joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ea220
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x40
mov rbx, r8
mov rdi, rdx
mov r8, qword [r8 + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1800ea246
mov rdx, qword [rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x1800ea274
movabs r10, 0x100000001b3
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1800ea261
mov r8, rbx
lea rdx, [rsp + 0x28]
lea rcx, [0x18023f5d0]
call fcn.18009c890
cmp qword [rax + 8], 0
je 0x1800ea2d2
mov r8, rbx
lea rdx, [rsp + 0x28]
lea rcx, [0x18023f5d0]
call fcn.1800ecac0
mov rdx, qword [rax]
cmp qword [rdx + 0x60], 0
je 0x1800ea2d2
mov r8, rbx
lea rdx, [rsp + 0x28]
lea rcx, [0x18023f5d0]
call fcn.1800ecac0
mov rdx, qword [rax]
add rdx, 0x50
mov rcx, rdi
call fcn.180098aa0
jmp 0x1800ea31c
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0
mov qword [rdi + 0x10], 7
mov qword [rdi + 0x18], 0xf
mov rax, qword [0x180202ed0]
mov dword [rdi], eax
movzx eax, word [0x180202ed4]
mov word [rdi + 4], ax
movzx eax, byte [0x180202ed6]
mov byte [rdi + 6], al
mov byte [rdi + 7], 0
mov rcx, rbx
call fcn.180098e30
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1800ea340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rdi, r8
mov rbx, rdx
mov r10, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1800ea368
mov rdx, qword [rdx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x1800ea3a3
movabs r8, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r8
inc rcx
cmp rcx, r10
jb 0x1800ea390
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [0x18023f5d0]
call fcn.18009c890
cmp qword [rax + 8], 0
jne 0x1800ea3f5
mov rax, qword [0x18023f618]
cmp rax, qword [0x18023f620]
je 0x1800ea3e3
mov rdx, rbx
mov rcx, rax
call fcn.180098aa0
add qword [0x18023f618], 0x20
jmp 0x1800ea3f5
mov r8, rbx
mov rdx, rax
lea rcx, [0x18023f610]
call fcn.1800eec50
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [0x18023f5d0]
call fcn.1800ecac0
mov rcx, qword [rax]
mov eax, dword [rdi]
mov dword [rcx + 0x30], eax
mov eax, dword [rdi + 4]
mov dword [rcx + 0x34], eax
mov eax, dword [rdi + 8]
mov dword [rcx + 0x38], eax
movzx eax, byte [rdi + 0xc]
mov byte [rcx + 0x3c], al
movzx eax, byte [rdi + 0xd]
mov byte [rcx + 0x3d], al
movzx eax, byte [rdi + 0xe]
mov byte [rcx + 0x3e], al
vmovups xmm0, xmmword [rdi + 0x10]
vmovups xmmword [rcx + 0x40], xmm0
add rdi, 0x20
add rcx, 0x50
cmp rcx, rdi
je 0x1800ea460
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1800ea456
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
call fcn.180098e90
nop
mov rcx, rbx
call fcn.180098e30
nop
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.180098e30
Function at 0x1800ec0f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x38
cmp qword [rdx + 0x18], 0xf
mov r10, rdx
mov r11, qword [rdx + 0x10]
jbe 0x1800ec105
mov r10, qword [rdx]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x1800ec149
mov qword [rsp + 0x30], rbx
movabs rbx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r10 + r8]
inc r8
xor r9, rax
imul r9, rbx
cmp r8, r11
jb 0x1800ec130
mov rbx, qword [rsp + 0x30]
mov r8, rdx
lea rdx, [rsp + 0x20]
call fcn.18009c890
cmp qword [rax + 8], 0
setne al
add rsp, 0x38
ret

Function at 0x1800ec170
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
cmp qword [r8 + 0x28], 0xf
lea r9, [r8 + 0x10]
mov r10, qword [r8 + 0x20]
mov rbx, r8
mov r14, rdx
mov rsi, rcx
jbe 0x1800ec1a1
mov r9, qword [r8 + 0x10]
xor edx, edx
movabs r8, 0xcbf29ce484222325
test r10, r10
je 0x1800ec1d4
movabs rcx, 0x100000001b3
nop dword [rax]
movzx eax, byte [r9 + rdx]
inc rdx
xor r8, rax
imul r8, rcx
cmp rdx, r10
jb 0x1800ec1c0
mov rdx, qword [rsi + 0x30]
and rdx, r8
shl rdx, 4
add rdx, qword [rsi + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x1800ec208
cmp rax, rbx
jne 0x1800ec1fe
mov rax, qword [rsi + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x1800ec213
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x1800ec213
cmp rax, rbx
jne 0x1800ec213
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdi, qword [rbx]
lea rcx, [rbx + 0x10]
dec qword [rsi + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
call fcn.180098e30
mov edx, 0x38
mov rcx, rbx
call fcn.18019051c
mov rbx, qword [rsp + 0x30]
mov rax, r14
mov rsi, qword [rsp + 0x38]
mov qword [r14], rdi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1800ec260
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
cmp qword [r8 + 0x28], 0xf
lea r9, [r8 + 0x10]
mov r10, qword [r8 + 0x20]
mov rbx, r8
mov r14, rdx
mov r11, rcx
jbe 0x1800ec291
mov r9, qword [r8 + 0x10]
xor edx, edx
movabs r8, 0xcbf29ce484222325
test r10, r10
je 0x1800ec2c4
movabs rcx, 0x100000001b3
nop dword [rax]
movzx eax, byte [r9 + rdx]
inc rdx
xor r8, rax
imul r8, rcx
cmp rdx, r10
jb 0x1800ec2b0
mov rdx, qword [r11 + 0x30]
and rdx, r8
shl rdx, 4
add rdx, qword [r11 + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x1800ec2f8
cmp rax, rbx
jne 0x1800ec2ee
mov rax, qword [r11 + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x1800ec303
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x1800ec303
cmp rax, rbx
jne 0x1800ec303
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdi, qword [rbx]
lea rcx, [rbx + 0x30]
dec qword [r11 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
call fcn.180098e30
lea rcx, [rbx + 0x10]
call fcn.180098e30
mov edx, 0x50
mov rcx, rbx
call fcn.18019051c
mov rbx, qword [rsp + 0x30]
mov rax, r14
mov rsi, qword [rsp + 0x38]
mov qword [r14], rdi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x1800ec360
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
cmp qword [r8 + 0x28], 0xf
lea r9, [r8 + 0x10]
mov r10, qword [r8 + 0x20]
mov rbx, r8
mov r14, rdx
mov r11, rcx
jbe 0x1800ec391
mov r9, qword [r8 + 0x10]
xor edx, edx
movabs r8, 0xcbf29ce484222325
test r10, r10
je 0x1800ec3c4
movabs rcx, 0x100000001b3
nop dword [rax]
movzx eax, byte [r9 + rdx]
inc rdx
xor r8, rax
imul r8, rcx
cmp rdx, r10
jb 0x1800ec3b0
mov rdx, qword [r11 + 0x30]
and rdx, r8
shl rdx, 4
add rdx, qword [r11 + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x1800ec3f8
cmp rax, rbx
jne 0x1800ec3ee
mov rax, qword [r11 + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x1800ec403
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x1800ec403
cmp rax, rbx
jne 0x1800ec403
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdi, qword [rbx]
lea rcx, [rbx + 0x30]
dec qword [r11 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
call fcn.180098c80
lea rcx, [rbx + 0x10]
call fcn.180098e30
mov edx, 0x48
mov rcx, rbx
call fcn.18019051c
mov rbx, qword [rsp + 0x30]
mov rax, r14
mov rsi, qword [rsp + 0x38]
mov qword [r14], rdi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1800ec460
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
cmp qword [r8 + 0x28], 0xf
lea r9, [r8 + 0x10]
mov r10, qword [r8 + 0x20]
mov rbx, r8
mov r14, rdx
mov rsi, rcx
jbe 0x1800ec491
mov r9, qword [r8 + 0x10]
xor edx, edx
movabs r8, 0xcbf29ce484222325
test r10, r10
je 0x1800ec4c4
movabs rcx, 0x100000001b3
nop dword [rax]
movzx eax, byte [r9 + rdx]
inc rdx
xor r8, rax
imul r8, rcx
cmp rdx, r10
jb 0x1800ec4b0
mov rdx, qword [rsi + 0x30]
and rdx, r8
shl rdx, 4
add rdx, qword [rsi + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x1800ec4f8
cmp rax, rbx
jne 0x1800ec4ee
mov rax, qword [rsi + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x1800ec503
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x1800ec503
cmp rax, rbx
jne 0x1800ec503
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdi, qword [rbx]
lea rcx, [rbx + 0x10]
dec qword [rsi + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
call fcn.180098e30
mov edx, 0x40
mov rcx, rbx
call fcn.18019051c
mov rbx, qword [rsp + 0x30]
mov rax, r14
mov rsi, qword [rsp + 0x38]
mov qword [r14], rdi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1800ee510
Capabilities:
Hash data using fnv

Disassembly:
mov rdx, qword [rcx + 0x10]
mov r9, rcx
add rdx, 1
mov r8, qword [rcx + 0x38]
vxorps xmm0, xmm0, xmm0
js 0x1800ee52c
vcvtsi2ss xmm0, xmm0, rdx
jmp 0x1800ee541
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
vcvtsi2ss xmm0, xmm0, rax
vaddss xmm0, xmm0, xmm0
vdivss xmm0, xmm0, dword [rcx]
vxorps xmm1, xmm1, xmm1
vroundss xmm1, xmm1, xmm0, 2
vmovss xmm0, dword [0x180218d30]
xor ecx, ecx
vcomiss xmm1, xmm0
jb 0x1800ee576
vsubss xmm1, xmm1, xmm0
vcomiss xmm1, xmm0
jae 0x1800ee576
movabs rax, 0x8000000000000000
mov rcx, rax
vcvttss2si rax, xmm1
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp r8, rcx
jae 0x1800ee5a8
cmp r8, 0x200
jae 0x1800ee5a5
lea r8, [r8*8]
cmp r8, rcx
jae 0x1800ee5a8
mov r8, rcx
mov rdx, r8
mov rcx, r9
jmp fcn.1800ee5c0
Function at 0x1800fedb0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1800fedd8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1800fedfe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1800fee00
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1800fee59
test ecx, ecx
jle 0x1800fee39
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1800fee59
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1800fee59
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x1800fee80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1800feeb1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x1800feecf
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1800feeeb
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800feeed
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1800fef29
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1800fefbe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1800fef64
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1800fef9e
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1800fefbe
cmp rbx, rax
ja 0x1800fef70
test rbx, rbx
je 0x1800fefbe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1800ff3d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1800ff3f4
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1800ff437
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x1800ff437
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x1800ff568
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1800ff47a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1800ff4a5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x1800ff56d
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1800ff51a
sub eax, 1
je 0x1800ff51a
cmp eax, 2
jne 0x1800ff568
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x1800ff56d
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x1800ff54b
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1800ff568
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1800ff56d
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x1800ffbb0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1800ffc79
cmp byte [rcx + 0x71], 0
je 0x1800ffc79
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1800ffc6c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1800ffc28
sub eax, 1
je 0x1800ffc2c
cmp eax, 2
jne 0x1800ffc6c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1800ffc5a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1800ffc6c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x180107d10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov edx, dword [0x18024256c]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x180244238], edx
jle 0x180107df1
lea rcx, [0x180244238]
call fcn.1801905cc
cmp dword [0x180244238], 0xffffffff
jne 0x180107df1
mov rcx, qword [0x180243e98]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov r10, rax
xor r11d, r11d
test rax, rax
je 0x180107dde
mov r8, qword [r10 + 0x10]
mov rax, 0xffffffffffffffff
mov r9d, 0x811c9dc5
inc rax
cmp byte [r8 + rax], r11b
jne 0x180107d82
mov rdx, r11
test rax, rax
je 0x180107dc0
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [r8 + rdx]
xor ecx, r9d
imul r9d, ecx, 0x1000193
inc rdx
cmp rdx, rax
jb 0x180107da0
cmp r9d, 0xd134a6b7
je 0x180107dcb
mov r10, qword [r10 + 0x20]
test r10, r10
jne 0x180107d71
jmp 0x180107dde
lea r8, str.m_iPrimaryAmmoType
mov rdx, qword [r10 + 0x18]
call fcn.180190160
mov r11d, eax
mov dword [0x18024423c], r11d
lea rcx, [0x180244238]
call fcn.180190560
movsxd rax, dword [0x18024423c]
add rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x180107e10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov edx, dword [0x18024256c]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x1802441f8], edx
jle 0x180107ef7
lea rcx, [0x1802441f8]
call fcn.1801905cc
cmp dword [0x1802441f8], 0xffffffff
jne 0x180107ef7
mov rcx, qword [0x180243e98]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov r10, rax
xor r11d, r11d
test rax, rax
je 0x180107ede
mov r8, qword [r10 + 0x10]
mov rax, 0xffffffffffffffff
mov r9d, 0x811c9dc5
inc rax
cmp byte [r8 + rax], r11b
jne 0x180107e82
mov rdx, r11
test rax, rax
je 0x180107ec0
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [r8 + rdx]
xor ecx, r9d
imul r9d, ecx, 0x1000193
inc rdx
cmp rdx, rax
jb 0x180107ea0
cmp r9d, 0x24615a25
je 0x180107ecb
mov r10, qword [r10 + 0x20]
test r10, r10
jne 0x180107e71
jmp 0x180107ede
lea r8, str.m_iReloadMode
mov rdx, qword [r10 + 0x18]
call fcn.180190160
mov r11d, eax
lea eax, [r11 - 0xf4]
mov dword [0x180244244], eax
lea rcx, [0x1802441f8]
call fcn.180190560
movsxd rax, dword [0x180244244]
add rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x180107f10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov edx, dword [0x18024256c]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x180244248], edx
jle 0x180107ff7
lea rcx, [0x180244248]
call fcn.1801905cc
cmp dword [0x180244248], 0xffffffff
jne 0x180107ff7
mov rcx, qword [0x180243e98]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov r10, rax
xor r11d, r11d
test rax, rax
je 0x180107fde
mov r8, qword [r10 + 0x10]
mov rax, 0xffffffffffffffff
mov r9d, 0x811c9dc5
inc rax
cmp byte [r8 + rax], r11b
jne 0x180107f82
mov rdx, r11
test rax, rax
je 0x180107fc0
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [r8 + rdx]
xor ecx, r9d
imul r9d, ecx, 0x1000193
inc rdx
cmp rdx, rax
jb 0x180107fa0
cmp r9d, 0x24615a25
je 0x180107fcb
mov r10, qword [r10 + 0x20]
test r10, r10
jne 0x180107f71
jmp 0x180107fde
lea r8, str.m_iReloadMode
mov rdx, qword [r10 + 0x18]
call fcn.180190160
mov r11d, eax
lea eax, [r11 - 0xf0]
mov dword [0x180244228], eax
lea rcx, [0x180244248]
call fcn.180190560
movsxd rax, dword [0x180244228]
add rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x180108010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov edx, dword [0x18024256c]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x1802441e8], edx
jle 0x1801080f7
lea rcx, [0x1802441e8]
call fcn.1801905cc
cmp dword [0x1802441e8], 0xffffffff
jne 0x1801080f7
mov rcx, qword [0x180243e98]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov r10, rax
xor r11d, r11d
test rax, rax
je 0x1801080de
mov r8, qword [r10 + 0x10]
mov rax, 0xffffffffffffffff
mov r9d, 0x811c9dc5
inc rax
cmp byte [r8 + rax], r11b
jne 0x180108082
mov rdx, r11
test rax, rax
je 0x1801080c0
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [r8 + rdx]
xor ecx, r9d
imul r9d, ecx, 0x1000193
inc rdx
cmp rdx, rax
jb 0x1801080a0
cmp r9d, 0x24615a25
je 0x1801080cb
mov r10, qword [r10 + 0x20]
test r10, r10
jne 0x180108071
jmp 0x1801080de
lea r8, str.m_iReloadMode
mov rdx, qword [r10 + 0x18]
call fcn.180190160
mov r11d, eax
lea eax, [r11 - 0xec]
mov dword [0x180244204], eax
lea rcx, [0x1802441e8]
call fcn.180190560
movsxd rax, dword [0x180244204]
add rax, rbx
add rsp, 0x20
pop rbx
ret