joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002f0a0
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18002f0f0
lea r11, [0x180073660]
nop dword [rax]
cmp r9b, 0x23
jne 0x18002f0d3
cmp byte [r8], r9b
jne 0x18002f0d3
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18002f0c0
mov r11, qword [0x18036f7d0]
not eax
movsxd rcx, dword [r11 + 0x1ad8]
mov r9, qword [r11 + 0x1ae0]
mov r10, rcx
mov rdx, rcx
mov r8, r9
test ecx, ecx
je 0x18002f158
nop dword [rax]
nop dword [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x18002f149
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18002f14c
mov rdx, r8
test rdx, rdx
jne 0x18002f120
mov r8, qword [r11 + 0x1ae0]
shl r10, 4
add r10, r8
cmp r9, r10
je 0x18002f16e
cmp dword [r9], eax
jne 0x18002f16e
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret

Function at 0x18002fd00
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0xc8]
mov r9, r8
movsxd r8, dword [rcx + 0xc0]
mov r10, rdx
xor ecx, ecx
mov rdx, r9
sub rdx, r10
test r9, r9
mov r8d, dword [rax + r8*4 - 4]
cmove rdx, rcx
mov rcx, r10
jmp fcn.180030530

Function at 0x180030530
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18003058d
lea rbx, [0x180073660]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180030574
cmp r10, 2
jb 0x180030574
cmp byte [r9], r8b
jne 0x180030574
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180030550
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1800305cf
lea rbx, [0x180073660]
cmp r8b, 0x23
jne 0x1800305b3
cmp byte [r9], r8b
jne 0x1800305b3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1800305a0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x1800310f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
xor eax, eax
lea r8, [0x180073c05]
mov dword [rsp + 0x2c], eax
lea r11, [0x180073660]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, str.Window
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov edx, r10d
mov r9b, 0x57
nop
cmp r9b, 0x23
jne 0x180031143
cmp byte [r8], r9b
jne 0x180031143
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x180031130
mov ecx, dword [rbx + 0x2fec]
lea rax, [0x18003ae30]
mov edi, dword [rbx + 0x2fe8]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x18003ad60]
mov qword [rsp + 0x38], rax
lea rax, [0x18003aee0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x180031253
inc edi
test ecx, ecx
je 0x1800311af
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1800311b4
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x180031253
mov rax, qword [0x18036f7d0]
mov qword [rsp + 0x60], rsi
test rax, rax
je 0x1800311d8
inc dword [rax + 0x3bc]
mov rdx, qword [0x18036f7e0]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call qword [0x18036eb30]
mov rdx, qword [rbx + 0x2ff0]
mov rsi, rax
test rdx, rdx
je 0x180031241
movsxd rcx, dword [rbx + 0x2fe8]
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0x2ff0]
test rcx, rcx
je 0x180031234
mov rax, qword [0x18036f7d0]
test rax, rax
je 0x180031234
dec dword [rax + 0x3bc]
mov rdx, qword [0x18036f7e0]
call qword [0x18036eb38]
mov qword [rbx + 0x2ff0], rsi
mov rsi, qword [rsp + 0x60]
mov dword [rbx + 0x2fec], edi
movsxd rax, dword [rbx + 0x2fe8]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2ff0]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2fe8]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x180031af0
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push r13
sub rsp, 0x38
mov r13, qword [0x18036f7d0]
mov qword [rsp + 0x50], rbx
mov rbx, rdx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
mov rdi, rcx
mov qword [rsp + 0x30], r12
test rdx, rdx
jne 0x180031b2e
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x180031b25
test r13, r13
je 0x180031b3a
inc dword [r13 + 0x3bc]
mov rdx, qword [0x18036f7e0]
lea rcx, [rbx + 1]
call qword [0x18036eb30]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x58], rax
mov rsi, rax
lea r12, [rax + rbx]
call sub.VCRUNTIME140.dll_memcpy
xor ebp, ebp
mov byte [r12], 0
xor edi, edi
mov rcx, rsi
cmp rsi, r12
jae 0x180031d10
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
movzx eax, byte [rcx]
cmp al, 0xa
je 0x180031d5b
cmp al, 0xd
je 0x180031d5b
mov rbx, rcx
cmp rcx, r12
jae 0x180031bb3
nop
movzx eax, byte [rbx]
cmp al, 0xa
je 0x180031bb3
cmp al, 0xd
je 0x180031bb3
inc rbx
cmp rbx, r12
jb 0x180031ba0
mov byte [rbx], 0
movzx eax, byte [rcx]
cmp al, 0x3b
je 0x180031cf4
cmp al, 0x5b
jne 0x180031cdb
cmp rbx, rcx
jbe 0x180031cdb
cmp byte [rbx - 1], 0x5d
lea rsi, [rbx - 1]
jne 0x180031cdb
lea r14, [rcx + 1]
mov byte [rsi], 0
mov r8, rsi
mov rcx, r14
sub r8, r14
mov edx, 0x5d
call sub.VCRUNTIME140.dll_memchr
mov r15, rax
test rax, rax
je 0x180031cf4
lea rcx, [rax + 1]
mov edx, 0x5b
sub rsi, rcx
mov r8, rsi
call sub.VCRUNTIME140.dll_memchr
mov r11, rax
test rax, rax
je 0x180031cf4
mov byte [r15], 0
lea r8, [r14 + 1]
movzx r9d, byte [r14]
mov esi, 0xffffffff
mov r10, qword [0x18036f7d0]
mov ecx, esi
test r9b, r9b
je 0x180031c7a
cmp r9b, 0x23
jne 0x180031c57
cmp byte [r8], r9b
jne 0x180031c57
cmp byte [r8 + 1], r9b
cmove ecx, esi
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
lea rax, [0x180073660]
inc r8
xor ecx, dword [rax + rdx*4]
test r9b, r9b
jne 0x180031c45
movsxd rax, dword [r10 + 0x2fe8]
xor r8d, r8d
xor edx, edx
not ecx
test eax, eax
jle 0x180031cb3
mov r10, qword [r10 + 0x2ff0]
mov r9, rax
lea rax, [r10 + 8]
nop word [rax + rax]
cmp dword [rax], ecx
je 0x180031cb9
inc r8d
inc rdx
add rax, 0x30
cmp rdx, r9
jl 0x180031ca0
xor edi, edi
xor ebp, ebp
jmp 0x180031cf4
lea rdi, [r8 + r8*2]
shl rdi, 4
add rdi, r10
je 0x180031cb5
mov rax, qword [rdi + 0x10]
lea r8, [r11 + 1]
mov rdx, rdi
mov rcx, r13
call rax
mov rbp, rax
jmp 0x180031cf4
test rdi, rdi
je 0x180031cf4
test rbp, rbp
je 0x180031cf4
mov r9, rcx
mov r8, rbp
mov rcx, r13
mov rdx, rdi
call qword [rdi + 0x18]
lea rcx, [rbx + 1]
cmp rcx, r12
jb 0x180031b84
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
test rsi, rsi
je 0x180031d3b
mov rax, qword [0x18036f7d0]
test rax, rax
je 0x180031d3b
dec dword [rax + 0x3bc]
mov rdx, qword [0x18036f7e0]
mov rcx, rsi
call qword [0x18036eb38]
mov byte [r13 + 0x2fd0], 1
add rsp, 0x38
pop r13
pop rsi
ret
inc rcx
jmp 0x180031b84
Function at 0x180031f10
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x18036f7d0]
cmp byte [rbx + 0x3008], 0
je 0x180031ff5
cmp qword [rbx + 0x3010], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x3018]
je 0x180031fdd
mov ecx, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test ecx, ecx
jns 0x180031f82
mov eax, ecx
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, ecx
mov rcx, rdi
test eax, eax
cmovg edx, eax
call fcn.18003b6d0
mov dword [rdi], ebp
mov r8, rsi
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
call fcn.18003b1a0
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x3010]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x3020]
cmove ecx, ebp
test rax, rax
movsxd r8, ecx
lea rcx, [0x18036f7d8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.18003b1a0
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
Function at 0x180038b50
Capabilities:
Write file on windows

Disassembly:
push r14
push r15
sub rsp, 0x28
mov rax, qword [0x18036f7d0]
xor r15d, r15d
mov r14, rcx
mov dword [rax + 0x2fd4], r15d
test rcx, rcx
je 0x180038c90
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x20], rdi
mov rdi, qword [0x18036f7d0]
lea rbx, [rdi + 0x2fd8]
mov dword [rdi + 0x2fd4], r15d
mov r8d, dword [rbx + 4]
test r8d, r8d
jns 0x180038bc2
mov eax, r8d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r15d
sar eax, 1
add eax, r8d
test eax, eax
cmovg edx, eax
call fcn.18003b6d0
mov eax, r15d
mov dword [rbx], r15d
cmp dword [rbx + 4], eax
jne 0x180038bdc
mov edx, 8
mov rcx, rbx
call fcn.18003b6d0
mov eax, dword [rbx]
movsxd rcx, eax
mov ebp, r15d
mov rax, qword [rbx + 8]
mov byte [rcx + rax], r15b
inc dword [rbx]
mov ecx, dword [rbx]
cmp dword [rdi + 0x2fe8], r15d
jle 0x180038c27
mov rsi, r15
nop word [rax + rax]
mov r9, qword [rdi + 0x2ff0]
mov r8, rbx
add r9, rsi
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add rsi, 0x30
cmp ebp, dword [rdi + 0x2fe8]
jl 0x180038c00
mov ecx, dword [rbx]
test ecx, ecx
lea eax, [rcx - 1]
lea rdx, [0x180073cbc]
mov rcx, r14
cmove eax, r15d
movsxd rsi, eax
mov rax, qword [rdi + 0x2fe0]
lea rdi, [0x18036f7d8]
test rax, rax
cmovne rdi, rax
call fcn.1800302e0
mov rbp, qword [rsp + 0x48]
mov rbx, rax
test rax, rax
je 0x180038c81
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
pop r15
pop r14
ret
Function at 0x18003e050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x18003e1e1
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x18003e0c0
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.1800411b0
mov r8d, dword [rbx + 0x80]
mov r9d, edi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.18003be70
mov dword [rbx + 0x80], 0
jmp 0x18003e1cd
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.1800416d0
movzx edx, word [rbx + 0x4c]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rsi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rsi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], edi
movsd xmm0, qword [rsi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], edi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x4c], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x18004ac70
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
call fcn.18002fd30
mov rcx, qword [0x18036f8a8]
lea rdx, [rsp + 0x20]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rsp + 0x28]
sub ecx, dword [rsp + 0x20]
movd xmm1, ecx
mov ecx, dword [rsp + 0x2c]
sub ecx, dword [rsp + 0x24]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rsp + 0x50]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x50]
xorps xmm1, xmm1
sub rax, qword [0x18036f8b0]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x18036f8b8]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rsp + 0x50]
mov qword [0x18036f8b0], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rdi + 0x140], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rdi + 0x141], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x143], 0
mov byte [rdi + 0x142], al
call fcn.18002fd30
mov rbx, rax
cmp byte [rax + 0x39b], 0
je 0x18004ad8e
cvttss2si ecx, dword [rax + 0x128]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], ecx
cvttss2si ecx, dword [rax + 0x12c]
mov dword [rsp + 0x44], ecx
mov rcx, qword [0x18036f8a8]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx + 0x128], 0xff7fffff
mov dword [rbx + 0x12c], 0xff7fffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x18004ae0d
mov rdx, qword [0x18036f8a8]
cmp rax, rdx
je 0x18004adc6
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x18004ae0d
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x18004ae0d
mov rcx, qword [0x18036f8a8]
lea rdx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x18004ae0d
movd xmm0, dword [rsp + 0x48]
movd xmm1, dword [rsp + 0x4c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0x128], xmm0
movss dword [rbx + 0x12c], xmm1
cmp byte [rdi + 0xc0], 0
je 0x18004ae1d
mov eax, 0xffffffff
jmp 0x18004ae22
call fcn.18002fd40
cmp dword [0x18036ed00], eax
je 0x18004ae35
mov dword [0x18036ed00], eax
call fcn.18004ae40
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180055c50
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx ebx, byte [rcx]
lea rdi, [rcx + 1]
mov rsi, rdx
mov r10d, 0x811c9dc5
mov rcx, rdi
movzx eax, bl
test bl, bl
je 0x180055c99
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, r10d
imul r10d, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x180055c80
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r11, qword [rcx + 0x10]
mov r9, r11
nop dword [rax]
mov rcx, qword [r9 + 0x60]
mov edx, 0x811c9dc5
movzx eax, word [r9 + 0x58]
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x180055ce4
nop word [rax + rax]
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x180055cd0
cmp edx, r10d
je 0x180055cf6
mov r9, qword [r9]
cmp r9, r11
jne 0x180055cb0
xor r11d, r11d
jmp 0x180055cfa
mov r11, qword [r9 + 0x30]
mov r10d, 0x811c9dc5
test bl, bl
je 0x180055d28
nop dword [rax]
nop dword [rax + rax]
movsx eax, bl
movzx ebx, byte [rdi]
lea rdi, [rdi + 1]
xor eax, r10d
imul r10d, eax, 0x1000193
test bl, bl
jne 0x180055d10
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbx, qword [rcx + 0x10]
mov r8, rbx
nop dword [rax]
mov rcx, qword [r8 + 0x60]
mov edx, 0x811c9dc5
movzx eax, word [r8 + 0x58]
shr rax, 1
lea r9, [rcx + rax*2]
cmp rcx, r9
je 0x180055d74
nop word [rax + rax]
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r9
jne 0x180055d60
cmp edx, r10d
je 0x180055d85
mov r8, qword [r8]
cmp r8, rbx
jne 0x180055d40
xor eax, eax
jmp 0x180055d89
mov eax, dword [r8 + 0x40]
lea rbx, [rax + r11]
xor r10d, r10d
mov r9, rsi
cmp r11, rbx
jae 0x180055e4c
mov edi, 0x3f3f
movzx r8d, byte [r9]
test r8b, r8b
je 0x180055e5e
cmp r8b, 0x3f
je 0x180055e15
movzx eax, r8b
and al, 0xdf
sub al, 0x41
cmp al, 5
ja 0x180055dca
and r8b, 0xdf
sub r8b, 0x37
jmp 0x180055ddb
lea ecx, [r8 - 0x30]
xor edx, edx
cmp cl, 9
cmovbe edx, r8d
movzx r8d, dl
movzx ecx, byte [r9 + 1]
movzx eax, cl
and al, 0xdf
sub al, 0x41
cmp al, 5
ja 0x180055df3
and cl, 0xdf
sub cl, 0x37
jmp 0x180055e01
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x180055dff
sub cl, 0x30
jmp 0x180055e01
xor cl, cl
shl r8b, 4
or r8b, cl
cmp byte [r11], r8b
je 0x180055e15
mov r9, rsi
xor r10d, r10d
jmp 0x180055e40
test r10, r10
mov rax, r11
cmovne rax, r10
cmp byte [r9 + 2], 0
mov r10, rax
je 0x180055e4e
movzx eax, word [r9]
cmp ax, di
je 0x180055e3c
cmp al, 0x3f
jne 0x180055e3c
add r9, 2
jmp 0x180055e40
add r9, 3
inc r11
cmp r11, rbx
jb 0x180055da1
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rbx, qword [rsp + 8]
mov rax, r10
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x180055fe0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180056200
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1800560e7
mov rax, qword [0x18036ed10]
cmp qword [rsp + 0x20], rax
jb 0x180056044
mov rax, qword [0x18036ed18]
cmp qword [rsp + 0x20], rax
ja 0x180056044
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180056006
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180056073
jmp 0x1800560e7
cmp dword [rsp + 0x50], 0x10000
jne 0x1800560ca
cmp qword [rsp + 0x48], 0x10000
jb 0x1800560ca
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800560b8
mov rax, qword [rsp + 0x28]
jmp 0x1800560e9
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800560e2
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180056200
mov qword [rsp + 0x20], rax
jmp 0x180056006
xor eax, eax
add rsp, 0x68
ret

Function at 0x1800560f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180056240
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x1800561f3
mov rax, qword [0x18036ed10]
cmp qword [rsp + 0x20], rax
jb 0x18005614b
mov rax, qword [0x18036ed18]
cmp qword [rsp + 0x20], rax
ja 0x18005614b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18005610d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18005617a
jmp 0x1800561f3
cmp dword [rsp + 0x50], 0x10000
jne 0x1800561d1
cmp qword [rsp + 0x48], 0x10000
jb 0x1800561d1
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800561bf
mov rax, qword [rsp + 0x28]
jmp 0x1800561f5
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800561ee
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180056240
mov qword [rsp + 0x20], rax
jmp 0x18005610d
xor eax, eax
add rsp, 0x68
ret
Function at 0x180056290
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180056820
mov qword [rsp + 0x28], 0
cmp qword [0x18036f8d0], 0
jne 0x1800562d8
cmp qword [0x18036f8c8], 0
je 0x1800562d8
mov rax, qword [0x18036f8c8]
mov qword [0x18036f8d0], rax
cmp qword [0x18036f8d0], 0
je 0x18005637e
mov rax, qword [0x18036f8d0]
cmp qword [rax + 0x10], 0
je 0x18005637e
mov rax, qword [0x18036f8d0]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18005637e
mov rax, qword [0x18036f8d0]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18005637e
mov rax, qword [0x18036f8d0]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180056344
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18005634b
xor eax, eax
jmp 0x1800564f9
mov rax, qword [0x18036f8d0]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x1800564f9
mov rax, qword [0x18036f8c8]
mov qword [0x18036f8d0], rax
jmp 0x1800563a0
mov rax, qword [0x18036f8d0]
mov rax, qword [rax + 8]
mov qword [0x18036f8d0], rax
cmp qword [0x18036f8d0], 0
je 0x1800563ed
cmp qword [0x18036f8d0], 0
je 0x1800563eb
mov rax, qword [0x18036f8d0]
cmp qword [rax + 0x10], 0
je 0x1800563eb
mov rax, qword [0x18036f8d0]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800563eb
mov rax, qword [0x18036f8d0]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800563eb
jmp 0x18005631c
jmp 0x18005638e
mov rcx, qword [rsp + 0x60]
call fcn.180058450
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180056500
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1800564f7
mov rax, qword [rsp + 0x48]
mov qword [0x18036f8d0], rax
mov rax, qword [0x18036f8d0]
mov dword [rax], 0x52727464
mov rax, qword [0x18036f8d0]
mov qword [rax + 0x10], 0
mov rax, qword [0x18036f8d0]
mov rcx, qword [0x18036f8c8]
mov qword [rax + 8], rcx
mov rax, qword [0x18036f8d0]
mov qword [0x18036f8c8], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18036f8d0]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x1800564a8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x1800564e2
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18005649e
mov rax, qword [0x18036f8d0]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18005631c
xor eax, eax
add rsp, 0x58
ret