joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800082c0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x18025e060]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rbx, [0x180262b50]
mov r8d, 0x32
mov rdx, rbx
lea rcx, str.TERM
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x18000832e
cmp byte [0x180262b50], 0
je 0x18000832e
xor eax, eax
mov qword [rsp + 0x38], 0xf
mov qword [rsp + 0x20], rax
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
nop dword [rax + rax]
inc r8
cmp byte [rbx + r8], al
jne 0x180008320
mov rdx, rbx
jmp 0x18000834d
xor eax, eax
mov qword [rsp + 0x38], 0xf
mov qword [rsp + 0x20], rax
lea rdx, [0x1800a9453]
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rcx, [rsp + 0x20]
call fcn.18001c600
mov rax, qword [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x20]
cmp rax, 0x10
mov r8, qword [rsp + 0x30]
cmovae rdx, rcx
cmp r8, 5
jne 0x18000838b
cmp dword [rdx], 0x72657478
jne 0x18000838b
cmp byte [rdx + 4], 0x6d
je 0x180008459
cmp rax, 0x10
lea rdx, [rsp + 0x20]
cmovae rdx, rcx
cmp r8, 0xb
jne 0x1800083bf
movabs r9, 0x6f632d6d72657478
cmp qword [rdx], r9
jne 0x1800083bf
cmp word [rdx + 8], 0x6f6c
jne 0x1800083bf
cmp byte [rdx + 0xa], 0x72
je 0x180008459
cmp rax, 0x10
lea rdx, [rsp + 0x20]
cmovae rdx, rcx
cmp r8, 0xe
jne 0x1800083f2
movabs r9, 0x35322d6d72657478
cmp qword [rdx], r9
jne 0x1800083f2
cmp dword [rdx + 8], 0x6c6f6336
jne 0x1800083f2
cmp word [rdx + 0xc], 0x726f
je 0x180008459
cmp rax, 0x10
lea rdx, [rsp + 0x20]
cmovae rdx, rcx
cmp r8, 6
jne 0x180008415
cmp dword [rdx], 0x65726373
jne 0x180008415
cmp word [rdx + 4], 0x6e65
je 0x180008459
cmp rax, 0x10
lea rdx, [rsp + 0x20]
cmovae rdx, rcx
cmp r8, 5
jne 0x180008436
cmp dword [rdx], 0x756e696c
jne 0x180008436
cmp byte [rdx + 4], 0x78
je 0x180008459
cmp rax, 0x10
lea rdx, [rsp + 0x20]
cmovae rdx, rcx
cmp r8, 6
jne 0x18000845d
cmp dword [rdx], 0x77677963
jne 0x18000845d
cmp word [rdx + 4], 0x6e69
jne 0x18000845d
mov bl, 1
jmp 0x18000845f
xor bl, bl
cmp rax, 0x10
jb 0x18000848f
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000848a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800084a5
call fcn.180067160
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180067140
add rsp, 0x50
pop rbx
ret
call fcn.1800785f0
int3
Function at 0x1800174c0
Capabilities:
Create thread
Set console window title

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test edx, edx
je 0x18001758b
cmp edx, 1
jne 0x1800175b8
call fcn.180013220
cmp qword [0x18025f0d0], 0x10
lea rax, [0x18025f0b8]
cmovae rax, qword [0x18025f0b8]
cmp qword [0x18025f0c8], 4
jne 0x180017558
cmp dword [rax], 0x6e65706f
jne 0x180017558
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call fcn.18006e0b4
mov r8, rax
lea rdx, [0x1800aa250]
lea rcx, str.CONOUT_
call fcn.18006de20
xor ecx, ecx
call fcn.18006e0b4
mov r8, rax
lea rdx, [0x1800aa260]
lea rcx, str.CONIN_
call fcn.18006de20
lea rcx, str.FLS_Engine_Log
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x180017460]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret
cmp dword [0x180262acc], 0
je 0x1800175b8
xor edx, edx
xor ecx, ecx
call fcn.1800658b0
mov rcx, qword [0x180262b08]
call fcn.180072d78
xor eax, eax
mov qword [0x180262b08], rax
mov dword [0x180262acc], eax
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x180019020
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x180019042
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1800190bc
mov rdi, r14
mov rcx, rbx
call fcn.18001c140
test rax, rax
jle 0x180019094
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.180069510
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1800190ac
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1800190b4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x180019056
sub r14, rdi
jmp 0x1800191a9
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1800190d3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800190d5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18001910a
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.180069510
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1800191a6
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x180019145
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x180019181
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.180077b2c
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x1800191bf
cmp rbp, rax
ja 0x180019151
mov r8, rdi
test rdi, rdi
je 0x1800191a6
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.180077b2c
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x1800191a9
Function at 0x1800195c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x18025e060]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1800195ed
xor eax, eax
jmp 0x180019733
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180019627
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180019627
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x180019733
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x180019726
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18001966a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180019679
movsx ecx, dil
jmp 0x1800196cd
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
je 0x1800196e7
sub eax, 1
je 0x1800196e7
cmp eax, 2
jne 0x180019726
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.18006de68
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18001972b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180019714
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.180072a78
cmp rsi, rax
jne 0x180019726
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x18001972b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180067140
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x180024230
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18002428d
lea rbx, [0x180241da0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180024274
cmp r10, 2
jb 0x180024274
cmp byte [r9], r8b
jne 0x180024274
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180024250
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1800242cf
lea rbx, [0x180241da0]
cmp r8b, 0x23
jne 0x1800242b3
cmp byte [r9], r8b
jne 0x1800242b3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1800242a0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x180024480
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rsi, r8
mov rbx, rcx
test rcx, rcx
jne 0x1800244ae
mov r8d, 0x641
lea rdx, str.E:_vs_space2K23FlsEngine.2K2323_FlsEngine_Easy_Core_srcimguiimgui.cpp
lea rcx, str.filename__mode
call fcn.18007c198
test rsi, rsi
je 0x1800244ba
mov qword [rsi], 0
lea rdx, [0x180249ac0]
mov rcx, rbx
call fcn.1800242e0
mov rbx, rax
test rax, rax
jne 0x1800244dc
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.180078bc0
mov ebp, eax
cmp eax, 0xffffffff
je 0x1800245aa
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.1800783b4
test eax, eax
jne 0x1800245aa
mov rcx, rbx
call fcn.180078bc0
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1800245aa
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call fcn.1800783b4
test eax, eax
jne 0x1800245aa
cmp rdi, 0xffffffffffffffff
je 0x1800245aa
mov rax, qword [0x180262a38]
test rax, rax
je 0x18002454c
inc dword [rax + 0x3b0]
mov rcx, rdi
call fcn.180078668
mov rbp, rax
test rax, rax
je 0x1800245aa
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.180077b2c
mov rcx, rbx
cmp rax, rdi
je 0x180024598
call fcn.18006e860
mov rax, qword [0x180262a38]
test rax, rax
je 0x18002458e
dec dword [rax + 0x3b0]
mov rcx, rbp
call fcn.180072d78
jmp 0x1800245b2
call fcn.18006e860
test rsi, rsi
je 0x1800245a5
mov qword [rsi], rdi
mov rax, rbp
jmp 0x1800245b4
mov rcx, rbx
call fcn.18006e860
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x180026410
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0xc8]
mov rbx, rcx
mov edi, edx
test eax, eax
jg 0x18002644c
mov r8d, 0x6c1
lea rdx, str.E:_vs_space2K23FlsEngine.2K2323_FlsEngine_Easy_Core_srcimguiimgui.h
lea rcx, str.Size___0
call fcn.18007c198
mov eax, dword [rbx + 0xc8]
movsxd rcx, eax
lea r8, [0x180241da0]
mov rax, qword [rbx + 0xd0]
mov edx, dword [rax + rcx*4 - 4]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x180262a38]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1c50], edx
jne 0x1800264c1
mov dword [rax + 0x1c54], edx
cmp dword [rax + 0x1c90], edx
jne 0x1800264d0
mov byte [rax + 0x1c94], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x1800264e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0xc8]
mov rdi, rdx
mov rbx, rcx
test eax, eax
jg 0x180026519
mov r8d, 0x6c1
lea rdx, str.E:_vs_space2K23FlsEngine.2K2323_FlsEngine_Easy_Core_srcimguiimgui.h
lea rcx, str.Size___0
call fcn.18007c198
mov eax, dword [rbx + 0xc8]
movss xmm0, dword [rdi]
subss xmm0, dword [rbx + 0x10]
movss xmm1, dword [rdi + 4]
subss xmm1, dword [rbx + 0x14]
movsxd rcx, eax
mov rax, qword [rbx + 0xd0]
cvttss2si r8d, xmm0
movss xmm0, dword [rdi + 8]
subss xmm0, dword [rbx + 0x10]
cvttss2si r9d, xmm1
movss xmm1, dword [rdi + 0xc]
lea rdi, [0x180241da0]
subss xmm1, dword [rbx + 0x14]
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, r8b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
cvttss2si r10d, xmm0
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r9b
cvttss2si r11d, xmm1
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r10b
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
xor ebx, dword [rdi + rdx*4]
shr eax, 0x10
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r11b
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r11d
shr eax, 8
movzx edx, al
mov eax, r11d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, qword [0x180262a38]
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r11d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
not ebx
cmp dword [rax + 0x1c50], ebx
jne 0x1800266b6
mov dword [rax + 0x1c54], ebx
cmp dword [rax + 0x1c90], ebx
jne 0x1800266c5
mov byte [rax + 0x1c94], 1
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800312d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x180262a38]
mov esi, ecx
mov rbx, qword [rax + 0x1c08]
add rbx, 0xc8
mov eax, dword [rbx]
mov edx, eax
test eax, eax
jg 0x18003131f
mov r8d, 0x6c1
lea rdx, str.E:_vs_space2K23FlsEngine.2K2323_FlsEngine_Easy_Core_srcimguiimgui.h
lea rcx, str.Size___0
call fcn.18007c198
mov eax, dword [rbx]
mov edx, eax
mov r9, qword [rbx + 8]
lea r8, [0x180241da0]
cdqe
mov edi, dword [r9 + rax*4 - 4]
not edi
movzx eax, sil
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x1800313b8
lea ecx, [rdx + 1]
test r8d, r8d
je 0x18003139e
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x1800313a3
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.18003a460
mov edx, dword [rbx]
mov r9, qword [rbx + 8]
mov rsi, qword [rsp + 0x40]
movsxd rax, edx
mov dword [r9 + rax*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180032860
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18025e060]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x180262a38]
mov edi, edx
cmp byte [rbx + 0x1f75], 0
jne 0x1800328c0
cmp byte [rbx + 0x1f76], 0
jne 0x1800328c0
mov r9d, dword [rbx + 0x3054]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.180024120
test dil, 1
je 0x1800329de
jmp 0x180032948
movss xmm1, dword [rbx + 0x1610]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x18024d894]
xor eax, eax
mulss xmm1, dword [0x18024d870]
addss xmm0, dword [rbx + 0x128]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1d08], rax
mov dword [rbx + 0x1cf4], 1
movss dword [rbx + 0x1d00], xmm0
movss dword [rbx + 0x1d04], xmm1
movss xmm0, dword [rbx + 0x166c]
mulss xmm0, dword [0x18024d7b4]
or dword [rbx + 0x1cf0], 0x41
movss dword [rbx + 0x1d50], xmm0
mov r9d, dword [rbx + 0x3054]
call fcn.180024120
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x180032998
lea r11, [0x180241da0]
cmp r9b, 0x23
jne 0x18003297b
cmp byte [r8], r9b
jne 0x18003297b
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180032968
not ecx
call fcn.18002b2d0
test rax, rax
je 0x1800329de
cmp byte [rax + 0x8e], 0
je 0x1800329de
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3054]
mov edx, 0x10
mov r9d, dword [rbx + 0x3054]
call fcn.180024120
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.18002da80
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180067140
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180038180
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x30f8], 0
lea rbx, [rcx + 0x3100]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180038222
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test ecx, ecx
jns 0x1800381d6
mov eax, ecx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.18003a210
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.180024cf0
mov eax, dword [rbx]
lea rcx, [0x180262a34]
mov r9, qword [rdi + 0x30f8]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rdi + 0x3108]
cmove edx, r14d
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call fcn.180072a78
mov r14, qword [rsp + 0x30]
jmp 0x18003822a
mov rcx, rbx
call fcn.180024cf0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x180038c70
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x180262a38]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x3094], ecx
test rbx, rbx
je 0x180038cdd
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.180038cf0
lea rdx, [0x180249ac4]
mov rcx, rbx
mov rdi, rax
call fcn.1800242e0
mov rbx, rax
test rax, rax
je 0x180038cd8
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call fcn.180072a78
mov rcx, rbx
call fcn.18006e860
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x180053160
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test edx, edx
lea rax, str.SCROLLX
lea rdi, str.SCROLLY
mov rbx, rcx
cmove rdi, rax
mov eax, dword [rcx + 0xc8]
test eax, eax
jg 0x1800531aa
mov r8d, 0x6c1
lea rdx, str.E:_vs_space2K23FlsEngine.2K2323_FlsEngine_Easy_Core_srcimguiimgui.h
lea rcx, str.Size___0
call fcn.18007c198
mov eax, dword [rbx + 0xc8]
movsxd rdx, eax
mov rcx, rdi
mov rax, qword [rbx + 0xd0]
mov r8d, dword [rax + rdx*4 - 4]
xor edx, edx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.180024230
Function at 0x180063d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [0x18025e060]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx r8d, byte [rcx]
movaps xmm6, xmm2
mov ebx, edx
test r8b, r8b
je 0x180063dfd
lea rax, [rcx + 1]
cmp r8b, 0x25
jne 0x180063dc3
cmp byte [rax], r8b
jne 0x180063df9
cmp r8b, r8b
cmovne rax, rcx
movzx r8d, byte [rax + 1]
lea rcx, [rax + 1]
test r8b, r8b
jne 0x180063db1
movaps xmm0, xmm6
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180067140
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rbx
ret
movzx r8d, byte [rcx]
cmp r8b, 0x25
jne 0x180063dd5
cmp byte [rcx + 1], r8b
je 0x180063dd5
lea rdx, [rsp + 0x20]
call fcn.180055b60
xorps xmm3, xmm3
lea r8, [rsp + 0x20]
cvtss2sd xmm3, xmm6
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.180024120
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x180063e48
nop
inc rcx
cmp byte [rcx], 0x20
je 0x180063e40
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x180063ecb
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x180063e6a
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, r8b
cmp r8b, 0x2b
jne 0x180063e78
movzx eax, byte [rcx + 1]
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
cmp al, 0x30
jl 0x180063eb6
movss xmm2, dword [0x18024d87c]
nop
cmp al, 0x39
ja 0x180063eb6
movzx eax, al
inc rdx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x180063e90
cmp r9b, 0x2d
jne 0x180063ed7
xorps xmm1, xmmword [0x18024dea0]
movaps xmm0, xmm1
jmp 0x180063dd8
call fcn.180076604
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x180063dd8
Function at 0x180063ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [0x18025e060]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx r8d, byte [rcx]
movaps xmm6, xmm2
mov ebx, edx
test r8b, r8b
je 0x180063f5d
lea rax, [rcx + 1]
cmp r8b, 0x25
jne 0x180063f23
cmp byte [rax], r8b
jne 0x180063f59
cmp r8b, r8b
cmovne rax, rcx
movzx r8d, byte [rax + 1]
lea rcx, [rax + 1]
test r8b, r8b
jne 0x180063f11
movaps xmm0, xmm6
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180067140
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rbx
ret
movzx r8d, byte [rcx]
cmp r8b, 0x25
jne 0x180063f35
cmp byte [rcx + 1], r8b
je 0x180063f35
lea rdx, [rsp + 0x20]
call fcn.180055b60
movaps xmm3, xmm6
lea r8, [rsp + 0x20]
movq r9, xmm6
lea rcx, [rsp + 0x40]
mov edx, 0x40
call fcn.180024120
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x180063fa8
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x180063fa0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x180064029
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x180063fca
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, r8b
cmp r8b, 0x2b
jne 0x180063fd8
movzx eax, byte [rcx + 1]
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
cmp al, 0x30
jl 0x180064014
movsd xmm2, qword [0x18024d828]
nop
cmp al, 0x39
ja 0x180064014
movzx eax, al
inc rdx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x180063ff0
cmp r9b, 0x2d
jne 0x180064031
xorps xmm1, xmmword [0x18024de90]
movaps xmm0, xmm1
jmp 0x180063f38
call fcn.180076604
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x180063f38