joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180169c60
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x18054e100]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor r15d, r15d
lea rcx, [rbp + 0x1f]
call fcn.1803006b0
nop
lea r8d, [r15 + 0x14]
lea rdx, str.ThunderMenuOutfit_
mov rcx, rax
call fcn.18006a3c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x21], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x11], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
lea rcx, [rbp + 0x1f]
call fcn.18006b8d0
mov esi, dword [rbp - 0x11]
lea r8, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova r8, qword [rbp - 0x21]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.180357d9c
mov r14, rax
lea r8, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova r8, qword [rbp - 0x21]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], r15
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x180169d62
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 1]
call fcn.18008a510
mov rcx, r14
call fcn.180357650
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 7
cmova rcx, qword [rbp - 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180169da4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbp + 0x17]
cmp rdx, 7
jbe 0x180169de0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180169ddb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180169e57
call fcn.180357650
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r15w
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x180169e28
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180169e23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180169e51
call fcn.180357650
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.180357630
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18035e820
nop
call fcn.18035e820
nop
int3
Function at 0x180169e60
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x18054e100]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor r15d, r15d
lea rcx, [rbp + 0x1f]
call fcn.1803006b0
nop
lea r8d, [r15 + 0x16]
lea rdx, str.ThunderMenuTeleport_
mov rcx, rax
call fcn.18006a3c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x21], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x11], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
lea rcx, [rbp + 0x1f]
call fcn.18006b8d0
mov esi, dword [rbp - 0x11]
lea r8, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova r8, qword [rbp - 0x21]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.180357d9c
mov r14, rax
lea r8, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova r8, qword [rbp - 0x21]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], r15
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x180169f62
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 1]
call fcn.18008a510
mov rcx, r14
call fcn.180357650
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 7
cmova rcx, qword [rbp - 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180169fa4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbp + 0x17]
cmp rdx, 7
jbe 0x180169fe0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180169fdb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18016a057
call fcn.180357650
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r15w
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x18016a028
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18016a023
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18016a051
call fcn.180357650
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.180357630
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18035e820
nop
call fcn.18035e820
nop
int3
Function at 0x18016a060
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x18054e100]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor r15d, r15d
lea rcx, [rbp + 0x1f]
call fcn.1803006b0
nop
lea r8d, [r15 + 0x15]
lea rdx, [0x180499860]
mov rcx, rax
call fcn.18006a3c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x21], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x11], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
lea rcx, [rbp + 0x1f]
call fcn.18006b8d0
mov esi, dword [rbp - 0x11]
lea r8, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova r8, qword [rbp - 0x21]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.180357d9c
mov r14, rax
lea r8, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova r8, qword [rbp - 0x21]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], r15
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x18016a162
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 1]
call fcn.18008a510
mov rcx, r14
call fcn.180357650
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 7
cmova rcx, qword [rbp - 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18016a1a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbp + 0x17]
cmp rdx, 7
jbe 0x18016a1e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18016a1db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18016a257
call fcn.180357650
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r15w
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x18016a228
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18016a223
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18016a251
call fcn.180357650
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.180357630
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18035e820
nop
call fcn.18035e820
nop
int3
Function at 0x18016a260
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x18054e100]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor r15d, r15d
lea rcx, [rbp + 0x1f]
call fcn.1803006b0
nop
lea r8d, [r15 + 0x15]
lea rdx, str.ThunderMenuOversee_
mov rcx, rax
call fcn.18006a3c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x21], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x11], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
lea rcx, [rbp + 0x1f]
call fcn.18006b8d0
mov esi, dword [rbp - 0x11]
lea r8, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova r8, qword [rbp - 0x21]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.180357d9c
mov r14, rax
lea r8, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova r8, qword [rbp - 0x21]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], r15
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x18016a362
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 1]
call fcn.18008a510
mov rcx, r14
call fcn.180357650
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 7
cmova rcx, qword [rbp - 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18016a3a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbp + 0x17]
cmp rdx, 7
jbe 0x18016a3e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18016a3db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18016a457
call fcn.180357650
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r15w
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x18016a428
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18016a423
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18016a451
call fcn.180357650
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.180357630
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18035e820
nop
call fcn.18035e820
nop
int3
Function at 0x18016a460
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x18054e100]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor r15d, r15d
lea rcx, [rbp + 0x1f]
call fcn.1803006b0
nop
lea r8d, [r15 + 0x17]
lea rdx, str.ThunderMenu_addPlayer_
mov rcx, rax
call fcn.18006a3c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x21], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x11], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
lea rcx, [rbp + 0x1f]
call fcn.18006b8d0
mov esi, dword [rbp - 0x11]
lea r8, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova r8, qword [rbp - 0x21]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.180357d9c
mov r14, rax
lea r8, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova r8, qword [rbp - 0x21]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], r15
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x18016a562
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 1]
call fcn.18008a510
mov rcx, r14
call fcn.180357650
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 7
cmova rcx, qword [rbp - 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18016a5a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbp + 0x17]
cmp rdx, 7
jbe 0x18016a5e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18016a5db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18016a657
call fcn.180357650
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r15w
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x18016a628
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18016a623
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18016a651
call fcn.180357650
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.180357630
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18035e820
nop
call fcn.18035e820
nop
int3
Function at 0x18016b450
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x50
xor r14d, r14d
movaps xmmword [rsp + 0x40], xmm6
movabs rax, 0xd80958fc74e988a6
mov dword [0x1805870e8], r14d
mov dword [0x1805870f8], r14d
mov rbp, rcx
mov qword [0x1805dd278], rax
call fcn.1801e4620
mov qword [rsp + 0x78], r14
mov edx, dword [rax]
movabs rax, 0x3fef770d40960d5a
mov qword [0x1805dd278], rax
mov dword [rsp + 0x78], edx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x78], r14
mov qword [0x180587120], rax
mov dword [rsp + 0x78], 1
mov rax, qword [rsp + 0x78]
mov qword [0x180587128], rax
mov dword [0x1805870f8], r14d
mov dword [0x1805870e8], 2
call fcn.1801e4620
mov rbx, 0xffffffffffffffff
movsd xmm0, qword [rax + 0x10]
movups xmm6, xmmword [rax]
movsd qword [rsp + 0x30], xmm0
inc rbx
cmp byte [rbx + rbp], r14b
jne 0x18016b502
mov esi, r14d
mov edi, r14d
test rbx, rbx
je 0x18016b541
mov rax, r14
nop dword [rax]
movsx ecx, byte [rax + rbp]
call fcn.180370a88
add eax, edi
inc esi
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, esi
cmp rax, rbx
jb 0x18016b520
movss xmm0, dword [rsp + 0x30]
lea ecx, [rdi + rdi*8]
movabs rax, 0x9a294b2138abb884
mov qword [rsp + 0x78], r14
mov qword [0x1805dd278], rax
mov eax, ecx
shr eax, 0xb
xor eax, ecx
mov qword [rsp + 0x80], r14
imul eax, eax, 0x8001
mov dword [0x1805870f8], r14d
mov qword [0x180587150], r14
mov dword [0x1805870e8], 7
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x78]
mov qword [0x180587120], rax
movss dword [rsp + 0x78], xmm6
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0x80]
mov qword [0x180587128], rax
mov qword [rsp + 0x80], r14
shufps xmm6, xmm6, 0xaa
movss dword [rsp + 0x78], xmm6
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0x80]
mov qword [0x180587130], rax
movss dword [rsp + 0x78], xmm0
mov eax, dword [rsp + 0x78]
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r14
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0x80]
mov qword [0x180587138], rax
mov dword [rsp + 0x78], 1
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x78], r14
mov qword [0x180587140], rax
mov dword [rsp + 0x78], 1
mov rax, qword [rsp + 0x78]
mov qword [0x180587148], rax
call fcn.1801e4620
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x88]
movaps xmm6, xmmword [rsp + 0x40]
movd xmm0, dword [rax]
cvtdq2ps xmm0, xmm0
cvttss2si eax, xmm0
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x18016b820
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x18054e100]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor r15d, r15d
lea rcx, [rbp + 0x1f]
call fcn.1803006b0
nop
lea r8d, [r15 + 0xd]
lea rdx, [0x18048ecc0]
mov rcx, rax
call fcn.18006a3c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x21], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x11], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
lea rcx, [rbp + 0x1f]
call fcn.18006b8d0
mov esi, dword [rbp - 0x11]
lea r8, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova r8, qword [rbp - 0x21]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.180357d9c
mov r14, rax
lea r8, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova r8, qword [rbp - 0x21]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], r15
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x18016b922
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 1]
call fcn.18008a510
mov rcx, r14
call fcn.180357650
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 7
cmova rcx, qword [rbp - 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18016b964
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbp + 0x17]
cmp rdx, 7
jbe 0x18016b9a0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18016b99b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18016ba17
call fcn.180357650
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r15w
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x18016b9e8
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18016b9e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18016ba11
call fcn.180357650
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.180357630
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18035e820
nop
call fcn.18035e820
nop
int3
Function at 0x180187f90
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18018813e
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18058ca68]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18058ca78]
lea rdx, [rdi + rdi]
call fcn.180084840
mov rax, qword [0x18058ca68]
lea r9, [rdi - 1]
mov qword [0x18058ca90], r9
mov qword [0x18058ca98], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180188133
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18058ca78]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18018807f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1801880f4
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1801880bc
mov r10, qword [rdx]
cmp r10, rax
je 0x1801880b6
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1801880f4
cmp r9, rdx
je 0x1801880d0
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180188108
cmp r9, rdx
jne 0x1801880c1
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18018812e
mov r9, qword [0x18058ca90]
jmp 0x180188030
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1801880f4
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.18033743c
int3
Function at 0x180196b00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rbx + rcx], 0
jne 0x180196b20
xor esi, esi
mov edi, esi
test rbx, rbx
je 0x180196b55
mov eax, esi
movsx ecx, byte [rax + rbp]
call fcn.180370a88
add eax, edi
inc esi
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, esi
cmp rax, rbx
jb 0x180196b34
mov rbx, qword [rsp + 0x30]
lea eax, [rdi + rdi*8]
mov rbp, qword [rsp + 0x38]
mov ecx, eax
mov rsi, qword [rsp + 0x40]
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
add rsp, 0x20
pop rdi
ret
Function at 0x1801b2030
Capabilities:
Create thread

Disassembly:
mov eax, 0x1048
call fcn.180358570
sub rsp, rax
mov rax, qword [0x18054e100]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov r8, rcx
lea rdx, str.finding__s
lea rcx, [rsp + 0x30]
call fcn.18007b4c0
lea rcx, [rsp + 0x30]
call fcn.1801dbb50
lea rcx, str.Cleaning_up_hooks
call fcn.1801dba10
xor eax, eax
lea r8, [0x1801b4c80]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov edx, 0x1fffff
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.180357630
add rsp, 0x1048
ret