joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004cd94
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rsi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x18004cdc4
cvtsi2ss xmm0, rdx
jmp 0x18004cdd9
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.msvcrt.dll_ceilf
movss xmm1, dword [0x1800d229c]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18004ce07
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18004ce07
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18004ce35
cmp rbx, 0x200
jae 0x18004ce32
shl rbx, 3
cmp rbx, rcx
jae 0x18004ce35
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
ja 0x18004cfa3
lea rax, [rbx - 1]
mov edi, 1
mov rbx, qword [rsi + 8]
or rax, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18000dacc
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18004cf67
mov rcx, qword [rcx]
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx edx, byte [rax + r9 + 0x10]
movabs r10, 0x100000001b3
xor r8, rdx
inc r9
imul r8, r10
cmp r9, 8
jb 0x18004cead
mov r11, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x18]
and r11, r8
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x18004ceec
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x18004cf5b
mov r10, qword [rdi + r11*8 + 8]
mov rdx, qword [rax + 0x10]
cmp rdx, qword [r10 + 0x10]
jne 0x18004cf30
mov r10, qword [r10]
cmp r10, rax
je 0x18004cee5
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18004cee5
mov r10, qword [r10 + 8]
cmp rdx, qword [r10 + 0x10]
je 0x18004cf7d
cmp qword [rdi + r11*8], r10
jne 0x18004cf26
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18004ce9d
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18004cf5b
lea rcx, [0x1800c7240]
call fcn.18008b460
int3

Function at 0x18004d2c0
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.10.virtual_32

Function at 0x18004d464
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.7.virtual_16
Function at 0x18004d4c4
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004d4dc
Capabilities:
Delete file

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004d500
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x50
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004d518
Capabilities:
Delete file

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004d584
Capabilities:
Write file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004d5a8
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004d5cc
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004d5f0
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x40
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004d62c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.10.virtual_32

Function at 0x18004d6bc
Capabilities:
Read file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.10.virtual_24

Function at 0x18004d7d0
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004d80c
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x38
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004d824
Capabilities:
Delete file

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004d83c
Capabilities:
Delete file

Disassembly:
sub rcx, 0x38
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004d878
Capabilities:
Write file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004d8b4
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004d8d8
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004d8fc
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004d920
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x48
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004d9bc
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.10.virtual_24

Function at 0x18004db0c
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004db48
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x40
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004db60
Capabilities:
Delete file

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004db84
Capabilities:
Delete file

Disassembly:
sub rcx, 0x40
jmp method.IMySteamRemoteStorage.6.virtual_24
Function at 0x18004dbcc
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004dc08
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004dc2c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004dc68
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x50
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004de0c
Capabilities:
Read file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004de6c
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004de78
Capabilities:
Delete file

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004de9c
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x48
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004deb4
Capabilities:
Delete file

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004dee4
Capabilities:
Delete file

Disassembly:
sub rcx, 0x48
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004df44
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004df68
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004df8c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x38
jmp method.IMySteamRemoteStorage.7.virtual_0
Function at 0x1800524c4
Capabilities:
Check if file exists
Create directory

Disassembly:
push rbx
sub rsp, 0x240
lea rdx, [rsp + 0x130]
sub rdx, rcx
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x1800524d8
mov edx, 0x5c
lea rcx, [rsp + 0x130]
call qword [sym.imp.msvcrt.dll_strrchr]
mov edx, 0x2f
lea rcx, [rsp + 0x130]
mov rbx, rax
call qword [sym.imp.msvcrt.dll_strrchr]
cmp rax, rbx
cmova rbx, rax
test rbx, rbx
je 0x1800525aa
lea rdx, [0x1800c5098]
mov byte [rbx + 1], 0
lea rcx, [rsp + 0x130]
call qword [sym.imp.msvcrt.dll_strtok]
mov byte [rsp + 0x20], 0
jmp 0x1800525a2
lea rcx, [rsp + 0x20]
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x180052545
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x18005254f
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x180052579
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [rsp + 0x20]
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x180052581
movzx eax, word [0x1800c509c]
lea rdx, [0x1800c50a0]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_strtok]
mov r8, rax
test rax, rax
jne 0x18005253d
add rsp, 0x240
pop rbx
ret
Function at 0x180054acc
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_0

Function at 0x180054e68
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x18
jmp method.IMySteamApps.2.virtual_56

Function at 0x180054fac
Capabilities:
Get common file path

Disassembly:
sub rcx, 0x10
jmp method.IMySteamApps.3.virtual_144

Function at 0x180055018
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_16

Function at 0x180055198
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_8

Function at 0x1800553f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_0

Function at 0x1800556fc
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x20
jmp method.IMySteamApps.2.virtual_56

Function at 0x180055828
Capabilities:
Get common file path

Disassembly:
sub rcx, 0x18
jmp method.IMySteamApps.3.virtual_144

Function at 0x1800559c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_8

Function at 0x180055c78
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.3.virtual_192

Function at 0x180055d38
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.3.virtual_184

Function at 0x180055de0
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamApps.2.virtual_56

Function at 0x180055ed0
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x28
jmp method.IMySteamApps.2.virtual_56

Function at 0x180055f0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.virtual_0

Function at 0x180056434
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.virtual_32

Function at 0x18005656c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamApps.2.virtual_56

Function at 0x180056698
Capabilities:
Get common file path

Disassembly:
sub rcx, 8
jmp method.IMySteamApps.3.virtual_144

Function at 0x1800566ec
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_16
Function at 0x180059698
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, rdx
mov rsi, rcx
mov ecx, 0x20
call fcn.18008cedc
mov r8, qword [rbx]
mov qword [rax], r8
mov r8, qword [0x1801a0248]
mov qword [rax + 8], r8
movups xmm0, xmmword [rdi]
movdqu xmmword [rax + 0x10], xmm0
mov qword [rsp + 0x50], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x180059744]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x18005971a
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call fcn.18008b8b4
int3
Function at 0x18005a6d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov r14, rdx
mov rdi, rcx
call fcn.18005cc34
nop
lea rsi, [rdi + 0xc0]
mov rcx, rsi
call fcn.180077ef4
nop
lea rax, vtable.GlRender.0
mov qword [rdi], rax
lea rax, vtable.GlRender.1.0
mov qword [rsi], rax
lea rbx, [rdi + 0x168]
mov qword [rbp + 0x48], rbx
and dword [rbp + 0x40], 0
mov eax, dword [rbp + 0x40]
mov dword [rbx], eax
and qword [rbx + 8], 0
and qword [rbx + 0x10], 0
mov ecx, 0x60
call fcn.18008cedc
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x18]
and qword [rcx], 0
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
mov qword [rbx + 0x30], 7
mov qword [rbx + 0x38], 8
mov dword [rbx], 0x3f800000
mov r8, qword [rbx + 8]
mov edx, 0x10
call fcn.18000dacc
nop
mov byte [rbp - 0x18], 0x84
mov byte [rbp - 0x17], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x16], 0x79
mov byte [rbp - 0x15], 0x60
mov byte [rbp - 0x14], 0x84
mov byte [rbp - 0x13], WSASetLastError
mov byte [rbp - 0x12], 0x7d
mov byte [rbp - 0x11], 0x4f
mov byte [rbp - 0x10], 0x82
mov byte [rbp - 0xf], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0xe], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0xd], WSACleanup
mov byte [rbp - 0xc], 0x7f
mov byte [rbp - 0xb], 0x80
mov byte [rbp - 0xa], 0
mov al, byte [rbp - 0x18]
xor edx, edx
mov al, byte [rbp + rdx - 0x18]
sub al, 0xd
mov byte [rbp + rdx - 0x18], al
inc rdx
cmp rdx, 0xe
jb 0x18005a7c5
lea rdx, [rbp - 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18005a812
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005a59c]
mov rdx, rax
mov rcx, rsi
call fcn.18007384c
mov qword [0x1801a0258], rdi
mov byte [rdi + 8], 1
mov rax, rdi
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18005bff4
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rdx, qword [0x18019fa60]
mov rdi, rcx
mov r8d, dword [rdx + 0x128]
sub r8d, 1
je 0x18005c1a5
cmp r8d, 1
jne 0x18005c1c3
mov byte [rbp - 0x30], 0x45
xor ebx, ebx
mov byte [rbp - 0x2f], 0x6a
mov ecx, ebx
mov byte [rbp - 0x2e], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x2d], WSACleanup
mov byte [rbp - 0x2c], 0x62
mov byte [rbp - 0x2b], 0x75
mov byte [rbp - 0x2a], 0x64
mov byte [rbp - 0x29], 0x69
mov byte [rbp - 0x28], 0x4e
mov byte [rbp - 0x27], 0x66
mov byte [rbp - 0x26], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x25], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x24], 0x62
mov byte [rbp - 0x23], 0x68
mov byte [rbp - 0x22], 0x66
mov byte [rbp - 0x21], 0x42
mov byte [rbp - 0x20], bl
mov al, byte [rbp - 0x30]
mov al, byte [rbp + rcx - 0x30]
dec al
mov byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x10
jb 0x18005c075
mov byte [rbp + 0x18], 0x5f
mov rcx, rbx
mov byte [rbp + 0x19], 0x7d
mov byte [rbp + 0x1a], WSASetLastError
mov byte [rbp + 0x1b], 0x7c
mov byte [rbp + 0x1c], 0x3d
mov byte [rbp + 0x1d], 0x3c
mov byte [rbp + 0x1e], bl
mov al, byte [rbp + 0x18]
mov al, byte [rbp + rcx + 0x18]
sub al, 0xa
mov byte [rbp + rcx + 0x18], al
inc rcx
cmp rcx, 6
jb 0x18005c0a9
lea r8, [rbp - 0x30]
mov rcx, rdi
lea rdx, [rbp + 0x18]
call fcn.180078770
mov rdx, rax
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005bbb0]
mov rcx, rdi
call fcn.18007384c
mov byte [rbp - 0x1f], 0x47
mov rcx, rbx
mov byte [rbp - 0x1e], 0x6c
mov byte [rbp - 0x1d], 0x76
mov byte [rbp - 0x1c], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x1b], 0x64
mov byte [rbp - 0x1a], 0x77
mov byte [rbp - 0x19], 0x66
mov byte [rbp - 0x18], 0x6b
mov byte [rbp - 0x17], 0x50
mov byte [rbp - 0x16], 0x68
mov byte [rbp - 0x15], 0x76
mov byte [rbp - 0x14], 0x76
mov byte [rbp - 0x13], 0x64
mov byte [rbp - 0x12], 0x6a
mov byte [rbp - 0x11], 0x68
mov byte [rbp - 0x10], 0x5a
mov byte [rbp - 0xf], bl
mov al, byte [rbp - 0x1f]
mov al, byte [rbp + rcx - 0x1f]
sub al, 3
mov byte [rbp + rcx - 0x1f], al
inc rcx
cmp rcx, 0x10
jb 0x18005c132
mov byte [rbp + 0x20], 0x5d
mov byte [rbp + 0x21], 0x7b
mov byte [rbp + 0x22], WSASetLastError
mov byte [rbp + 0x23], 0x7a
mov byte [rbp + 0x24], 0x3b
mov byte [rbp + 0x25], 0x3a
mov byte [rbp + 0x26], bl
mov al, byte [rbp + 0x20]
mov al, byte [rbp + rbx + 0x20]
sub al, 8
mov byte [rbp + rbx + 0x20], al
inc rbx
cmp rbx, 6
jb 0x18005c163
lea r8, [rbp - 0x1f]
mov rcx, rdi
lea rdx, [rbp + 0x20]
call fcn.180078770
mov rdx, rax
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005bbb0]
mov rcx, rdi
call fcn.18007384c
jmp 0x18005c1c3
xor r9d, r9d
lea rdx, [0x18005b748]
xor r8d, r8d
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x1801a09d8], rax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1800619e0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
cmp byte [rcx + 9], 0
mov r15, r8
mov rdi, rcx
jne 0x180061b9b
cmp qword [rcx + 0x178], 0
je 0x180061b9b
and qword [rbp + 0x30], 0
lea r8, [rbp + 0x30]
call fcn.180062560
and qword [rbp - 0x38], 0
xor eax, eax
mov dword [rbp - 0x44], eax
mov qword [rbp + 0x48], rax
mov dword [rbp - 0x28], eax
mov qword [rbp - 0x18], rax
mov rax, qword [rdi + 0x170]
mov qword [rbp - 0x60], rax
mov rax, qword [rdi + 0x180]
mov qword [rbp - 0x58], rax
mov rax, qword [rdi + 0x178]
mov qword [rbp - 0x50], rax
mov eax, dword [rdi + 0x190]
mov dword [rbp - 0x48], eax
mov rax, qword [rdi + 0x188]
mov qword [rbp - 0x30], rax
mov eax, 2
mov dword [rbp - 0x24], eax
mov dword [rbp - 0x20], eax
lea rax, [sym.steamclient64.dll_Breakpad_SteamMiniDumpInit]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x30]
and qword [rbp + 0x30], 0
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x1c], 1
lea rdx, [rbp + 0x30]
lea rcx, [0x18005ea98]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbp + 0x30]
test rax, rax
je 0x180061a96
mov qword [rdi + 0x168], rax
call fcn.180021a3c
mov rcx, qword [rdi + 0x168]
call fcn.18001ec44
mov rsi, qword [0x18019fc70]
mov r14, qword [rdi + 0x1b0]
test rsi, rsi
je 0x180061ae1
inc dword [rsi + 0xf4]
mov ecx, 0xe8
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rbp + 0x30], rax
mov rbx, rax
test rax, rax
je 0x180061b12
xor edx, edx
mov r8d, 0xe8
mov rcx, rax
call sub.msvcrt.dll_memset
mov qword [rbx + 0x60], 0x100
jmp 0x180061b14
xor ebx, ebx
or dword [rsi + 0xc], 8
lea rax, str.imgui_impl_vulkan
movaps xmm0, xmmword [rbp - 0x60]
movaps xmm1, xmmword [rbp - 0x50]
mov qword [rsi + 0x90], rax
mov rax, qword [rbp + 0x48]
mov qword [rsi + 0xa0], rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x58], r14
movaps xmm0, xmmword [rbp - 0x40]
movups xmmword [rbx + 0x10], xmm1
mov dword [rbx + 0x88], eax
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rbx + 0x20], xmm0
movaps xmm0, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x30], xmm1
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx + 0x40], xmm0
movsd qword [rbx + 0x50], xmm1
call fcn.18001df4c
mov rcx, rdi
call fcn.18005d380
mov rax, qword [r15 + 0x30]
mov ecx, dword [rax]
lea rax, [rcx + rcx*2]
mov rcx, qword [rdi + 0x1b8]
add rax, rax
mov rcx, qword [rcx + rax*8 + 8]
call fcn.18001d65c
mov byte [rdi + 9], 1
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18006570c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, rdx
mov r14, rcx
xor edi, edi
xor ebx, ebx
xor esi, esi
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
jne 0x1800657ad
cmp esi, edi
jne 0x180065761
lea r15d, [rdi + 0x3e8]
mov edx, edi
mov r8d, r15d
mov rcx, rbx
call fcn.180063c14
test rax, rax
je 0x1800657e9
mov rbx, rax
mov edi, r15d
call qword [sym.imp.msvcrt.dll__errno]
movsxd rcx, esi
mov r9, r14
add rcx, rbx
mov edx, 1
and dword [rax], 0
mov eax, edi
sub eax, esi
movsxd r8, eax
call qword [sym.imp.msvcrt.dll_fread]
mov rcx, r14
mov r15, rax
call qword [sym.imp.msvcrt.dll_ferror]
test eax, eax
jne 0x1800657f2
mov rcx, r14
add esi, r15d
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
je 0x18006573a
cmp esi, edi
jne 0x180065830
lea r8d, [rdi + 1]
mov edx, edi
mov rcx, rbx
call fcn.180063c14
test rax, rax
jne 0x18006582d
lea r8, [0x18019b838]
mov edx, 0xc8
mov rcx, rbp
call fcn.18004390c
test rbx, rbx
je 0x1800657e5
mov rax, qword [fcn.1800913b8]
mov rcx, rbx
call rax
xor eax, eax
jmp 0x180065859
lea r8, [0x18019b860]
jmp 0x1800657c7
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0
je 0x18006580d
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.msvcrt.dll_strerror]
jmp 0x180065814
lea rax, str.Error_reading_file
mov r9, rax
lea r8, [0x18019b644]
mov edx, 0xc8
mov rcx, rbp
call fcn.18004390c
jmp 0x1800657d4
mov rbx, rax
movsxd rax, esi
mov rdx, rbp
mov rcx, rbx
mov byte [rax + rbx], 0
call fcn.180064fec
mov rdi, rax
test rbx, rbx
je 0x180065856
mov rdx, qword [fcn.1800913b8]
mov rcx, rbx
call rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x180066aa4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov rdi, qword [0x1801a0438]
mov rsi, rdx
mov rbx, qword [rdi + 8]
test rbx, rbx
jne 0x180066b31
mov r9d, 0x4f4e4554
lea r8, [0x1800fe090]
mov edx, 0x2728e
mov ecx, dword [r8]
mov eax, ecx
xor eax, r9d
mov r9d, ecx
mov dword [r8], eax
lea r8, [r8 + 4]
sub rdx, 1
jne 0x180066add
mov edx, 0x4e078
mov ecx, 1
call qword [sym.imp.msvcrt.dll_calloc]
mov rbx, rax
test rax, rax
je 0x180066b26
and dword [rax + 0x70], 0
mov rcx, rax
call fcn.18006bd64
test eax, eax
jne 0x180066b28
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
xor ebx, ebx
mov qword [rdi + 8], rbx
test rbx, rbx
je 0x180066b40
mov rdx, rsi
mov rcx, rbx
call fcn.18006d7b0
test eax, eax
je 0x180066b44
xor al, al
jmp 0x180066b9c
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x40]
call fcn.18006df88
mov rdi, rax
test eax, eax
jle 0x180066b9a
lea rdx, [0x1800c6248]
lea rcx, [0x1801a0d80]
call qword [sym.imp.msvcrt.dll_fopen]
mov rcx, qword [rsp + 0x40]
mov r8d, 1
mov r9, rax
movsxd rdx, edi
mov rbx, rax
call fcn.18009a620
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_fclose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_free]
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800670ac
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
lea rbx, [0x1800c6e40]
mov r9d, ecx
not r9d
cmp r8, 4
jb 0x1800670fe
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
xor r11d, r11d
movzx ecx, byte [rdx + r11]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc r11
xor r9d, dword [rbx + rax*4]
cmp r11, 4
jl 0x1800670d5
add rdx, 4
sub r10, 1
jne 0x1800670d2
test r8, r8
je 0x180067120
movzx ecx, byte [rdx]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc rdx
xor r9d, dword [rbx + rax*4]
sub r8, 1
jne 0x180067103
mov rbx, qword [rsp + 8]
not r9d
mov eax, r9d
ret
Function at 0x180070330
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
and qword [rcx + 8], 0
lea rax, vtable.MemoryAllocator.0
mov rbx, r8
mov qword [rcx], rax
and rbx, 0xfffffffffffff000
mov rsi, rdx
test r8, r8
mov rdi, rcx
cmove rbx, r8
add rbx, 0x1000
mov r9d, 0x40
mov rcx, rbx
mov r8d, 0x3000
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rdi + 8], rax
test rax, rax
je 0x180070365
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret