joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ac620
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov r8d, dword [0x18027a35c]
mov esi, ecx
xor ecx, ecx
mov ebx, ecx
test r8d, r8d
je 0x1800ac667
mov rax, qword [0x18027a350]
add rax, 0x20
nop word [rax + rax]
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x1800ac674
inc ebx
add rax, 0x38
cmp ebx, r8d
jb 0x1800ac650
mov eax, ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
cmp ebx, 0xffffffff
je 0x1800ac667
test esi, esi
mov qword [rsp + 0x48], rdi
mov edx, 0xffffffff
setne cl
mov r8d, ecx
lea rcx, [rsp + 0x20]
call fcn.1800ac330
mov edi, eax
test eax, eax
jne 0x1800ac75d
mov r9d, dword [0x18027a35c]
cmp ebx, r9d
jae 0x1800ac6ec
nop dword [rax + rax]
mov ecx, ebx
imul rdx, rcx, 0x38
mov rcx, qword [0x18027a350]
movzx r8d, byte [rdx + rcx + 0x20]
shr r8d, 1
and r8d, 1
cmp r8d, esi
je 0x1800ac6e5
mov edx, esi
mov ecx, ebx
call fcn.1800ac510
mov edi, eax
test eax, eax
jne 0x1800ac6ec
mov r9d, dword [0x18027a35c]
inc ebx
cmp ebx, r9d
jb 0x1800ac6b0
cmp qword [rsp + 0x20], 0
je 0x1800ac75b
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800ac747
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800ac738
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x1800ac710
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1802663d0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
Function at 0x1800b3240
Capabilities:
Allocate or change rwx memory
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
lea rcx, [rbp - 0x50]
call fcn.1800b2f60
nop
mov r8d, 1
lea rdx, [rbp - 0x50]
call fcn.1800b6280
nop
lea r9, [fcn.1800b3420]
mov edx, 0x60
lea r8d, [rdx - 0x5f]
lea rcx, [rbp - 0x50]
call fcn.1801b40c4
mov rbx, qword [0x180262508]
mov rdi, qword [0x180262510]
cmp rbx, rdi
je 0x1800b3402
lea rsi, str.BytePatch::Initialize___failed_to_initialize:_n___n___n
movabs r14, 0xb000000000000000
movabs r15, 0xb000000000000008
nop
cmp byte [rbx + 0x58], 0
jne 0x1800b33f5
mov r8, qword [rbx + 8]
mov rdx, qword [rbx]
call fcn.1801b3540
mov qword [rbx + 0x50], rax
test rax, rax
jne 0x1800b336c
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 0x38
mov rax, qword [rbx]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], r14
mov rax, qword [rbx + 8]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x30], 2
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
vmovups xmm0, xmmword [rsp + 0x30]
vmovdqa xmmword [rbp - 0x70], xmm0
vmovups xmm1, xmmword [rsp + 0x40]
vmovdqa xmmword [rbp - 0x60], xmm1
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x70]
call fcn.1800b7a90
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x70]
call fcn.1800a0370
jmp 0x1800b33f5
movsxd rcx, dword [rbx + 0x10]
add rcx, rax
mov qword [rbx + 0x50], rcx
lea r9, [rbp + 0x50]
mov r8d, 0x40
mov rdx, qword [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, qword [rbx + 0x48]
mov rdx, qword [rbx + 0x50]
mov rcx, qword [rbx + 0x30]
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rbp + 0x60]
mov r8d, dword [rbp + 0x50]
mov rdx, qword [rbx + 0x48]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r9, [rbp + 0x58]
mov r8d, 0x40
mov rdx, qword [rbx + 0x48]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, qword [rbx + 0x48]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x50]
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rbp + 0x68]
mov r8d, dword [rbp + 0x58]
mov rdx, qword [rbx + 0x48]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx + 0x58], 1
add rbx, 0x60
cmp rbx, rdi
jne 0x1800b32c0
add rsp, 0x118
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800b34d0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdi, qword [0x180262510]
mov rbx, qword [0x180262508]
cmp rbx, rdi
je 0x1800b3547
cmp byte [rbx + 0x58], 0
je 0x1800b353e
mov rdx, qword [rbx + 0x48]
lea r9, [rsp + 0x30]
mov rcx, qword [rbx + 0x50]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, qword [rbx + 0x48]
mov rdx, qword [rbx + 0x30]
mov rcx, qword [rbx + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x38]
mov rdx, qword [rbx + 0x48]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx + 0x58], 0
add rbx, 0x60
cmp rbx, rdi
jne 0x1800b34f2
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800b9930
Capabilities:
Hash data using fnv

Disassembly:
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov r9d, 1
bsr r8, rax
mov rsi, rcx
shlx rax, r9, r8
cmp rdx, rax
jbe 0x1800b9965
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, r9
bsr rcx, rax
mov qword [rsp + 0x40], rdi
mov r8, rbx
inc ecx
mov qword [rsp + 0x48], r14
shlx rdi, r9, rcx
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1800a0700
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800b9ab4
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rbp
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800b9a2d
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800b9aa3
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1800b9a6a
mov r10, qword [rdx]
cmp r10, rax
je 0x1800b9a64
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800b9aa3
cmp r9, rdx
je 0x1800b9a7f
nop
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1800b9ac9
cmp r9, rdx
jne 0x1800b9a70
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1800b99e0
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800b9aa3
Function at 0x1800b9b40
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1800b9bec
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x1800b9b7a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x20
pop rdi
jmp 0x1800b9e60
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x1800b9bba
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x20
call fcn.1801b3bbc
mov rcx, rbx
test rbx, rbx
jne 0x1800b9ba0
mov rbx, qword [rsp + 0x38]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
call fcn.1800a2a60
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x1800b9f5e
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x38], rdi
mov rbx, r14
mov qword [rsp + 0x30], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
xor rcx, rax
mov qword [rsp + 0x28], r13
movzx eax, byte [r14 + 0x11]
mov r13, qword [r14 + 8]
imul rcx, r8
mov qword [rsp + 0x20], r15
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
mov qword [rsp + 0x78], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x68], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x70], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.1801b3bbc
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x70]
je 0x1800b9f6a
cmp rbx, rbp
jne 0x1800b9f10
cmp qword [rsp + 0x68], r14
jne 0x1800b9f3d
mov qword [r15], rbx
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x68], r14
jne 0x1800b9f79
mov qword [r15], r12
mov rax, r12
jmp 0x1800b9f7c
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x1800b9f3d
nop word [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.1801b3bbc
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x1800ba016
cmp rbx, rbp
jne 0x1800b9ff0
jmp 0x1800b9f3a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x1800b9f90
jmp 0x1800b9f3d
Function at 0x1800b9c00
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1800b9cac
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x1800b9c3a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x20
pop rdi
jmp 0x1800ba030
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x1800b9c7a
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x28
call fcn.1801b3bbc
mov rcx, rbx
test rbx, rbx
jne 0x1800b9c60
mov rbx, qword [rsp + 0x38]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
call fcn.1800a2a60
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x1800ba12e
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x38], rdi
mov rbx, r14
mov qword [rsp + 0x30], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
xor rcx, rax
mov qword [rsp + 0x28], r13
movzx eax, byte [r14 + 0x11]
mov r13, qword [r14 + 8]
imul rcx, r8
mov qword [rsp + 0x20], r15
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
mov qword [rsp + 0x78], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x68], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x70], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x28
call fcn.1801b3bbc
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x70]
je 0x1800ba13a
cmp rbx, rbp
jne 0x1800ba0e0
cmp qword [rsp + 0x68], r14
jne 0x1800ba10d
mov qword [r15], rbx
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x68], r14
jne 0x1800ba149
mov qword [r15], r12
mov rax, r12
jmp 0x1800ba14c
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x1800ba10d
nop word [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x28
call fcn.1801b3bbc
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x1800ba1e6
cmp rbx, rbp
jne 0x1800ba1c0
jmp 0x1800ba10a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x1800ba160
jmp 0x1800ba10d
Function at 0x1800b9e60
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1800b9bec
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x1800b9b7a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x20
pop rdi
jmp 0x1800b9e60
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x1800b9bba
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x20
call fcn.1801b3bbc
mov rcx, rbx
test rbx, rbx
jne 0x1800b9ba0
mov rbx, qword [rsp + 0x38]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
call fcn.1800a2a60
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x1800b9f5e
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x38], rdi
mov rbx, r14
mov qword [rsp + 0x30], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
xor rcx, rax
mov qword [rsp + 0x28], r13
movzx eax, byte [r14 + 0x11]
mov r13, qword [r14 + 8]
imul rcx, r8
mov qword [rsp + 0x20], r15
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
mov qword [rsp + 0x78], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x68], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x70], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.1801b3bbc
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x70]
je 0x1800b9f6a
cmp rbx, rbp
jne 0x1800b9f10
cmp qword [rsp + 0x68], r14
jne 0x1800b9f3d
mov qword [r15], rbx
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x68], r14
jne 0x1800b9f79
mov qword [r15], r12
mov rax, r12
jmp 0x1800b9f7c
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x1800b9f3d
nop word [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.1801b3bbc
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x1800ba016
cmp rbx, rbp
jne 0x1800b9ff0
jmp 0x1800b9f3a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x1800b9f90
jmp 0x1800b9f3d
Function at 0x1800ba030
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1800b9cac
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x1800b9c3a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x20
pop rdi
jmp 0x1800ba030
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x1800b9c7a
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x28
call fcn.1801b3bbc
mov rcx, rbx
test rbx, rbx
jne 0x1800b9c60
mov rbx, qword [rsp + 0x38]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
call fcn.1800a2a60
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x1800ba12e
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x38], rdi
mov rbx, r14
mov qword [rsp + 0x30], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
xor rcx, rax
mov qword [rsp + 0x28], r13
movzx eax, byte [r14 + 0x11]
mov r13, qword [r14 + 8]
imul rcx, r8
mov qword [rsp + 0x20], r15
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
mov qword [rsp + 0x78], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x68], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x70], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x28
call fcn.1801b3bbc
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x70]
je 0x1800ba13a
cmp rbx, rbp
jne 0x1800ba0e0
cmp qword [rsp + 0x68], r14
jne 0x1800ba10d
mov qword [r15], rbx
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x68], r14
jne 0x1800ba149
mov qword [r15], r12
mov rax, r12
jmp 0x1800ba14c
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x1800ba10d
nop word [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x28
call fcn.1801b3bbc
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x1800ba1e6
cmp rbx, rbp
jne 0x1800ba1c0
jmp 0x1800ba10a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x1800ba160
jmp 0x1800ba10d
Function at 0x1800c3580
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
nop word [rax + rax]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], 0x7a
lea rdx, [rsp + 0x20]
call fcn.1801b2f80
mov rcx, qword [rax]
cmp byte [rcx + 0x18], 0
je 0x1800c35f6
mov rbx, qword [0x180267f40]
test rbx, rbx
jne 0x1800c35eb
nop dword [rax]
lea rdx, [0x180267f40]
lea rcx, [0x1801ad420]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [0x180267f40]
test rbx, rbx
je 0x1800c35c0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rbx
je 0x1800c360c
cmp byte [0x1802677cc], 0
jne 0x1800c360c
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800c3590
add rsp, 0x30
pop rbx
ret
Function at 0x1800c3ca0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x1800c3ced
lea rdx, [0x1801b1410]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
xor eax, eax
lea r8, [0x1800c3c70]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800c3ced
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x1800c3d00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov edx, dword [0x180265dfc]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x180267810], edx
jle 0x1800c3de1
lea rcx, [0x180267810]
call fcn.1801b3c6c
cmp dword [0x180267810], 0xffffffff
jne 0x1800c3de1
mov rcx, qword [0x1802676e0]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov r10, rax
xor r11d, r11d
test rax, rax
je 0x1800c3dce
mov r8, qword [r10 + 0x10]
mov rax, 0xffffffffffffffff
mov r9d, 0x811c9dc5
inc rax
cmp byte [r8 + rax], r11b
jne 0x1800c3d72
mov rdx, r11
test rax, rax
je 0x1800c3db0
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [rdx + r8]
xor ecx, r9d
imul r9d, ecx, 0x1000193
inc rdx
cmp rdx, rax
jb 0x1800c3d90
cmp r9d, 0xcd91f684
je 0x1800c3dbb
mov r10, qword [r10 + 0x20]
test r10, r10
jne 0x1800c3d61
jmp 0x1800c3dce
lea r8, str.m_iItemDefinitionIndex
mov rdx, qword [r10 + 0x18]
call fcn.1801b3800
mov r11d, eax
mov dword [0x18026781c], r11d
lea rcx, [0x180267810]
call fcn.1801b3c00
movsxd rax, dword [0x18026781c]
add rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1800c3e00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov edx, dword [0x180265dfc]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x180267814], edx
jle 0x1800c3ee1
lea rcx, [0x180267814]
call fcn.1801b3c6c
cmp dword [0x180267814], 0xffffffff
jne 0x1800c3ee1
mov rcx, qword [0x1802676e0]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov r10, rax
xor r11d, r11d
test rax, rax
je 0x1800c3ece
mov r8, qword [r10 + 0x10]
mov rax, 0xffffffffffffffff
mov r9d, 0x811c9dc5
inc rax
cmp byte [r8 + rax], r11b
jne 0x1800c3e72
mov rdx, r11
test rax, rax
je 0x1800c3eb0
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [rdx + r8]
xor ecx, r9d
imul r9d, ecx, 0x1000193
inc rdx
cmp rdx, rax
jb 0x1800c3e90
cmp r9d, 0x7a1c884e
je 0x1800c3ebb
mov r10, qword [r10 + 0x20]
test r10, r10
jne 0x1800c3e61
jmp 0x1800c3ece
lea r8, str.m_lifeState
mov rdx, qword [r10 + 0x18]
call fcn.1801b3800
mov r11d, eax
mov dword [0x1802677d0], r11d
lea rcx, [0x180267814]
call fcn.1801b3c00
movsxd rax, dword [0x1802677d0]
add rax, rbx
add rsp, 0x20
pop rbx
ret