x1800998b0]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000d680
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x1800998fc], 0x7fffffff
jne 0x18000d6a2
mov dword [0x1800998fc], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000d6b3
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000d6e3
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000d6d0
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010280
cmp qword [rax + 8], 0
je 0x18000d70e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000d73f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000d71b
mov rdx, qword [rdi]
mov rcx, qword [0x180099910]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000d78b
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x18000d794
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18000d7b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
mov r8d, dword [0x180099544]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov r8d, dword [rcx + rax]
cmp dword [0x180099900], r8d
jle 0x18000d832
lea rcx, [0x180099900]
call fcn.180064738
cmp dword [0x180099900], 0xffffffff
jne 0x18000d832
mov edx, 2
lea rsi, [0x180099a90]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180066e30]
call fcn.180064678
lea rcx, [0x180099900]
call fcn.1800646cc
jmp 0x18000d839
lea rsi, [0x180099a90]
mov qword [rsp + 0x70], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000d857
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x180099adc], 0x7fffffff
jne 0x18000d879
mov dword [0x180099adc], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000d88a
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000d8c3
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000d8b0
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010280
cmp qword [rax + 8], 0
je 0x18000d8ee
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000d91f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000d8fb
mov rdx, qword [rdi]
mov rcx, qword [0x180099910]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000d965
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
mov rcx, r14
call rdx
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, ebx
jmp 0x18000d96e
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x18000d980
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x180099544]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x180099850], r9d
jle 0x18000da0b
lea rcx, [0x180099850]
call fcn.180064738
cmp dword [0x180099850], 0xffffffff
jne 0x18000da0b
mov edx, 2
lea rsi, [0x180099be0]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180066e20]
call fcn.180064678
lea rcx, [0x180099850]
call fcn.1800646cc
jmp 0x18000da12
lea rsi, [0x180099be0]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000da30
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x180099c2c], 0x7fffffff
jne 0x18000da52
mov dword [0x180099c2c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000da63
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000da93
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000da80
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010280
cmp qword [rax + 8], 0
je 0x18000dabe
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000daef
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000dacb
mov rdx, qword [rdi]
mov rcx, qword [0x180099910]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000db39
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, ebx
jmp 0x18000db42
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18000db60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x180099544]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x18009991c], r9d
jle 0x18000dbeb
lea rcx, [0x18009991c]
call fcn.180064738
cmp dword [0x18009991c], 0xffffffff
jne 0x18000dbeb
mov edx, 2
lea rsi, [0x180099a40]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180066e10]
call fcn.180064678
lea rcx, [0x18009991c]
call fcn.1800646cc
jmp 0x18000dbf2
lea rsi, [0x180099a40]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000dc10
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x180099a8c], 0x7fffffff
jne 0x18000dc32
mov dword [0x180099a8c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000dc43
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000dc73
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000dc60
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010280
cmp qword [rax + 8], 0
je 0x18000dc9e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000dccf
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000dcab
mov rdx, qword [rdi]
mov rcx, qword [0x180099910]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000dd1b
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov edx, r14d
mov rcx, r15
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x18000dd24
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18000dd40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x180099544]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x180099970], r9d
jle 0x18000ddcb
lea rcx, [0x180099970]
call fcn.180064738
cmp dword [0x180099970], 0xffffffff
jne 0x18000ddcb
mov edx, 2
lea rsi, [0x180099800]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180066e00]
call fcn.180064678
lea rcx, [0x180099970]
call fcn.1800646cc
jmp 0x18000ddd2
lea rsi, [0x180099800]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000ddf0
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x18009984c], 0x7fffffff
jne 0x18000de12
mov dword [0x18009984c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000de23
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000de53
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000de40
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010280
cmp qword [rax + 8], 0
je 0x18000de7e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000deaf
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000de8b
mov rdx, qword [rdi]
mov rcx, qword [0x180099910]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000def6
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000e890
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
nop
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
jmp 0x18000deff
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180015ed0
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x180099544]
mov rax, qword gs:[0x58]
mov rdi, qword [rdx]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x180099cec], ecx
jle 0x180015f32
lea rcx, [0x180099cec]
call fcn.180064738
cmp dword [0x180099cec], 0xffffffff
jne 0x180015f32
lea rcx, [0x180066ed0]
call fcn.180064678
lea rcx, [0x180099cec]
call fcn.1800646cc
mov rax, qword [0x180099630]
xor esi, esi
test rax, rax
je 0x180015f49
mov rcx, qword [rax + 0xa0]
jmp 0x180015f4c
mov rcx, rsi
cmp qword [rcx + 0x48], rsi
jne 0x180015f57
call fcn.180017940
call fcn.1800192e0
call fcn.180021c50
call fcn.180015640
cmp byte [0x1800981c8], sil
je 0x180015f7b
lea rcx, [0x1800981b0]
call fcn.1800126e0
xor edx, edx
lea rcx, str.UnityWndClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rbx
jne 0x180015fb5
mov ecx, 9
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x180015fb5
cmp byte [0x1800981c8], sil
sete byte [0x1800981c8]
call fcn.180023f60
call fcn.180024360
mov rax, qword [rdi]
lea r8, [0x180099628]
xor r9d, r9d
mov rcx, rdi
lea edx, [r9 + 1]
call qword [rax + pe_nt_image_headers64]
mov rax, qword [0x180099630]
mov rcx, qword [rax + 0x4210]
mov rcx, qword [rcx]
add rcx, 0xa8
cmp byte [rcx], sil
cmove rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.180016ed0