joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004d32c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rsi, rdx
movabs r8, 0xcbf29ce484222325
mov r10, rcx
xor r9d, r9d
movzx eax, byte [rbx + r9 + 0x10]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 8
jb 0x18004d351
mov rcx, qword [r10 + 0x30]
mov rdx, qword [r10 + 0x18]
and rcx, r8
add rcx, rcx
cmp qword [rdx + rcx*8 + 8], rbx
jne 0x18004d3a1
cmp qword [rdx + rcx*8], rbx
jne 0x18004d396
mov rax, qword [r10 + 8]
mov qword [rdx + rcx*8], rax
jmp 0x18004d39a
mov rax, qword [rbx + 8]
mov qword [rdx + rcx*8 + 8], rax
jmp 0x18004d3ae
cmp qword [rdx + rcx*8], rbx
jne 0x18004d3ae
mov rax, qword [rbx]
mov qword [rdx + rcx*8], rax
mov rdi, qword [rbx]
dec qword [r10 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
mov rdx, qword [rbx + 0x30]
cmp rdx, 0xf
jbe 0x18004d3fb
mov rcx, qword [rbx + 0x18]
inc rdx
cmp rdx, 0x1000
jb 0x18004d3f6
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18004d42f
mov rcx, r8
call fcn.18009529c
and qword [rbx + 0x28], 0
mov edx, 0x38
mov rcx, rbx
mov qword [rbx + 0x30], 0xf
mov byte [rbx + 0x18], 0
call fcn.18009529c
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.1800995a0
int3
Function at 0x18004d6c8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rsi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x18004d6f8
cvtsi2ss xmm0, rdx
jmp 0x18004d70d
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.msvcrt.dll_ceilf
movss xmm1, dword [0x1800da214]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18004d73b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18004d73b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18004d769
cmp rbx, 0x200
jae 0x18004d766
shl rbx, 3
cmp rbx, rcx
jae 0x18004d769
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
ja 0x18004d8d7
lea rax, [rbx - 1]
mov edi, 1
mov rbx, qword [rsi + 8]
or rax, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18000dd0c
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18004d89b
mov rcx, qword [rcx]
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx edx, byte [rax + r9 + 0x10]
movabs r10, 0x100000001b3
xor r8, rdx
inc r9
imul r8, r10
cmp r9, 8
jb 0x18004d7e1
mov r11, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x18]
and r11, r8
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x18004d820
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x18004d88f
mov r10, qword [rdi + r11*8 + 8]
mov rdx, qword [rax + 0x10]
cmp rdx, qword [r10 + 0x10]
jne 0x18004d864
mov r10, qword [r10]
cmp r10, rax
je 0x18004d819
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18004d819
mov r10, qword [r10 + 8]
cmp rdx, qword [r10 + 0x10]
je 0x18004d8b1
cmp qword [rdi + r11*8], r10
jne 0x18004d85a
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18004d7d1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18004d88f
lea rcx, [0x1800cf190]
call fcn.180093828
int3

Function at 0x18004dbf4
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.9.virtual_32

Function at 0x18004dd98
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.7.virtual_16
Function at 0x18004ddf8
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004de10
Capabilities:
Delete file

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004de34
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x50
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004de4c
Capabilities:
Delete file

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004deb8
Capabilities:
Write file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004dedc
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004df00
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004df24
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x40
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004df60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.9.virtual_32

Function at 0x18004dff0
Capabilities:
Read file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.9.virtual_24

Function at 0x18004e104
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004e140
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x38
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004e158
Capabilities:
Delete file

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004e170
Capabilities:
Delete file

Disassembly:
sub rcx, 0x38
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004e1ac
Capabilities:
Write file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004e1e8
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004e20c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004e230
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004e254
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x48
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004e2f0
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.9.virtual_24

Function at 0x18004e440
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004e47c
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x40
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004e494
Capabilities:
Delete file

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004e4b8
Capabilities:
Delete file

Disassembly:
sub rcx, 0x40
jmp method.IMySteamRemoteStorage.6.virtual_24
Function at 0x18004e500
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004e53c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004e560
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004e59c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x50
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004e740
Capabilities:
Read file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004e7a0
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004e7ac
Capabilities:
Delete file

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004e7d0
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x48
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004e7e8
Capabilities:
Delete file

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004e818
Capabilities:
Delete file

Disassembly:
sub rcx, 0x48
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004e878
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004e89c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004e8c0
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x38
jmp method.IMySteamRemoteStorage.7.virtual_0
Function at 0x180052de0
Capabilities:
Check if file exists
Create directory

Disassembly:
push rbx
sub rsp, 0x240
lea rdx, [rsp + 0x130]
sub rdx, rcx
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x180052df4
mov edx, 0x5c
lea rcx, [rsp + 0x130]
call qword [sym.imp.msvcrt.dll_strrchr]
mov edx, 0x2f
lea rcx, [rsp + 0x130]
mov rbx, rax
call qword [sym.imp.msvcrt.dll_strrchr]
cmp rax, rbx
cmova rbx, rax
test rbx, rbx
je 0x180052ec6
lea rdx, [0x1800cd108]
mov byte [rbx + 1], 0
lea rcx, [rsp + 0x130]
call qword [sym.imp.msvcrt.dll_strtok]
mov byte [rsp + 0x20], 0
jmp 0x180052ebe
lea rcx, [rsp + 0x20]
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x180052e61
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x180052e6b
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x180052e95
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [rsp + 0x20]
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x180052e9d
movzx eax, word [0x1800cd10c]
lea rdx, [0x1800cd104]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_strtok]
mov r8, rax
test rax, rax
jne 0x180052e59
add rsp, 0x240
pop rbx
ret
Function at 0x180055558
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_0

Function at 0x1800558f4
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x18
jmp method.IMySteamApps.2.virtual_56

Function at 0x180055a38
Capabilities:
Get common file path

Disassembly:
sub rcx, 0x10
jmp method.IMySteamApps.3.virtual_144

Function at 0x180055aa4
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_16

Function at 0x180055c24
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_8

Function at 0x180055e7c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_0

Function at 0x180056188
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x20
jmp method.IMySteamApps.2.virtual_56

Function at 0x1800562b4
Capabilities:
Get common file path

Disassembly:
sub rcx, 0x18
jmp method.IMySteamApps.3.virtual_144

Function at 0x18005644c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_8

Function at 0x180056704
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.3.virtual_192

Function at 0x1800567c4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.3.virtual_184

Function at 0x18005686c
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamApps.2.virtual_56

Function at 0x18005695c
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x28
jmp method.IMySteamApps.2.virtual_56

Function at 0x180056998
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.virtual_0

Function at 0x180056ecc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.virtual_32

Function at 0x180057004
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamApps.2.virtual_56

Function at 0x180057130
Capabilities:
Get common file path

Disassembly:
sub rcx, 8
jmp method.IMySteamApps.3.virtual_144

Function at 0x180057184
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_16
Function at 0x18005a130
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, rdx
mov rsi, rcx
mov ecx, 0x20
call fcn.1800952a4
mov r8, qword [rbx]
mov qword [rax], r8
mov r8, qword [0x1801b8258]
mov qword [rax + 8], r8
movups xmm0, xmmword [rdi]
movdqu xmmword [rax + 0x10], xmm0
mov qword [rsp + 0x50], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x18005a1dc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x18005a1b2
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call fcn.180093c7c
int3
Function at 0x18005b180
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov r14, rdx
mov rdi, rcx
call fcn.18005d510
nop
lea rsi, [rdi + 0xc0]
mov rcx, rsi
call fcn.1800802bc
nop
lea rax, vtable.GlRender.0
mov qword [rdi], rax
lea rax, vtable.GlRender.1.0
mov qword [rsi], rax
lea rbx, [rdi + 0x168]
mov qword [rbp + 0x48], rbx
and dword [rbp + 0x40], 0
mov eax, dword [rbp + 0x40]
mov dword [rbx], eax
and qword [rbx + 8], 0
and qword [rbx + 0x10], 0
mov ecx, 0x60
call fcn.1800952a4
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x18]
and qword [rcx], 0
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
mov qword [rbx + 0x30], 7
mov qword [rbx + 0x38], 8
mov dword [rbx], 0x3f800000
mov r8, qword [rbx + 8]
mov edx, 0x10
call fcn.18000dd0c
nop
mov byte [rbp - 0x18], 0x78
mov byte [rbp - 0x17], 0x68
mov byte [rbp - 0x16], WSASetLastError
mov byte [rbp - 0x15], 0x54
mov byte [rbp - 0x14], 0x78
mov byte [rbp - 0x13], 0x62
mov byte [rbp - 0x12], WSACleanup
mov byte [rbp - 0x11], 0x43
mov byte [rbp - 0x10], 0x76
mov byte [rbp - 0xf], 0x67
mov byte [rbp - 0xe], 0x67
mov byte [rbp - 0xd], 0x66
mov byte [rbp - 0xc], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0xb], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0xa], 0
mov al, byte [rbp - 0x18]
xor edx, edx
mov al, byte [rbp + rdx - 0x18]
dec al
mov byte [rbp + rdx - 0x18], al
inc rdx
cmp rdx, 0xe
jb 0x18005b26d
lea rdx, [rbp - 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18005b2ba
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005b044]
mov rdx, rax
mov rcx, rsi
call fcn.18007b7d8
mov qword [0x1801b8268], rdi
mov byte [rdi + 8], 1
mov rax, rdi
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18005ca9c
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rdx, qword [0x1801b7a70]
mov rdi, rcx
mov r8d, dword [rdx + 0x128]
sub r8d, 1
je 0x18005cc4d
cmp r8d, 1
jne 0x18005cc6b
mov byte [rbp - 0x30], 0x48
xor ebx, ebx
mov byte [rbp - 0x2f], WSASetLastError
mov ecx, ebx
mov byte [rbp - 0x2e], 0x77
mov byte [rbp - 0x2d], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x2c], 0x65
mov byte [rbp - 0x2b], 0x78
mov byte [rbp - 0x2a], 0x67
mov byte [rbp - 0x29], 0x6c
mov byte [rbp - 0x28], 0x51
mov byte [rbp - 0x27], 0x69
mov byte [rbp - 0x26], 0x77
mov byte [rbp - 0x25], 0x77
mov byte [rbp - 0x24], 0x65
mov byte [rbp - 0x23], 0x6b
mov byte [rbp - 0x22], 0x69
mov byte [rbp - 0x21], 0x45
mov byte [rbp - 0x20], bl
mov al, byte [rbp - 0x30]
mov al, byte [rbp + rcx - 0x30]
sub al, 4
mov byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x10
jb 0x18005cb1d
mov byte [rbp + 0x18], 0x56
mov rcx, rbx
mov byte [rbp + 0x19], reloc.WS2_32.dll_WSACleanup
mov byte [rbp + 0x1a], 0x66
mov byte [rbp + 0x1b], reloc.WS2_32.dll_WSAStartup
mov byte [rbp + 0x1c], 0x34
mov byte [rbp + 0x1d], 0x33
mov byte [rbp + 0x1e], bl
mov al, byte [rbp + 0x18]
mov al, byte [rbp + rcx + 0x18]
dec al
mov byte [rbp + rcx + 0x18], al
inc rcx
cmp rcx, 6
jb 0x18005cb51
lea r8, [rbp - 0x30]
mov rcx, rdi
lea rdx, [rbp + 0x18]
call fcn.180080b38
mov rdx, rax
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005c658]
mov rcx, rdi
call fcn.18007b7d8
mov byte [rbp - 0x1f], 0x4e
mov rcx, rbx
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x1d], 0x7d
mov byte [rbp - 0x1c], 0x7a
mov byte [rbp - 0x1b], 0x6b
mov byte [rbp - 0x1a], 0x7e
mov byte [rbp - 0x19], WSASetLastError
mov byte [rbp - 0x18], WSACleanup
mov byte [rbp - 0x17], 0x57
mov byte [rbp - 0x16], WSASetLastError
mov byte [rbp - 0x15], 0x7d
mov byte [rbp - 0x14], 0x7d
mov byte [rbp - 0x13], 0x6b
mov byte [rbp - 0x12], WSACleanup
mov byte [rbp - 0x11], WSASetLastError
mov byte [rbp - 0x10], 0x61
mov byte [rbp - 0xf], bl
mov al, byte [rbp - 0x1f]
mov al, byte [rbp + rcx - 0x1f]
sub al, 0xa
mov byte [rbp + rcx - 0x1f], al
inc rcx
cmp rcx, 0x10
jb 0x18005cbda
mov byte [rbp + 0x20], 0x5b
mov byte [rbp + 0x21], 0x79
mov byte [rbp + 0x22], 0x6b
mov byte [rbp + 0x23], 0x78
mov byte [rbp + 0x24], 0x39
mov byte [rbp + 0x25], 0x38
mov byte [rbp + 0x26], bl
mov al, byte [rbp + 0x20]
mov al, byte [rbp + rbx + 0x20]
sub al, 6
mov byte [rbp + rbx + 0x20], al
inc rbx
cmp rbx, 6
jb 0x18005cc0b
lea r8, [rbp - 0x1f]
mov rcx, rdi
lea rdx, [rbp + 0x20]
call fcn.180080b38
mov rdx, rax
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005c658]
mov rcx, rdi
call fcn.18007b7d8
jmp 0x18005cc6b
xor r9d, r9d
lea rdx, [0x18005c1f0]
xor r8d, r8d
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x1801b87d0], rax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1800622b0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
cmp byte [rcx + 9], 0
mov r15, r8
mov rdi, rcx
jne 0x18006246b
cmp qword [rcx + 0x178], 0
je 0x18006246b
and qword [rbp + 0x30], 0
lea r8, [rbp + 0x30]
call fcn.180062e30
and qword [rbp - 0x38], 0
xor eax, eax
mov dword [rbp - 0x44], eax
mov qword [rbp + 0x48], rax
mov dword [rbp - 0x28], eax
mov qword [rbp - 0x18], rax
mov rax, qword [rdi + 0x170]
mov qword [rbp - 0x60], rax
mov rax, qword [rdi + 0x180]
mov qword [rbp - 0x58], rax
mov rax, qword [rdi + 0x178]
mov qword [rbp - 0x50], rax
mov eax, dword [rdi + 0x190]
mov dword [rbp - 0x48], eax
mov rax, qword [rdi + 0x188]
mov qword [rbp - 0x30], rax
mov eax, 2
mov dword [rbp - 0x24], eax
mov dword [rbp - 0x20], eax
lea rax, [sym.steam_api64.dll_SteamAPI_ISteamApps_RequestPublisherOwnedAppData]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x30]
and qword [rbp + 0x30], 0
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x1c], 1
lea rdx, [rbp + 0x30]
lea rcx, [0x18005f370]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbp + 0x30]
test rax, rax
je 0x180062366
mov qword [rdi + 0x168], rax
call fcn.18002204c
mov rcx, qword [rdi + 0x168]
call fcn.18001f254
mov rsi, qword [0x1801b7c80]
mov r14, qword [rdi + 0x1b0]
test rsi, rsi
je 0x1800623b1
inc dword [rsi + 0xf4]
mov ecx, 0xe8
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rbp + 0x30], rax
mov rbx, rax
test rax, rax
je 0x1800623e2
xor edx, edx
mov r8d, 0xe8
mov rcx, rax
call fcn.1800970a0
mov qword [rbx + 0x60], 0x100
jmp 0x1800623e4
xor ebx, ebx
or dword [rsi + 0xc], 8
lea rax, str.imgui_impl_vulkan
movaps xmm0, xmmword [rbp - 0x60]
movaps xmm1, xmmword [rbp - 0x50]
mov qword [rsi + 0x90], rax
mov rax, qword [rbp + 0x48]
mov qword [rsi + 0xa0], rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x58], r14
movaps xmm0, xmmword [rbp - 0x40]
movups xmmword [rbx + 0x10], xmm1
mov dword [rbx + 0x88], eax
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rbx + 0x20], xmm0
movaps xmm0, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x30], xmm1
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx + 0x40], xmm0
movsd qword [rbx + 0x50], xmm1
call fcn.18001e55c
mov rcx, rdi
call fcn.18005dc5c
mov rax, qword [r15 + 0x30]
mov ecx, dword [rax]
lea rax, [rcx + rcx*2]
mov rcx, qword [rdi + 0x1b8]
add rax, rax
mov rcx, qword [rcx + rax*8 + 8]
call fcn.18001dc6c
mov byte [rdi + 9], 1
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180064758
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [0x1801b7c88]
mov rbx, rcx
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9d, dword [rbx + 0xc]
movabs rdx, 0xcbf29ce484222325
mov dword [rsp + 0x40], r9d
xor r8d, r8d
movzx eax, byte [rsp + r8 + 0x40]
movabs rcx, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, rcx
cmp r8, 4
jb 0x180064797
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x20]
and rax, rdx
add rax, rax
mov rdi, qword [rcx + rax*8 + 8]
cmp rdi, qword [rbp + 0x10]
je 0x1800647e7
mov rcx, qword [rcx + rax*8]
jmp 0x1800647df
cmp rdi, rcx
je 0x1800647e7
mov rdi, qword [rdi + 8]
cmp r9d, dword [rdi + 0x10]
jne 0x1800647d6
jmp 0x1800647e9
xor edi, edi
test rdi, rdi
je 0x180064873
cmp rdi, qword [rbp + 0x10]
je 0x180064873
mov rdx, qword [rdi + 0x20]
mov rsi, qword [rdi + 0x18]
jmp 0x18006480b
cmp qword [rsi], rbx
je 0x180064810
add rsi, 8
cmp rsi, rdx
jne 0x180064802
cmp rsi, rdx
je 0x180064852
lea rax, [rsi + 8]
jmp 0x18006482e
mov rcx, qword [rax]
cmp rcx, rbx
je 0x18006482a
mov qword [rsi], rcx
add rsi, 8
add rax, 8
cmp rax, rdx
jne 0x18006481b
cmp rsi, rdx
je 0x180064852
mov rbx, qword [rdi + 0x20]
mov rcx, rsi
sub rbx, rdx
mov r8, rbx
call sub.msvcrt.dll_memmove
lea rax, [rbx + rsi]
mov qword [rdi + 0x20], rax
mov rax, qword [rdi + 0x20]
sub rax, qword [rdi + 0x18]
test rax, 0xfffffffffffffff8
jne 0x180064873
lea rcx, [rbp + 8]
mov r8, rdi
lea rdx, [rsp + 0x40]
call fcn.180043724
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x18006bdf8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x30]
mov byte [rax], 0
jmp fcn.1800432ac