joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ab70
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14000ab7d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14000ab8d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14000ab75
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14000aba5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14000ab92
sub eax, 3
jb 0x14000abbf
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14000abf6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14000abe6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14000abe4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14000abd3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14000ab32
jmp 0x14000ab7d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x8000]
mov eax, dword [rdi]
or eax, eax
je 0x14000ac52
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xa000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14000ac02
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14000ac4c
mov qword [rbx], rax
add rbx, 8
jmp 0x14000ac22
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14000acaa
sub rsp, 0xffffffffffffff80
jmp section.UPX0
Function at 0x140001100
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd r13, dword [rcx + 0x3c]
xor r15d, r15d
mov rbp, rdx
mov rdi, rcx
mov r10d, r15d
mov ebx, dword [r13 + rcx + 0x88]
add rbx, rcx
mov r14d, dword [rbx + 0x1c]
mov r11d, dword [rbx + 0x20]
add r14, rcx
mov r12d, dword [rbx + 0x24]
add r11, rcx
add r12, rcx
cmp rdx, 0x10000
jae 0x14000117c
mov r8d, dword [rbx + 0x10]
movzx edx, bp
cmp edx, r8d
jb 0x1400012c7
mov ecx, dword [rbx + 0x14]
add ecx, r8d
cmp edx, ecx
jae 0x1400012c7
sub edx, r8d
mov r10d, dword [r14 + rdx*4]
jmp 0x1400011d1
mov esi, dword [rbx + 0x18]
mov r9d, r15d
test esi, esi
je 0x1400011d4
nop word [rax + rax]
mov r8d, dword [r11]
mov rax, rbp
add r8, rdi
sub r8, rbp
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400011b3
inc rax
test ecx, ecx
jne 0x1400011a0
test edx, edx
je 0x1400011c5
inc r9d
add r11, 4
cmp r9d, esi
jb 0x140001190
jmp 0x1400011d4
mov eax, r9d
movzx ecx, word [r12 + rax*2]
mov r10d, dword [r14 + rcx*4]
add r10, rdi
cmp r10, rbx
jb 0x1400012a7
mov eax, dword [r13 + rdi + 0x8c]
lea rdx, [rax + rax*4]
lea rax, [rbx + rdx*8]
cmp r10, rax
jae 0x1400012a7
mov rcx, r10
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rsi, rax
test rax, rax
je 0x1400012c7
mov edx, 0x2e
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strchr]
mov r14, rax
mov byte [rax], r15b
mov rax, qword [0x140004668]
test rax, rax
jne 0x140001282
mov rcx, qword gs:[0x60]
mov rdi, qword [rcx + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140001267
mov rcx, qword [rbx + 0x50]
lea rdx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140001263
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140001244
jmp 0x140001267
mov r15, qword [rbx + 0x20]
lea rdx, str.LoadLibraryA
mov rcx, r15
call fcn.140001100
mov qword [0x140004668], rax
test rax, rax
je 0x1400012c7
mov rcx, rsi
call rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x1400012c7
lea rdx, [r14 + 1]
mov rcx, rbx
call fcn.140001100
mov r10, rax
mov rax, r10
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor eax, eax
jmp 0x1400012aa

Function at 0x140001ba0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001bea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001bea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001bea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001bea
cmp dword [rcx + 0x84], 0xe
jbe 0x140001bea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001bec
xor al, al
add rsp, 0x28
ret
Function at 0x140e87860
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140e8786a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140e87893
pop rbp
sub rbp, 0x33
sub rbp, 0xe87860
sub rsp, 0x20
jmp 0x140e878b2
mov rax, 0xe87860
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffff85dfc090
xor byte [rax], dl
inc rax
dec rcx
jne 0x140e878d1
jmp 0x140e878e8
and ebp, dword [rbx + 0x16]
fcomp dword [rcx]
jns 0x140e87907
sbb dword [rax + rdx*4 + 0x11d89090], ebp
push rcx
cwde
xchg ecx, eax
nop
nop
fcom dword [rcx + 0x5057d879]
xchg edi, eax
nop
nop
nop
fcom dword [rdi + 0x52]
mov eax, 0xd8909090
jb 0x140e878e5
nop
nop
fsub dword [rdi + 0x72]
fcom dword [rcx - 0x63eee4af]
xchg ecx, eax
push rcx
sbb edx, dword [rcx]
pushfq
nop
nop
nop
fcom dword [rcx - 0x273f3f88]
sub al, bl
mov dl, 0xb9
nop
nop
nop
nop
nop
fsubr dword [rcx]
xchg esi, eax
invalid
Function at 0x18001680c
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
xor r10d, r10d
mov rbx, rdx
mov r11, rcx
test r9b, r9b
je 0x18001685e
test r8, r8
je 0x180016881
movabs r9, 0x100000001b3
mov al, byte [r10 + rbx]
mov dl, byte [r10 + rbx]
add al, 0x20
movzx ecx, al
sub dl, 0x41
movzx eax, byte [r10 + rbx]
cmp dl, 0x19
cmova ecx, eax
inc r10
imul r11, r9
movsx rax, cl
xor r11, rax
cmp r10, r8
jb 0x18001682e
jmp 0x180016881
test r8, r8
je 0x180016881
movabs r9, 0x100000001b3
movsx rcx, byte [r10 + rdx]
inc r10
imul r11, r9
xor r11, rcx
cmp r10, r8
jb 0x18001686d
mov rbx, qword [rsp + 8]
mov rax, r11
ret

Function at 0x180016b24
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r8d, r8d
movzx eax, byte [r8 + rdx]
movabs r9, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, r9
cmp r8, 8
jb 0x180016aff
mov rax, rcx
ret
mov rdx, rcx
movabs rcx, 0xcbf29ce484222325
jmp 0x180016afc

Function at 0x180017d80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r8d, r8d
cmp byte [rcx], r8b
je 0x180017d92
inc r8
cmp byte [r8 + rcx], 0
jne 0x180017d88
mov r9b, dl
mov rdx, rcx
movabs rcx, 0xcbf29ce484222325
jmp fcn.18001680c
Function at 0x180017ed8
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rsi
push rdi
push r14
sub rsp, 0x38
lea rax, [r11 + 0x10]
mov qword [r11 - 0x38], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r11d, dword [rcx + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x180017f7f
mov r10d, dword [r11 + 0x18]
test r10d, r10d
je 0x180017f7f
mov r14d, dword [r11 + 0x20]
dec r10d
mov edi, 0x312ae6e7
lea rcx, [r14 + r10*4]
mov r9d, dword [rcx + r8]
add r9, r8
mov bl, byte [r9]
inc r9
test bl, bl
je 0x180017f7a
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r9]
cmova edx, ecx
inc r9
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x180017f4f
cmp edi, 0x73264f21
je 0x180017f84
test r10d, r10d
jne 0x180017f32
mov rax, qword [rax]
jmp 0x180017f0d
mov ecx, dword [r11 + 0x24]
mov r9, qword [rsp + 0x20]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov edx, 0x200
add rax, r8
lea rcx, [0x180083d20]
mov r8, qword [rsp + 0x60]
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r9d, dword [rcx + r10 + 0x88]
add r9, r10
cmp r9, r10
je 0x180018038
mov r8d, dword [r9 + 0x18]
test r8d, r8d
je 0x180018038
mov r14d, dword [r9 + 0x20]
dec r8d
mov esi, 0x3037b147
lea rcx, [r14 + r8*4]
mov r11d, dword [rcx + r10]
add r11, r10
mov bl, byte [r11]
inc r11
test bl, bl
je 0x180018033
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r11]
cmova edx, ecx
inc r11
xor edx, esi
imul esi, edx, 0x1000193
test bl, bl
jne 0x180018008
cmp esi, 0xff9560e3
je 0x18001803d
test r8d, r8d
jne 0x180017feb
mov rax, qword [rax]
jmp 0x180017fc6
mov edx, dword [r9 + 0x24]
lea rcx, [0x180083d20]
add rdx, r10
movzx r8d, word [rdx + r8*2]
mov edx, dword [r9 + 0x1c]
add rdx, r10
mov r9d, dword [rdx + r8*4]
add r9, r10
call r9
lea rax, [0x180083d20]
add rsp, 0x38
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x180019050
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x48
xor r11d, r11d
mov r8, rcx
mov edx, r11d
cmp word [rcx], r11w
je 0x18001906d
inc rdx
cmp word [rcx + rdx*2], r11w
jne 0x180019063
movabs r9, 0xcbf29ce484222325
mov r10, r11
test rdx, rdx
je 0x1800190b7
movzx eax, word [r8 + r10*2]
movzx ecx, word [r8 + r10*2]
sub ax, 0x41
add cx, 0x20
cmp ax, 0x19
cmova cx, word [r8 + r10*2]
inc r10
movzx eax, cx
movabs rcx, 0x100000001b3
imul r9, rcx
xor r9, rax
cmp r10, rdx
jb 0x18001907f
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], r11
lea rcx, [0x180019040]
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x20], r9
call fcn.180019188
neg al
sbb rax, rax
and rax, qword [rsp + 0x28]
add rsp, 0x48
ret
Function at 0x18002acdc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r10d, r10d
mov r11, rcx
test r9b, r9b
je 0x18002ad26
test r8, r8
je 0x18002ad49
movabs r9, 0x100000001b3
movzx eax, word [rdx + r10*2]
movzx ecx, word [rdx + r10*2]
sub ax, 0x41
add cx, 0x20
cmp ax, 0x19
cmova cx, word [rdx + r10*2]
inc r10
imul r11, r9
movzx eax, cx
xor r11, rax
cmp r10, r8
jb 0x18002acf6
jmp 0x18002ad49
test r8, r8
je 0x18002ad49
movabs r9, 0x100000001b3
movzx ecx, word [rdx + r10*2]
inc r10
imul r11, r9
xor r11, rcx
cmp r10, r8
jb 0x18002ad35
mov rax, r11
ret
Function at 0x18004c1f0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov r15, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov ebx, dword [rcx + r8 + 0x88]
add rbx, r8
cmp rbx, r8
je 0x18004c297
mov r10d, dword [rbx + 0x18]
test r10d, r10d
je 0x18004c297
mov esi, dword [rbx + 0x20]
dec r10d
mov edi, 0x222e2948
lea rcx, [rsi + r10*4]
mov r9d, dword [rcx + r8]
add r9, r8
mov r11b, byte [r9]
inc r9
test r11b, r11b
je 0x18004c292
movsx ecx, r11b
sub r11b, 0x41
mov edx, ecx
or edx, 0x20
cmp r11b, 0x19
mov r11b, byte [r9]
cmova edx, ecx
inc r9
xor edx, edi
imul edi, edx, 0x1000193
test r11b, r11b
jne 0x18004c263
cmp edi, 0xbff26b64
je 0x18004c29c
test r10d, r10d
jne 0x18004c245
mov rax, qword [rax]
jmp 0x18004c221
mov ecx, dword [rbx + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov rdx, r15
add rax, r8
xor ecx, ecx
xor r8d, r8d
call rax
mov rcx, 0xffffffffffffffff
lea r12, [rax + 1]
mov eax, 2
mul r12
cmovo rax, rcx
mov rcx, rax
call fcn.180019480
mov rcx, qword gs:[0x60]
mov rbp, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov r10d, dword [rdx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x18004c362
mov r11d, dword [r10 + 0x18]
test r11d, r11d
je 0x18004c362
mov r14d, dword [r10 + 0x20]
dec r11d
mov edi, 0xcf1f5930
lea rax, [r14 + r11*4]
mov r8d, dword [rax + r9]
add r8, r9
mov bl, byte [r8]
inc r8
test bl, bl
je 0x18004c35d
movsx eax, bl
sub bl, 0x41
mov edx, eax
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r8]
cmova edx, eax
inc r8
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x18004c332
cmp edi, 0xac038e4c
je 0x18004c367
test r11d, r11d
jne 0x18004c315
mov rcx, qword [rcx]
jmp 0x18004c2f0
mov ecx, dword [r10 + 0x24]
mov r8, r12
add rcx, r9
movzx edx, word [rcx + r11*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
mov rdx, r15
add rax, r9
mov rcx, rbp
call rax
mov rbx, qword [rsp + 0x40]
mov rax, rbp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x180054e54
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, rdx
mov r13, r8
xor edx, edx
mov rdi, rcx
test r12, r12
je 0x180054f1d
test rcx, rcx
je 0x180054f1d
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180054f1d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x180054f1d
test rax, rax
je 0x180054f1d
add rax, 0x88
je 0x180054f1d
mov ebx, dword [rax]
add rbx, rcx
je 0x180054f1d
cmp dword [rbx + 0x1c], edx
je 0x180054f1d
cmp dword [rbx + 0x20], edx
je 0x180054f1d
cmp dword [rbx + 0x24], edx
je 0x180054f1d
mov r14d, dword [rbx + 0x1c]
mov esi, edx
mov ebp, dword [rbx + 0x20]
add r14, rcx
mov r15d, dword [rbx + 0x24]
add rbp, rcx
add r15, rcx
cmp dword [rbx + 0x18], edx
jbe 0x180054f1d
mov ecx, esi
movzx r8d, word [r15 + rcx*2]
cmp dword [r14 + r8*4], edx
je 0x180054f16
cmp dword [rbp + rcx*4], edx
je 0x180054f16
mov r9d, dword [rbp + rcx*4]
mov rcx, r13
mov edx, dword [r14 + r8*4]
add r9, rdi
add rdx, rdi
call r12
xor edx, edx
test al, al
jne 0x180054f3c
inc esi
cmp esi, dword [rbx + 0x18]
jb 0x180054ee8
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov al, 1
jmp 0x180054f1f
Function at 0x180067ae4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [rcx - 0x10000]
mov rsi, rcx
movabs rcx, 0x7ffffffeffff
mov rbx, rdx
cmp rax, rcx
ja 0x180067c00
movabs rax, 0x458cc1eac803cde9
xor r9d, r9d
mov qword [r11 - 0x28], rax
movabs rax, 0x5077ce94ca103e1
mov qword [r11 - 0x20], rax
movabs rax, 0x32feaeacb167a2ab
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0x5077ce94cc57180
mov qword [rsp + 0x38], rax
pxor xmm0, xmmword [rsp + 0x30]
movq rax, xmm0
movdqa xmmword [rsp + 0x20], xmm0
test al, al
je 0x180067b77
inc r9
cmp byte [rsp + r9 + 0x20], 0
jne 0x180067b6c
xor r10d, r10d
movabs rdi, 0xcbf29ce484222325
test r9, r9
je 0x180067bbd
movzx edx, byte [rsp + r10 + 0x20]
lea eax, [rdx + 0x20]
movzx ecx, al
lea r8d, [rdx - 0x41]
cmp r8b, 0x19
cmova ecx, edx
inc r10
movsx rax, cl
movabs rcx, 0x100000001b3
imul rdi, rcx
xor rdi, rax
cmp r10, r9
jb 0x180067b89
mov rax, qword [0x18008ac48]
test rax, rax
jne 0x180067be4
call fcn.180018fbc
mov rcx, rax
lea rdx, str.PlayerEyes
call fcn.1800171bc
mov qword [0x18008ac48], rax
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.180017bc0
mov rdx, rsi
mov rcx, rbx
mov r8, qword [rax]
call r8
jmp 0x180067c11
xorps xmm3, xmm3
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, rbx
call fcn.18006b45c
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x180067c24
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [rcx - 0x10000]
mov rsi, rcx
movabs rcx, 0x7ffffffeffff
mov rbx, rdx
cmp rax, rcx
ja 0x180067d40
movabs rax, 0x5a99c7fec803cde9
xor r9d, r9d
mov qword [r11 - 0x28], rax
movabs rax, 0x5077ce94cc571f4
mov qword [r11 - 0x20], rax
movabs rax, 0x32feaeacb167a2ab
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0x5077ce94cc57180
mov qword [rsp + 0x38], rax
pxor xmm0, xmmword [rsp + 0x30]
movq rax, xmm0
movdqa xmmword [rsp + 0x20], xmm0
test al, al
je 0x180067cb7
inc r9
cmp byte [rsp + r9 + 0x20], 0
jne 0x180067cac
xor r10d, r10d
movabs rdi, 0xcbf29ce484222325
test r9, r9
je 0x180067cfd
movzx edx, byte [rsp + r10 + 0x20]
lea eax, [rdx + 0x20]
movzx ecx, al
lea r8d, [rdx - 0x41]
cmp r8b, 0x19
cmova ecx, edx
inc r10
movsx rax, cl
movabs rcx, 0x100000001b3
imul rdi, rcx
xor rdi, rax
cmp r10, r9
jb 0x180067cc9
mov rax, qword [0x18008ac48]
test rax, rax
jne 0x180067d24
call fcn.180018fbc
mov rcx, rax
lea rdx, str.PlayerEyes
call fcn.1800171bc
mov qword [0x18008ac48], rax
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.180017bc0
mov rdx, rsi
mov rcx, rbx
mov r8, qword [rax]
call r8
jmp 0x180067d51
xorps xmm3, xmm3
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, rbx
call fcn.18006b45c
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180068d64
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [rcx - 0x10000]
mov rsi, rcx
movabs rcx, 0x7ffffffeffff
mov rbx, rdx
cmp rax, rcx
ja 0x180068e80
movabs rax, 0x458cc1ead506c7e3
xor r9d, r9d
mov qword [r11 - 0x28], rax
movabs rax, 0x5077ce94ca103e1
mov qword [r11 - 0x20], rax
movabs rax, 0x32feaeacb167a2ab
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0x5077ce94cc57180
mov qword [rsp + 0x38], rax
pxor xmm0, xmmword [rsp + 0x30]
movq rax, xmm0
movdqa xmmword [rsp + 0x20], xmm0
test al, al
je 0x180068df7
inc r9
cmp byte [rsp + r9 + 0x20], 0
jne 0x180068dec
xor r10d, r10d
movabs rdi, 0xcbf29ce484222325
test r9, r9
je 0x180068e3d
movzx edx, byte [rsp + r10 + 0x20]
lea eax, [rdx + 0x20]
movzx ecx, al
lea r8d, [rdx - 0x41]
cmp r8b, 0x19
cmova ecx, edx
inc r10
movsx rax, cl
movabs rcx, 0x100000001b3
imul rdi, rcx
xor rdi, rax
cmp r10, r9
jb 0x180068e09
mov rax, qword [0x18008ac48]
test rax, rax
jne 0x180068e64
call fcn.180018fbc
mov rcx, rax
lea rdx, str.PlayerEyes
call fcn.1800171bc
mov qword [0x18008ac48], rax
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.180017bc0
mov rdx, rsi
mov rcx, rbx
mov r8, qword [rax]
call r8
jmp 0x180068e91
xorps xmm3, xmm3
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, rbx
call fcn.18006b45c
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x18006d250
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
lea rax, [rcx - 0x10000]
movabs rdx, 0x7ffffffeffff
cmp rax, rdx
ja 0x18006d2d9
mov rax, qword [rcx]
xor r9d, r9d
test rax, rax
je 0x18006d2d9
mov rbx, qword [rax + 0x10]
mov r10d, r9d
cmp byte [rbx], r9b
je 0x18006d28b
inc r10
cmp byte [r10 + rbx], r9b
jne 0x18006d282
movabs r11, 0xcbf29ce484222325
test r10, r10
je 0x18006d2d4
mov al, byte [r9 + rbx]
movzx ecx, byte [r9 + rbx]
add al, 0x20
mov r8b, byte [r9 + rbx]
sub r8b, 0x41
movzx edx, al
cmp r8b, 0x19
movabs rax, 0x100000001b3
cmova edx, ecx
inc r9
imul r11, rax
movsx rcx, dl
xor r11, rcx
cmp r9, r10
jb 0x18006d29a
mov rax, r11
jmp 0x18006d2db
xor eax, eax
mov rbx, qword [rsp + 8]
ret
Function at 0x18006e46c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
cmp edx, 1
jne 0x18006e60f
call fcn.18006da4c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18006e519
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x18006e519
mov r14d, dword [r9 + 0x20]
dec r10d
mov esi, 0xa5b49d66
lea rcx, [r14 + r10*4]
mov r11d, dword [rcx + r8]
add r11, r8
mov bl, byte [r11]
inc r11
test bl, bl
je 0x18006e514
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r11]
cmova edx, ecx
inc r11
xor edx, esi
imul esi, edx, 0x1000193
test bl, bl
jne 0x18006e4e9
cmp esi, 0x98017e76
je 0x18006e51e
test r10d, r10d
jne 0x18006e4cc
mov rax, qword [rax]
jmp 0x18006e4a7
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov rcx, rdi
add rax, r8
call rax
mov rax, qword [0x18008b000]
test rax, rax
jne 0x18006e5f4
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18006e5cf
mov r11d, dword [r9 + 0x18]
test r11d, r11d
je 0x18006e5cf
mov r14d, dword [r9 + 0x20]
dec r11d
mov esi, 0x234c01fe
lea rcx, [r14 + r11*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov bl, byte [r10]
inc r10
test bl, bl
je 0x18006e5ca
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r10]
cmova edx, ecx
inc r10
xor edx, esi
imul esi, edx, 0x1000193
test bl, bl
jne 0x18006e59f
cmp esi, 0x5e6acd1e
je 0x18006e5d4
test r11d, r11d
jne 0x18006e582
mov rax, qword [rax]
jmp 0x18006e55d
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r11*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov qword [0x18008b000], rax
and qword [rsp + 0x28], 0
lea r8, [0x18006da98]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret