joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401579a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
mov eax, 0x20
call fcn.14015c3d0
sub rsp, rax
mov rax, qword [rcx + 8]
lea esi, [r9 + 1]
mov rbx, rdx
mov r10, rcx
mov r9, qword [rax + 0xc0]
test byte [r9 + 0x68], 1
je 0x1401579fe
mov edx, dword [rdx + 8]
lea eax, [rsi + r8]
cmp eax, edx
jbe 0x1401579e7
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov eax, r8d
sub edx, r8d
add qword [rbx + 0x18], rax
add qword [rbx + 0x20], rax
sub dword [rbx + 0xc], r8d
mov dword [rbx + 8], edx
jmp 0x140157a03
cmp esi, dword [rdx + 8]
ja 0x1401579da
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
dec ecx
mov qword [rsp + 0x38], rdi
movzx edi, byte [rcx + rax]
mov rcx, qword [r10 + 0x110]
call fcn.140131850
mov rcx, rax
call fcn.14009f590
bt eax, 0x15
jae 0x140157a4c
or eax, 0xffffffff
sub eax, edi
mov rdi, qword [rsp + 0x38]
add dword [rbx + 8], eax
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov r10d, dword [rbx + 8]
lea ecx, [rdi + rsi]
mov esi, 0x100
mov r8d, r10d
sub r8d, ecx
mov eax, r10d
xor r8d, ecx
xor eax, ecx
or r8d, eax
xor r8d, r10d
shr r8d, 0x1f
dec r8d
cmp r10d, esi
cmovb esi, r10d
xor r9d, r9d
test esi, esi
je 0x140157ad0
mov r11d, edi
mov qword [rsp + 0x30], rbp
mov rbp, qword [rbx + 0x18]
shr r11d, 0x1f
mov eax, r9d
mov ecx, edi
sub ecx, r9d
shr eax, 0x1f
shr ecx, 0x1f
xor cl, al
xor al, r11b
or cl, al
mov eax, r10d
sub eax, r9d
xor cl, r11b
dec cl
dec eax
movzx edx, cl
inc r9d
movzx ecx, byte [rax + rbp]
xor ecx, edi
and edx, ecx
not edx
and r8d, edx
cmp r9d, esi
jb 0x140157a91
mov rbp, qword [rsp + 0x30]
not r8d
movzx eax, r8b
lea ecx, [rax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [rdi + 1]
mov rdi, qword [rsp + 0x38]
neg ecx
and eax, ecx
sub r10d, eax
mov eax, ecx
and eax, 1
mov dword [rbx + 8], r10d
mov rbx, qword [rsp + 0x40]
not ecx
or eax, ecx
add rsp, 0x20
pop rsi
ret
Function at 0x14015e4d8
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14015e2ac
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14015e2ac
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14015e2ac
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14015e2ac
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14015e2ac
cmp dword [rcx + 0x84], 0xe
jbe 0x14015e2ac
cmp dword [rcx + 0xf8], esi
je 0x14015e2ac
mov ecx, r14d
call fcn.14015e3f4
mov ecx, 2
call fcn.14016f658
nop
cmp byte [0x1402021a0], 0
jne 0x14015e376
mov r15d, 1
mov eax, r15d
xchg dword [0x140202190], eax
test ebx, ebx
jne 0x14015e31f
mov rdi, qword [0x1401ff510]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140202198]
cmp rcx, rax
je 0x14015e316
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140002bd0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140202448]
jmp 0x14015e32b
cmp ebx, r15d
jne 0x14015e331
lea rcx, [0x140202460]
call fcn.14016f2b0
nop
test ebx, ebx
jne 0x14015e348
lea rdx, [0x140188b08]
lea rcx, [0x140188ae8]
call fcn.14016ecec
lea rdx, [0x140188b18]
lea rcx, [0x140188b10]
call fcn.14016ecec
movzx eax, byte [0x1402021a0]
test esi, esi
cmove eax, r15d
mov byte [0x1402021a0], al
jmp 0x14015e376
mov ecx, 2
call fcn.14016f6ac
test esi, esi
jne 0x14015e38d
mov ecx, r14d
call fcn.14015e3a8
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14015e23c
Function at 0x140173eb8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140173d58
call fcn.140162e7c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14016299c
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140173d40
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140173d40
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140173d8a
lock or dword [rax + 0x14], 0x10
jmp 0x140173d40
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140173da7
mov rcx, qword [rbp + 0x10]
call fcn.14017a3d0
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14016dc80
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140170720
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140173dfe
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140173d40
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140173e6a
mov rcx, qword [rbp + 0x10]
call fcn.14016dc80
cmp eax, 0xffffffff
je 0x140173e51
mov rcx, qword [rbp + 0x10]
call fcn.14016dc80
cmp eax, 0xfffffffe
je 0x140173e51
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14016dc80
movsxd rdi, eax
lea rsi, [0x140202840]
mov rcx, rbx
sar rdi, 6
call fcn.14016dc80
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140173e58
lea rax, [0x1401ff820]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140173e6a
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140173ea0
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140173e9c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140173e9c
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140173d43
jmp 0x140173d10

Function at 0x140173f04
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x140173ee1
call fcn.140162e7c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14016299c
or eax, 0xffffffff
jmp 0x140173efe
sub dword [rcx + 0x10], 1
jns 0x140173ef0
add rsp, 0x28
jmp fcn.140173eb8
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x140173ec0
Function at 0x1401748fc
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14017491c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140162e0c
or eax, 0xffffffff
jmp 0x14017491e
xor eax, eax
add rsp, 0x28
ret
Function at 0x18001b350
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x18001b371
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x18001b39e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18001b3a0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x18001b3f9
test ecx, ecx
jle 0x18001b3d9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x18001b3f9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18001b3f9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add eax, 0xc5010f55
add dword [0x19d43b571], ebx
invalid
Function at 0x18001b420
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x18001b442
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x18001b451
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18001b474
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18001b476
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18001b4b2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18001b54e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18001b4ed
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18001b52e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x18001b54e
cmp rbx, rax
ja 0x18001b500
test rbx, rbx
je 0x18001b54e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
invalid
Function at 0x18001b940
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1802e8038]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18001b96d
xor eax, eax
jmp 0x18001baca
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x18001b998
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x18001b998
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x18001baca
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18001babd
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x18001b9db
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18001ba06
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18001bac2
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18001ba75
sub eax, 1
je 0x18001ba75
cmp eax, 2
jne 0x18001babd
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18001bac2
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x18001baa3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x18001babd
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x18001bac2
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180115350
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x18001bd60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1802e8038]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18001be33
cmp byte [rcx + 0x71], 0
je 0x18001be33
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18001be2f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18001bdf4
sub eax, 1
je 0x18001bdf8
cmp eax, 2
jne 0x18001be2f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180115350
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18001be26
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18001be2f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18001bddc
xor al, al
jmp 0x18001bddc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180115350
add rsp, 0x60
pop rbx
ret
Function at 0x1800599b0
Capabilities:
Hide graphical window
Terminate process

Disassembly:
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rbx, rcx
add rcx, 0x580
lea rdx, [rbx + 0x4a8]
call fcn.180077360
lea rcx, [rbx + 0x5d8]
lea rdx, [rbx + 0x1c0]
call fcn.180077360
lea rcx, [rbx + 0x630]
lea rdx, [rbx + 0x250]
call fcn.180077360
lea rcx, [rbx + 0x688]
lea rdx, [rbx + 0x2e0]
call fcn.180077360
lea rcx, [rbx + 0x6e0]
call fcn.1800772e0
test al, al
je 0x180059a90
cmp byte [rbx + 0x530], 0
je 0x180059a90
cmp byte [rbx + 0x4e8], 0
jne 0x180059a90
lea rcx, [rbx + 0x4f0]
call fcn.18003ba20
mov rbx, rax
lea rdx, str.enabled
lea rcx, [rsp + 0x40]
call fcn.18001a9f0
nop
lea rdx, str.functions:Settings:fastExit
lea rcx, [rsp + 0x20]
call fcn.18001a9f0
nop
mov r8, rbx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.18003e3c0
nop
lea rcx, [rsp + 0x20]
call fcn.18001bcd0
nop
lea rcx, [rsp + 0x40]
call fcn.18001bcd0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [rbx + 0x320], 0
je 0x180059aa6
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 5
jmp 0x180059aae
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
cmp byte [rbx + 0x200], 0
je 0x180059b3d
movzx ebx, byte [rbx + 0x248]
mov rax, qword [0x1802eea00]
mov rcx, qword [rax + 0x38]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 8]
call fcn.18008f580
mov eax, 0x306b
mov r8d, 0x306f
test bl, bl
cmovne r8d, eax
xor edx, edx
lea rcx, str.FPS
call fcn.18008c9d0
mov rax, qword [0x1802eea00]
movss xmm6, dword [rax + 0xd4]
cvtps2pd xmm6, xmm6
lea rcx, str.FPS_TITLE
call fcn.1800730a0
movaps xmm2, xmm6
movq r8, xmm6
mov rdx, rax
lea rcx, str._s:__.1f
call fcn.1800b26c0
call fcn.18008f620
call fcn.18008ee20
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
ret
Function at 0x18005bdc0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x18005be32
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r8 - 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x18005bdf0
mov ecx, dword [r10]
jmp 0x18005bf33
cmp ecx, 0x270
jb 0x18005bf33
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
mov rdx, qword [rbx + 8]
lea r8, [rbx + 8]
xor rdx, rax
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx + 0x4e0]
xor rcx, rdx
mov qword [rbx - 0x9c0], rcx
lea rbx, [r8]
sub rdi, 1
jne 0x18005be60
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov rax, qword [rbx]
nop
mov rdx, rax
lea r8, [rbx + 8]
xor rdx, qword [r8]
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx - 0xea0]
xor rcx, rdx
mov qword [rbx - 0x9c0], rcx
lea rbx, [r8]
sub rdi, 1
jne 0x18005beb0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 8]
mov rdi, qword [rsp]
btr edx, 0x1f
xor rdx, qword [r10 + 0x1380]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x18005c470
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1802e8038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x180328f18]
mov rbx, r8
lea rsi, [rdi + 0x164]
lea rcx, [rdi + 0x16c]
mov dword [rsi], 1
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + 0x168], ebx
add rbx, 8
je 0x18005c547
mov rax, qword [rdi]
test rax, rax
je 0x18005c505
mov rcx, qword [rax + 8]
cmp rcx, 0xffffffffffffffff
je 0x18005c505
test rsi, rsi
je 0x18005c505
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x18005c505
cmp dword [rsp + 0x30], ebx
je 0x18005c547
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x18005c524
mov eax, dword [rdi + 8]
dec eax
test eax, 0xfffffffd
jne 0x18005c524
mov ecx, dword [rdi + 0x60]
lea rdx, [rdi + 0x64]
call r8
mov rbx, qword [rdi]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
xor al, al
mov byte [rbx], 0
mov dword [rdi + 8], 0
jmp 0x18005c549
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180115350
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18005fdc0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1802e8038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rcx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], r8
lea rbx, [rcx + 8]
mov qword [rsp + 0x20], rbx
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18005fe06
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsi + 0x58]
call fcn.1800604f0
test rax, rax
jne 0x18005fe38
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x28]
lea rcx, [rsi + 0x58]
call fcn.180060970
mov rcx, qword [rax]
add rcx, 0x18
call fcn.180060040
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x28]
lea rcx, [rsi + 0x58]
call fcn.180060970
mov rdi, qword [rax]
mov r8, qword [rsp + 0x48]
movzx edx, r8b
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, byte [rsp + 0x49]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x4a]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x4b]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x4c]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x4d]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x4e]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x4f]
xor rdx, rax
imul rdx, rcx
mov rcx, qword [rdi + 0x48]
and rcx, rdx
shl rcx, 4
add rcx, qword [rdi + 0x30]
mov rax, qword [rcx + 8]
cmp rax, qword [rdi + 0x20]
je 0x18005fef9
mov rcx, qword [rcx]
cmp r8, qword [rax + 0x10]
je 0x18005fefb
cmp rax, rcx
je 0x18005fef9
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
jne 0x18005fee8
jmp 0x18005fefb
xor eax, eax
test rax, rax
jne 0x18005ff22
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
lea rcx, [rdi + 0x18]
call fcn.180060700
mov rdx, qword [rax]
mov byte [rdx + 0x18], 0
mov qword [rdx + 0x20], 0
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
lea rcx, [rdi + 0x18]
call fcn.180060700
mov rdi, qword [rax]
call qword [0x1802eec48]
mov r14, rax
mov ecx, dword [rsi]
add rcx, qword [rdi + 0x20]
cmp rcx, rax
jbe 0x18005ff52
movzx ebp, byte [rdi + 0x18]
jmp 0x18005ff71
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x50]
call qword [rax + 8]
movzx ebp, al
mov ecx, dword [rsi]
add rcx, r14
mov byte [rdi + 0x18], al
mov qword [rdi + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
movzx eax, bpl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180115350
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret