joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800e8100
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
test ax, ax
jne 0x1800e8216
mov qword [rsp + 0x38], rbx
movabs rax, 0xf3a21bcd95725a4a
mov qword [0x1805dd278], rax
mov dword [rsp + 0x38], 2
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rbx
mov qword [0x180587120], rax
mov dword [rsp + 0x38], 0x49
mov rax, qword [rsp + 0x38]
mov qword [0x180587128], rax
mov dword [0x1805870f8], ebx
mov dword [0x1805870e8], 2
call fcn.1801e4620
cmp dword [rax], ebx
jne 0x1800e8216
movabs rax, 0xd80958fc74e988a6
mov dword [0x1805870e8], ebx
mov qword [0x1805dd278], rax
mov dword [0x1805870f8], ebx
call fcn.1801e4620
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0x38], ecx
mov qword [0x1805dd278], rax
mov rax, qword [rsp + 0x38]
mov qword [0x180587120], rax
mov dword [0x1805870f8], ebx
mov qword [0x180587128], rbx
mov dword [0x1805870e8], 2
call fcn.1801e4620
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0xfb8794444a7d60fb
mov dword [rsp + 0x38], ecx
mov qword [0x1805dd278], rax
mov rax, qword [rsp + 0x38]
mov qword [0x180587120], rax
mov qword [0x180587128], rbx
jmp 0x1800e82bd
movabs rax, 0xd80958fc74e988a6
mov dword [0x1805870e8], ebx
mov qword [0x1805dd278], rax
mov dword [0x1805870f8], ebx
call fcn.1801e4620
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0x38], ecx
mov qword [0x1805dd278], rax
mov rax, qword [rsp + 0x38]
mov qword [0x180587120], rax
mov dword [0x1805870f8], ebx
mov qword [0x180587128], rbx
mov dword [0x1805870e8], 2
call fcn.1801e4620
mov qword [rsp + 0x38], rbx
mov ecx, dword [rax]
movabs rax, 0xfb8794444a7d60fb
mov dword [rsp + 0x38], ecx
mov qword [0x1805dd278], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x38], 1
mov qword [0x180587120], rax
mov rax, qword [rsp + 0x38]
mov qword [0x180587128], rax
mov dword [0x1805870f8], ebx
mov dword [0x1805870e8], 2
call fcn.1801e4620
add rsp, 0x20
pop rbx
ret
Function at 0x1800f2050
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov ecx, 0x20
movaps xmmword [rsp + 0x70], xmm6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor esi, esi
movabs rbp, 0xd80958fc74e988a6
xorps xmm6, xmm6
test ax, ax
je 0x1800f20f9
mov dword [0x1805870e8], esi
mov dword [0x1805870f8], esi
mov qword [0x1805dd278], rbp
call fcn.1801e4620
movss xmm0, dword [0x1805045d4]
lea edx, [rsi + 1]
mov dword [rsp + 0x60], 1
xorps xmm3, xmm3
mov dword [rsp + 0x58], 1
xorps xmm2, xmm2
mov ecx, dword [rax]
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x40], 1
movss dword [rsp + 0x38], xmm6
movss dword [rsp + 0x30], xmm6
movss dword [rsp + 0x28], xmm6
movss dword [rsp + 0x20], xmm0
call fcn.18015d3f0
mov edi, esi
lea r14, str.GADGET_PARACHUTE
mov ebx, esi
mov eax, edi
movsx ecx, byte [rax + r14]
call fcn.180370a88
add eax, ebx
inc edi
imul ebx, eax, 0x401
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp edi, 0x10
jb 0x1800f2104
lea ebx, [rbx + rbx*8]
mov dword [0x1805870e8], esi
mov dword [0x1805870f8], esi
mov qword [0x1805dd278], rbp
call fcn.1801e4620
mov r9d, 1
mov ecx, dword [rax]
mov eax, ebx
shr eax, 0xb
xor eax, ebx
imul edx, eax, 0x8001
call fcn.18015ca90
call fcn.1800aa380
mov dword [0x1805870e8], esi
mov dword [0x1805870f8], esi
mov qword [0x1805dd278], rbp
call fcn.1801e4620
mov qword [rsp + 0xa8], rsi
mov ecx, dword [rax]
movabs rax, 0x886e37ec497200b6
mov dword [rsp + 0xa8], ecx
mov qword [0x1805dd278], rax
mov rax, qword [rsp + 0xa8]
mov qword [0x180587120], rax
mov dword [0x1805870f8], esi
mov dword [0x1805870e8], 1
call fcn.1801e4620
cmp dword [rax], esi
je 0x1800f22df
mov dword [0x1805870e8], esi
mov dword [0x1805870f8], esi
mov qword [0x1805dd278], rbp
call fcn.1801e4620
mov qword [rsp + 0xa8], rsi
mov ecx, dword [rax]
movabs rax, 0x47e4e977581c5b55
mov dword [rsp + 0xa8], ecx
mov qword [0x1805dd278], rax
mov rax, qword [rsp + 0xa8]
mov qword [0x180587120], rax
mov dword [0x1805870f8], esi
mov dword [0x1805870e8], 1
call fcn.1801e4620
cmp dword [rax], esi
jne 0x1800f22df
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1800f2266
mov dword [0x1805870e8], esi
mov dword [0x1805870f8], esi
mov qword [0x1805dd278], rbp
call fcn.1801e4620
movss xmm1, dword [0x1805043d0]
movaps xmm2, xmm6
mov ecx, dword [rax]
call fcn.180167b70
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1800f22a5
mov dword [0x1805870e8], esi
mov dword [0x1805870f8], esi
mov qword [0x1805dd278], rbp
call fcn.1801e4620
movss xmm2, dword [0x180504508]
movss xmm1, dword [0x1805043d0]
mov ecx, dword [rax]
call fcn.180167b70
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1800f22df
mov dword [0x1805870e8], esi
mov dword [0x1805870f8], esi
mov qword [0x1805dd278], rbp
call fcn.1801e4620
movss xmm1, dword [0x180504508]
movaps xmm2, xmm6
mov ecx, dword [rax]
call fcn.180167b70
movaps xmm6, xmmword [rsp + 0x70]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180131cd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov ebp, dword [0x180568668]
lea r14, [0x180000000]
xor ebx, ebx
mov esi, ebx
mov edi, ebx
nop dword [rax]
mov eax, esi
movsx ecx, byte [rax + r14 + 0x48f018]
call fcn.180370a88
add eax, edi
inc esi
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
cmp esi, 0x10
jb 0x180131d00
lea eax, [rdi + rdi*8]
mov r8d, ebp
mov ecx, eax
movabs rbp, 0xb3271d7ab655b441
shr ecx, 0xb
xor ecx, eax
imul edx, ecx, 0x8001
mov rcx, rbp
call fcn.18015c0b0
mov esi, dword [0x180568668]
mov edi, ebx
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [rbx + r14 + 0x48f030]
call fcn.180370a88
add eax, edi
inc ebx
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
cmp ebx, 0x10
jb 0x180131d60
lea eax, [rdi + rdi*8]
mov r8d, esi
mov edx, eax
mov rcx, rbp
shr edx, 0xb
xor edx, eax
imul edx, edx, 0x8001
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.18015c0b0
Function at 0x180136170
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
call fcn.1803708f0
mov r8d, dword [0x1805aa3ac]
mov ebx, eax
mov rdx, qword gs:[0x58]
mov eax, 4
mov rdx, qword [rdx + r8*8]
mov r8d, dword [rax + rdx]
cmp dword [0x1805f1f48], r8d
jle 0x1801361e9
lea rcx, [0x1805f1f48]
call fcn.180357e54
cmp dword [0x1805f1f48], 0xffffffff
jne 0x1801361e9
xor edx, edx
mov dword [0x1805eda40], ebx
mov r8d, 0x3fc
lea rcx, [0x1805eda44]
call fcn.18038da60
lea rcx, [0x1805f1f48]
call fcn.180357de8
mov ecx, edi
xor sil, sil
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea r9, [0x180000000]
mov r10, rdi
movzx edx, byte [rdi + r9 + 0x5ed940]
movzx r8d, ax
shr r8d, 0xf
and r8b, 1
je 0x180136259
lea r11, [rdi*4]
test dl, 1
je 0x180136240
mov ecx, ebx
mov eax, 0x200
sub ecx, dword [r11 + r9 + 0x5eda40]
mov edi, 0x50
test dl, 2
cmovne eax, edi
cmp ecx, eax
jle 0x18013625c
movzx eax, dl
and al, 3
cmp al, 1
jne 0x18013624c
or dl, 2
mov sil, 1
mov dword [r11 + r9 + 0x5eda40], ebx
jmp 0x18013625c
and dl, 0xfd
mov rbx, qword [rsp + 0x30]
neg r8b
xor r8b, dl
movzx eax, sil
mov rsi, qword [rsp + 0x38]
and r8b, 1
xor r8b, dl
mov byte [r10 + r9 + 0x5ed940], r8b
add rsp, 0x20
pop rdi
ret
Function at 0x18013e7d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x18054e100]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, qword [0x180575ff0]
xor r12d, r12d
mov edi, r12d
mov ebx, r12d
test rsi, rsi
je 0x18013e854
mov ecx, r12d
lea rbp, [0x180575fe0]
nop word [rax + rax]
cmp qword [0x180575ff8], 0xf
mov rax, rbp
cmova rax, qword [0x180575fe0]
movsx ecx, byte [rcx + rax]
call fcn.180370a88
add eax, ebx
inc edi
imul ebx, eax, 0x401
mov ecx, edi
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp rcx, rsi
jb 0x18013e820
lea eax, [rbx + rbx*8]
mov ebp, r12d
mov ecx, eax
lea rdi, [0x180576000]
shr ecx, 0xb
mov rbx, rdi
xor ecx, eax
movabs r13, 0x6d0de6a7b5da71f8
imul r15d, ecx, 0x8001
nop dword [rax]
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x20], ebp
mov rax, qword [rsp + 0x20]
mov qword [0x180587120], rax
mov dword [0x1805870f8], r12d
mov qword [0x1805dd278], r13
mov dword [0x1805870e8], 1
call fcn.1801e4620
mov r8, 0xffffffffffffffff
mov rdx, qword [rax]
nop dword [rax]
inc r8
cmp byte [rdx + r8], r12b
jne 0x18013e8c0
mov ecx, ebp
shl rcx, 5
add rcx, rdi
call fcn.180068770
mov r14, qword [rbx + 0x10]
mov esi, r12d
mov edi, r12d
test r14, r14
je 0x18013e91e
mov rcx, r12
nop dword [rax]
cmp qword [rbx + 0x18], 0xf
mov rax, rbx
jbe 0x18013e8fd
mov rax, qword [rbx]
movsx ecx, byte [rcx + rax]
call fcn.180370a88
add eax, edi
inc esi
imul edi, eax, 0x401
mov ecx, esi
mov eax, edi
shr eax, 6
xor edi, eax
cmp rcx, r14
jb 0x18013e8f0
lea eax, [rdi + rdi*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
test eax, eax
je 0x18013e9b9
cmp r15d, eax
jne 0x18013e9b9
cmp qword [rbx + 0x18], 0xf
mov rcx, rbx
mov dword [0x1805ab7fc], ebp
jbe 0x18013e94e
mov rcx, qword [rbx]
call fcn.1801dba10
mov edx, dword [0x1805ab7fc]
lea rcx, [rsp + 0x28]
call fcn.18006a170
cmp qword [rax + 0x18], 0xf
jbe 0x18013e96d
mov rax, qword [rax]
mov rcx, rax
call fcn.1801dba10
lea rcx, [rsp + 0x28]
call fcn.18006b8d0
lea rcx, [0x18048f568]
call fcn.1801dba10
cmp byte [0x1805b1ac3], r12b
jne 0x18013e9a6
cmp byte [0x1805ab39e], r12b
je 0x18013e9ab
mov byte [0x1805b1099], 1
jmp 0x18013e9ab
call fcn.18013e1d0
mov byte [0x1805ab39e], r12b
mov byte [0x1805b10a0], r12b
inc ebp
lea rdi, [0x180576000]
add rbx, 0x20
cmp ebp, 0x20
jl 0x18013e880
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180357630
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180145980
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x18054e100]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xor ebx, ebx
mov edx, dword [0x1805ed934]
lea rcx, [rsp + 0x68]
call fcn.18006a170
nop
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rsp + 0x78]
sub rax, rcx
cmp rax, 2
jb 0x180145b49
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x80], 0xf
cmova rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 2
lea r9, [0x18048f6b0]
lea rcx, [rsp + 0x88]
call fcn.18006a4c0
nop
lea r8d, [rbx + 0x15]
lea rdx, str._HEIST_PLANNING_STAGE
lea rcx, [rsp + 0x88]
call fcn.18006a3c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova r9, qword [rsp + 0x48]
mov r10, qword [rsp + 0x58]
add r10, r9
cmp r9, r10
je 0x180145aa0
nop dword [rax]
movzx r8d, byte [r9]
lea edx, [r8 - 0x41]
lea eax, [r8 + 0x20]
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx eax, cl
add eax, ebx
imul ebx, eax, 0x401
mov eax, ebx
shr eax, 6
xor ebx, eax
inc r9
cmp r9, r10
jne 0x180145a70
lea eax, [rbx + rbx*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul edx, ecx, 0x8001
movabs rcx, 0xb3271d7ab655b441
mov r8d, 0xffffffff
call fcn.18015c0b0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x180145aff
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180145afa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180145b43
call fcn.180357650
movdqa xmm0, xmmword [0x180509e00]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
lea rcx, [rsp + 0x88]
call fcn.18006b8d0
nop
lea rcx, [rsp + 0x68]
call fcn.18006b8d0
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.180357630
add rsp, 0xb0
pop rbx
ret
call fcn.18035e820
nop
call fcn.18006b090
int3
Function at 0x180145b50
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x18054e100]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xor ebx, ebx
mov edx, dword [0x1805ed934]
lea rcx, [rsp + 0x68]
call fcn.18006a170
nop
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rsp + 0x78]
sub rax, rcx
cmp rax, 2
jb 0x180145d19
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x80], 0xf
cmova rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 2
lea r9, [0x18048f6b0]
lea rcx, [rsp + 0x88]
call fcn.18006a4c0
nop
lea r8d, [rbx + 0x1a]
lea rdx, str._GANGOPS_FLOW_MISSION_PROG
lea rcx, [rsp + 0x88]
call fcn.18006a3c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova r9, qword [rsp + 0x48]
mov r10, qword [rsp + 0x58]
add r10, r9
cmp r9, r10
je 0x180145c70
nop dword [rax]
movzx r8d, byte [r9]
lea edx, [r8 - 0x41]
lea eax, [r8 + 0x20]
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx eax, cl
add eax, ebx
imul ebx, eax, 0x401
mov eax, ebx
shr eax, 6
xor ebx, eax
inc r9
cmp r9, r10
jne 0x180145c40
lea eax, [rbx + rbx*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul edx, ecx, 0x8001
movabs rcx, 0xb3271d7ab655b441
mov r8d, 0xffffffff
call fcn.18015c0b0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x180145ccf
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180145cca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180145d13
call fcn.180357650
movdqa xmm0, xmmword [0x180509e00]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
lea rcx, [rsp + 0x88]
call fcn.18006b8d0
nop
lea rcx, [rsp + 0x68]
call fcn.18006b8d0
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.180357630
add rsp, 0xb0
pop rbx
ret
call fcn.18035e820
nop
call fcn.18006b090
int3
Function at 0x180154480
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbx
sub rsp, 0x60
cmp byte [0x1805b10e7], 0
mov rbx, rcx
je 0x180154567
lea rcx, str.FixVehicle
call fcn.1801dba10
cmp byte [rbx + 0xa5], 0
je 0x18015467d
mov r8d, dword [rbx + 0x98]
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_aa53e9f38e046fdce5a65f1a4cf6198d___void__int_.0
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x20]
lea rax, [rsp + 0x20]
lea rdx, str._FV_
mov qword [rsp + 0x58], rax
lea rcx, [0x1805d7180]
call fcn.1801522d0
mov eax, dword [rbx + 0x98]
movabs rcx, 0x9f47b058362c84b5
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x78]
mov qword [0x180587120], rax
mov dword [0x1805870f8], 0
mov qword [0x1805dd278], rcx
mov dword [0x1805870e8], 1
call fcn.1801e4620
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_09779c287ecdaad35338dc8960989b1d___void__int_.0
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x20]
mov edx, dword [rax]
mov qword [rsp + 0x58], rcx
lea rcx, [0x1805d7180]
call fcn.180152530
lea rcx, [0x1805d7180]
add rsp, 0x60
pop rbx
jmp fcn.180152680
mov qword [rsp + 0x70], rsi
movsxd rsi, dword [rcx + 4]
lea rcx, str.FixVehicle_player
call fcn.1801dba10
cmp byte [rbx + 0xa5], 0
je 0x180154678
mov rax, qword [0x18058c9e8]
mov rcx, qword [rax + 0x188]
mov rax, qword [rcx]
test rax, rax
je 0x180154678
mov rax, qword [rax + 0x10]
cmp esi, dword [rax + 0x188]
jge 0x1801545c2
mov rax, qword [rax + 0x180]
mov rcx, rsi
add rcx, rcx
mov r8, qword [rax + rcx*8]
jmp 0x1801545c5
xor r8d, r8d
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_f25cda9d9058bd0dc3f508e7d513e371___void__int_.0
mov dword [rbx + 0x98], r8d
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x20]
lea rax, [rsp + 0x20]
lea rdx, str._FV_
mov qword [rsp + 0x58], rax
lea rcx, [0x1805d7180]
call fcn.1801522d0
mov eax, dword [rbx + 0x98]
movabs rcx, 0x9f47b058362c84b5
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x78]
mov qword [0x180587120], rax
mov dword [0x1805870f8], 0
mov qword [0x1805dd278], rcx
mov dword [0x1805870e8], 1
call fcn.1801e4620
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_abfba14e15c8100bcfa5f7483b117b0c___void__int_.0
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x20]
mov edx, dword [rax]
mov qword [rsp + 0x58], rcx
lea rcx, [0x1805d7180]
call fcn.180152530
lea rcx, [0x1805d7180]
call fcn.180152680
mov rsi, qword [rsp + 0x70]
add rsp, 0x60
pop rbx
ret
Function at 0x180154690
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbx
sub rsp, 0x60
cmp byte [0x1805b10e7], 0
mov rbx, rcx
je 0x180154777
lea rcx, str.TuneVehicle
call fcn.1801dba10
cmp byte [rbx + 0xa5], 0
je 0x18015488d
mov r8d, dword [rbx + 0x98]
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_45cc32e6e7af293a1fdf1a2f6652f7d7___void__int_.0
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x20]
lea rax, [rsp + 0x20]
lea rdx, str._TV_
mov qword [rsp + 0x58], rax
lea rcx, [0x1805d7180]
call fcn.1801522d0
mov eax, dword [rbx + 0x98]
movabs rcx, 0x9f47b058362c84b5
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x78]
mov qword [0x180587120], rax
mov dword [0x1805870f8], 0
mov qword [0x1805dd278], rcx
mov dword [0x1805870e8], 1
call fcn.1801e4620
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_1c423197b70e8100cb11fae1f1f5d111___void__int_.0
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x20]
mov edx, dword [rax]
mov qword [rsp + 0x58], rcx
lea rcx, [0x1805d7180]
call fcn.180152530
lea rcx, [0x1805d7180]
add rsp, 0x60
pop rbx
jmp fcn.180152680
mov qword [rsp + 0x70], rsi
movsxd rsi, dword [rcx + 4]
lea rcx, str.TuneVehicle_player
call fcn.1801dba10
cmp byte [rbx + 0xa5], 0
je 0x180154888
mov rax, qword [0x18058c9e8]
mov rcx, qword [rax + 0x188]
mov rax, qword [rcx]
test rax, rax
je 0x180154888
mov rax, qword [rax + 0x10]
cmp esi, dword [rax + 0x188]
jge 0x1801547d2
mov rax, qword [rax + 0x180]
mov rcx, rsi
add rcx, rcx
mov r8, qword [rax + rcx*8]
jmp 0x1801547d5
xor r8d, r8d
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_49a5a0664cb7b607f2b5a21b20ba1599___void__int_.0
mov dword [rbx + 0x98], r8d
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x20]
lea rax, [rsp + 0x20]
lea rdx, str._TV_
mov qword [rsp + 0x58], rax
lea rcx, [0x1805d7180]
call fcn.1801522d0
mov eax, dword [rbx + 0x98]
movabs rcx, 0x9f47b058362c84b5
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x78]
mov qword [0x180587120], rax
mov dword [0x1805870f8], 0
mov qword [0x1805dd278], rcx
mov dword [0x1805870e8], 1
call fcn.1801e4620
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_24d0261eac4b60bfdb82e9772fe034f5___void__int_.0
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x20]
mov edx, dword [rax]
mov qword [rsp + 0x58], rcx
lea rcx, [0x1805d7180]
call fcn.180152530
lea rcx, [0x1805d7180]
call fcn.180152680
mov rsi, qword [rsp + 0x70]
add rsp, 0x60
pop rbx
ret
Function at 0x180159a30
Capabilities:
Encode data using xor

Disassembly:
mov r10, qword [rcx]
xor eax, eax
mov r11, qword [rcx + 8]
add r11, r10
cmp r10, r11
je 0x180159a72
movzx r9d, byte [r10]
lea ecx, [r9 + 0x20]
movzx edx, cl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova edx, r9d
inc r10
movsx ecx, dl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r10, r11
jne 0x180159a41
lea ecx, [rax + rax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret

Function at 0x180167c50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x18], 0xf
mov r14, rcx
mov rsi, rcx
jbe 0x180167c72
mov rsi, qword [rcx]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x180167c80
xor ebp, ebp
mov edi, ebp
test rbx, rbx
je 0x180167cb5
mov eax, ebp
movsx ecx, byte [rax + rsi]
call fcn.180370a88
add eax, edi
inc ebp
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, ebp
cmp rax, rbx
jb 0x180167c94
mov rcx, r14
lea ebx, [rdi + rdi*8]
call fcn.18006b8d0
mov rbp, qword [rsp + 0x50]
mov eax, ebx
shr eax, 0xb
xor eax, ebx
mov rbx, qword [rsp + 0x48]
imul eax, eax, 0x8001
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x180169a20
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x18054e100]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor r15d, r15d
lea rcx, str.appdata
call fcn.18035fa3c
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], r15
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], r15b
jne 0x180169a76
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.18006b0d0
nop
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rbp + 0xf]
sub rax, rcx
cmp rax, 0x13
jb 0x180169c53
lea r9, [rbp - 1]
cmp qword [rbp + 0x17], 0xf
cmova r9, qword [rbp - 1]
mov qword [rsp + 0x30], 0x13
lea rax, str.ThunderMenuUsers_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x1f]
call fcn.18006a4c0
nop
mov esi, dword [rbp + 0x2f]
lea r8, [rbp + 0x1f]
cmp qword [rbp + 0x37], 0xf
cmova r8, qword [rbp + 0x1f]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
cmovo rax, rbx
mov rcx, rax
call fcn.180357d9c
mov r14, rax
lea r8, [rbp + 0x1f]
cmp qword [rbp + 0x37], 0xf
cmova r8, qword [rbp + 0x1f]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x180169b50
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 0x21]
call fcn.18008a510
mov rcx, r14
call fcn.180357650
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 7
cmova rcx, qword [rbp - 0x21]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180169b92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbp - 9]
cmp rdx, 7
jbe 0x180169bd2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180169bcd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180169c59
call fcn.180357650
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], 7
mov word [rbp - 0x21], r15w
lea rcx, [rbp + 0x1f]
call fcn.18006b8d0
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 0xf
jbe 0x180169c24
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180169c1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180169c4d
call fcn.180357650
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.180357630
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18035e820
nop
call fcn.18006b090
nop
call fcn.18035e820
int3