joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001213
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rax, rcx
lea rcx, [rsp + 0x68]
mov qword [rcx], rdx
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r9
mov qword [rsp + 0x20], rcx
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
add rdx, 0x10
mov rdx, qword [rdx]
mov rcx, qword [rdx + 0x30]
movsxd r8, dword [rcx + 0x3c]
mov r8d, dword [rcx + r8 + 0x88]
test r8, r8
je 0x180001248
mov r9d, dword [rcx + r8 + 0x18]
test r9, r9
je 0x180001248
mov r10d, dword [rcx + r8 + 0x20]
add r10, rcx
lea r11, [rcx + 1]
dec r9
mov esi, r9d
mov edi, dword [r10 + rsi*4]
mov bpl, byte [rcx + rdi]
test bpl, bpl
je 0x1800012c5
add rdi, r11
mov ebx, 0xb77c62e
movsx r14d, bpl
lea ebp, [r14 - 0x41]
mov r15d, r14d
or r15d, 0x20
cmp bpl, 0x1a
cmovae r15d, r14d
xor r15d, ebx
imul ebx, r15d, 0x1000193
mov bpl, byte [rdi]
inc rdi
test bpl, bpl
jne 0x180001291
cmp ebx, 0xd526b462
je 0x1800012cf
test rsi, rsi
jne 0x180001276
jmp 0x180001248
mov edx, dword [rcx + r8 + 0x1c]
mov r8d, dword [rcx + r8 + 0x24]
add rdx, rcx
add r8, rcx
movzx r8d, word [r8 + rsi*2]
mov r10d, dword [rdx + r8*4]
add r10, rcx
mov r9, qword [rsp + 0x20]
lea rcx, [0x1800116d0]
mov edx, 0x200
mov r8, rax
call r10
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x180001313
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x180001313
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x180001389
add rsi, r10
mov edi, 0x786ba5d2
movsx ebx, bl
lea ebp, [rbx - 0x41]
mov r14d, ebx
or r14d, 0x20
cmp bpl, 0x1a
cmovae r14d, ebx
xor r14d, edi
imul edi, r14d, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x180001359
cmp edi, 0xaab4b456
je 0x180001390
test r11, r11
jne 0x180001340
jmp 0x180001313
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
lea rsi, [0x1800116d0]
mov rcx, rsi
call rdx
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800013d6
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xa8
xor ecx, ecx
call fcn.18000c091
mov qword [0x1800118d8], rax
lea rcx, str.VALORANT_Win64_Shipping.exe
lea rdx, [0x18000d0e0]
xor r8d, r8d
xor r9d, r9d
call fcn.18000157a
mov qword [0x1800118e0], rax
lea rcx, str._valorant__StaticFindObject__p
mov rdx, rax
call fcn.180001213
lea r8, str._Game_Maps_Menu_MainMenuV2.MainMenuV2
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [0x1800118e0]
mov qword [0x1800116b8], rax
test rax, rax
jne 0x180001527
lea r8, [rsp + 0x22]
movaps xmm0, xmmword [0x18000d070]
movaps xmmword [r8 - 2], xmm0
movaps xmm0, xmmword [0x18000d080]
movaps xmmword [r8 + 0xe], xmm0
movaps xmm0, xmmword [0x18000d090]
movaps xmmword [r8 + 0x1e], xmm0
movaps xmm0, xmmword [0x18000d0a0]
movaps xmmword [r8 + 0x2e], xmm0
mov word [r8 + 0x3e], 0x44
mov word [r8 + 0x7e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x20], 0x44
inc rax
cmp rax, 0x40
jne 0x180001486
mov word [rsp + 0xa0], 0
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [0x1800118e0]
mov qword [0x1800116b8], rax
test rax, rax
jne 0x180001527
lea r8, [rsp + 0x22]
movaps xmm0, xmmword [0x18000d0b0]
movaps xmmword [r8 - 2], xmm0
movaps xmm0, xmmword [0x18000d0c0]
movaps xmmword [r8 + 0xe], xmm0
movaps xmm0, xmmword [0x18000d0d0]
movaps xmmword [r8 + 0x1e], xmm0
mov dword [r8 + 0x2e], 0x67007a
mov word [r8 + 0x32], 0x13
mov word [r8 + 0x66], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x20], 0x13
inc rax
cmp rax, 0x34
jne 0x1800014fb
mov word [rsp + 0x88], 0
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [0x1800118e0]
mov qword [0x1800116b8], rax
lea rcx, str._valorant__GWorld__p
mov rdx, rax
call fcn.180001213
mov al, 1
add rsp, 0xa8
ret
Function at 0x1800017ea
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, r8
mov rsi, rdx
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x18000181f
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x18000181f
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov ebx, dword [r9 + r11*4]
mov r14b, byte [rax + rbx]
test r14b, r14b
je 0x18000189b
add rbx, r10
mov ebp, 0x98a57e91
movsx r14d, r14b
lea r15d, [r14 - 0x41]
mov r12d, r14d
or r12d, 0x20
cmp r15b, 0x1a
cmovae r12d, r14d
xor r12d, ebp
imul ebp, r12d, 0x1000193
mov r14b, byte [rbx]
inc rbx
test r14b, r14b
jne 0x180001867
cmp ebp, 0x10d75663
je 0x1800018a5
test r11, r11
jne 0x18000184c
jmp 0x18000181f
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, rdi
call rdx
mov qword [rsp + 0x20], rdi
test rax, rax
jle 0x1800019e5
mov rbx, rax
add rbx, rdi
cmp byte [rdi], 0x3f
jne 0x180001902
lea rax, [rdi + 1]
mov qword [rsp + 0x20], rax
mov edx, 0xffffffff
cmp byte [rdi + 1], 0x3f
jne 0x1800019c7
add rdi, 2
mov qword [rsp + 0x20], rdi
jmp 0x1800019c7
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x180001913
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x180001913
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r15d, dword [r9 + r11*4]
mov r12b, byte [rax + r15]
test r12b, r12b
je 0x180001990
add r15, r10
mov ebp, 0x48f68d75
movsx r12d, r12b
lea r13d, [r12 - 0x41]
mov r14d, r12d
or r14d, 0x20
cmp r13b, 0x1a
cmovae r14d, r12d
xor r14d, ebp
imul ebp, r14d, 0x1000193
mov r12b, byte [r15]
inc r15
test r12b, r12b
jne 0x18000195b
cmp ebp, 0x30369308
je 0x18000199a
test r11, r11
jne 0x180001940
jmp 0x180001913
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r9d, dword [rcx + rdx*4]
add r9, rax
mov rcx, rdi
lea rdx, [rsp + 0x20]
mov r8d, 0x10
call r9
mov edx, eax
mov rcx, rsi
call fcn.180001ac4
mov rdi, qword [rsp + 0x20]
inc rdi
mov qword [rsp + 0x20], rdi
cmp rdi, rbx
jb 0x1800018d7
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1800019fa
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x10
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x180001a13
mov r9d, dword [rax + r8 + 0x18]
test r9, r9
je 0x180001a13
mov r10d, dword [rax + r8 + 0x20]
add r10, rax
lea r11, [rax + 1]
dec r9
mov esi, r9d
mov edi, dword [r10 + rsi*4]
mov bpl, byte [rax + rdi]
test bpl, bpl
je 0x180001a90
add rdi, r11
mov ebx, 0xc82f5478
movsx r14d, bpl
lea ebp, [r14 - 0x41]
mov r15d, r14d
or r15d, 0x20
cmp bpl, 0x1a
cmovae r15d, r14d
xor r15d, ebx
imul ebx, r15d, 0x1000193
mov bpl, byte [rdi]
inc rdi
test bpl, bpl
jne 0x180001a5c
cmp ebx, 0x8f5b6c46
je 0x180001a9a
test rsi, rsi
jne 0x180001a41
jmp 0x180001a13
mov edx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rdx, rax
add r8, rax
movzx r8d, word [r8 + rsi*2]
mov edx, dword [rdx + r8*4]
add rdx, rax
mov rcx, qword [rcx]
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp rdx

Function at 0x180001ac4
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov esi, edx
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
cmp rcx, qword [rdi + 8]
jne 0x180001b93
lea rax, [rcx + rcx]
test rcx, rcx
mov edx, 1
cmovne rdx, rax
mov qword [rdi + 8], rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x180001b0c
mov r9d, dword [rax + r8 + 0x18]
test r9, r9
je 0x180001b0c
mov r10d, dword [rax + r8 + 0x20]
add r10, rax
lea rbx, [rax + 1]
dec r9
mov r11d, r9d
mov r14d, dword [r10 + r11*4]
mov r15b, byte [rax + r14]
test r15b, r15b
je 0x180001b89
add r14, rbx
mov ebp, 0xf77cc7a
movsx r15d, r15b
lea r12d, [r15 - 0x41]
mov r13d, r15d
or r13d, 0x20
cmp r12b, 0x1a
cmovae r13d, r15d
xor r13d, ebp
imul ebp, r13d, 0x1000193
mov r15b, byte [r14]
inc r14
test r15b, r15b
jne 0x180001b55
cmp ebp, 0x1f09c0dc
je 0x180001b98
test r11, r11
jne 0x180001b3a
jmp 0x180001b0c
mov rax, qword [rdi]
jmp 0x180001bc5
shl rdx, 2
mov ecx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rcx, rax
add r8, rax
movzx r8d, word [r8 + r11*2]
mov r8d, dword [rcx + r8*4]
add r8, rax
mov rcx, qword [rdi]
call r8
mov qword [rdi], rax
mov rcx, qword [rdi + 0x10]
lea rdx, [rcx + 1]
mov qword [rdi + 0x10], rdx
mov dword [rax + rcx*4], esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180003f04
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rax, qword [0x1800118d0]
test rax, rax
jne 0x180003ff7
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax]
mov rcx, qword [rdx + 0x30]
xor eax, eax
mov r8, rdx
movsxd r9, dword [rcx + 0x3c]
mov r9d, dword [rcx + r9 + 0x88]
test r9, r9
je 0x180003fbf
mov r10d, dword [rcx + r9 + 0x18]
test r10, r10
je 0x180003fbf
mov r11d, dword [rcx + r9 + 0x20]
add r11, rcx
lea rdi, [rcx + 1]
dec r10
mov ebx, r10d
mov r14d, dword [r11 + rbx*4]
mov r15b, byte [rcx + r14]
test r15b, r15b
je 0x180003fba
add r14, rdi
mov ebp, 0x8656c6a2
movsx r15d, r15b
lea r12d, [r15 - 0x41]
mov r13d, r15d
or r13d, 0x20
cmp r12b, 0x1a
cmovae r13d, r15d
xor r13d, ebp
imul ebp, r13d, 0x1000193
mov r15b, byte [r14]
inc r14
test r15b, r15b
jne 0x180003f86
cmp ebp, 0x4bfd695d
je 0x180003fd6
test rbx, rbx
jne 0x180003f6b
mov r8, qword [r8]
cmp r8, rdx
je 0x180003ff0
mov rcx, qword [r8 + 0x30]
test rcx, rcx
jne 0x180003f44
jmp 0x180003ff0
mov eax, dword [rcx + r9 + 0x1c]
mov edx, dword [rcx + r9 + 0x24]
add rax, rcx
add rdx, rcx
movzx edx, word [rdx + rbx*2]
mov eax, dword [rax + rdx*4]
add rax, rcx
mov qword [0x1800118d0], rax
mov edx, 1
mov rcx, rsi
call rax
test eax, eax
je 0x180004009
xor eax, eax
jmp 0x18000400f
cmp byte [rsi], 0
setne al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180004020
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x140
movaps xmmword [rsp + 0x130], xmm6
mov rsi, rcx
movaps xmm0, xmmword [0x18000d640]
lea rax, [rsp + 0x120]
movaps xmmword [rax], xmm0
movss xmm3, dword [0x18000d2f4]
movss xmm0, dword [0x1800110f4]
addss xmm0, xmm3
addss xmm3, dword [0x1800110f0]
mov r8, qword [0x1800110d0]
mov rdx, qword [0x180011920]
mov qword [rsp + 0x28], rax
movss dword [rsp + 0x20], xmm0
lea rcx, [rsp + 0xd0]
call fcn.180008b22
movaps xmm6, xmmword [0x18000d380]
movaps xmmword [rsp + 0xa0], xmm6
xorps xmm0, xmm0
movlps qword [rsp + 0xc8], xmm0
movaps xmm0, xmmword [0x18000d2b0]
movaps xmmword [rsp + 0x100], xmm0
movsd xmm0, qword [0x18000d360]
movsd qword [rsp + 0xc0], xmm0
movsd xmm0, qword [0x1800110d0]
addps xmm0, xmmword [0x18000d650]
movaps xmmword [rsp + 0x90], xmm6
movlps qword [rsp + 0xb8], xmm0
lea rax, [rsp + 0xd2]
movaps xmm0, xmmword [0x18000d660]
movaps xmmword [rax - 2], xmm0
mov dword [rax + 0xe], 0x100064
mov word [rax + 0x22], 0
mov ecx, 1
xor byte [rsp + rcx*2 + 0xd0], 0x10
inc rcx
cmp rcx, 0x12
jne 0x180004105
mov word [rsp + 0xf4], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
cmp word [rsp + 0xd2], 0
je 0x180004161
xor ecx, ecx
cmp word [rsp + rcx*2 + 0xd2], 0
lea rcx, [rcx + 1]
jne 0x180004138
mov dword [rsp + 0x88], ecx
mov dword [rsp + 0x8c], ecx
test ecx, ecx
je 0x180004161
mov qword [rsp + 0x80], rax
mov r8, qword [0x1800118e8]
mov rdx, qword [0x180011920]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x68], rax
xor eax, eax
mov byte [rsp + 0x60], al
mov byte [rsp + 0x58], al
mov byte [rsp + 0x50], al
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0x3f800000
lea rcx, [rsp + 0x7f]
lea r9, [rsp + 0x80]
call fcn.1800087ca
call fcn.1800042a8
mov edx, dword [0x180011954]
mov rcx, rsi
call fcn.180004fb8
call fcn.18000600e
mov rdx, qword [0x180011928]
lea rcx, [rsp + 0x90]
lea rsi, [rsp + 0xd0]
lea r9, [rsp + 0xa0]
mov r8, rsi
call fcn.180009c98
movss xmm0, dword [rsi]
xorps xmm2, xmm2
ucomiss xmm0, xmm2
jne 0x180004232
jnp 0x180004296
movss xmm1, dword [rsp + 0xa0]
ucomiss xmm1, xmm2
jne 0x180004242
jnp 0x180004296
lea rax, [rsp + 0x110]
addss xmm0, dword [0x18000d670]
movaps xmmword [rax], xmm6
addss xmm1, dword [0x18000d2f4]
mov rdx, qword [0x180011920]
movd r8d, xmm0
movd ecx, xmm1
shl rcx, 0x20
or r8, rcx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x40a00000
lea rcx, [rsp + 0x90]
movss xmm3, dword [0x18000d674]
call fcn.180008b22
movaps xmm6, xmmword [rsp + 0x130]
add rsp, 0x140
pop rsi
ret
Function at 0x1800098ac
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd8
mov rdi, r9
mov rbx, r8
mov rsi, rdx
cmp qword [0x1800159c8], 0
jne 0x18000994a
xor eax, eax
mov word [rsp + 0x2e], ax
lea rdx, [rsp + 0x32]
movaps xmm0, xmmword [0x18000dcb0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000dcc0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000dcd0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000dce0]
movaps xmmword [rdx + 0x2e], xmm0
movaps xmm0, xmmword [0x18000dcf0]
movaps xmmword [rdx + 0x3e], xmm0
mov dword [rdx + 0x4e], 0x440036
mov word [rdx + 0xa2], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x30], 0x44
inc rax
cmp rax, 0x52
jne 0x180009921
mov word [rsp + 0xd4], 0
lea rcx, [rsp + 0x2e]
call fcn.180001540
mov qword [0x1800159c8], rax
lea r14, [rsp + 0x30]
mov word [r14], 0
lea rdx, str.Engine.Default__KismetStringLibrary
mov rcx, r14
call fcn.180001540
movups xmm0, xmmword [rbx]
movaps xmmword [r14], xmm0
xorps xmm0, xmm0
movaps xmmword [r14 + 0x20], xmm0
movups xmm0, xmmword [rdi]
movaps xmmword [r14 + 0x10], xmm0
mov rdx, qword [0x1800159c8]
mov r9d, 0x4668b40
add r9, qword [0x1800118d8]
lea rdi, [rsp + 0x30]
mov rcx, rax
mov r8, rdi
call r9
movaps xmm0, xmmword [rdi + 0x20]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x18000a83c
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xc0
movaps xmmword [rsp + 0xb0], xmm6
movaps xmm6, xmm1
mov rdx, qword [0x180015aa8]
test rdx, rdx
jne 0x18000a8d2
xor eax, eax
mov word [rsp + 0x2e], ax
lea rdx, [rsp + 0x32]
movaps xmm0, xmmword [str._lGN_GL_ab_ZDL_dH_Ae_K_H_t1]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000dda0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000ddb0]
movaps xmmword [rdx + 0x1e], xmm0
movabs rcx, 0x46006a00070050
mov qword [rdx + 0x2e], rcx
mov dword [rdx + 0x36], 0x29005a
mov word [rdx + 0x72], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x30], 0x29
inc rax
cmp rax, 0x3a
jne 0x18000a8a6
mov word [rsp + 0xa4], 0
lea rcx, [rsp + 0x2e]
call fcn.180001540
mov rdx, rax
mov qword [0x180015aa8], rax
mov rcx, qword [0x180015ab0]
test rcx, rcx
jne 0x18000a905
lea rcx, [rsp + 0x30]
mov word [rcx], 0
lea rdx, str.Engine.Default__KismetMathLibrary
call fcn.180001540
mov rcx, rax
mov qword [0x180015ab0], rax
mov rdx, qword [0x180015aa8]
lea rsi, [rsp + 0x30]
movss dword [rsi], xmm6
mov eax, 0x4668b40
add rax, qword [0x1800118d8]
mov r8, rsi
call rax
movss xmm0, dword [rsi + 4]
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc0
pop rsi
ret
Function at 0x18000b810
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, r8
mov rsi, rdx
mov rax, qword [0x1800118d0]
test rax, rax
jne 0x18000b90f
mov qword [rsp + 0x20], rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax]
mov rcx, qword [rdx + 0x30]
xor eax, eax
mov r8, rdx
movsxd r9, dword [rcx + 0x3c]
mov r9d, dword [rcx + r9 + 0x88]
test r9, r9
je 0x18000b8d1
mov r10d, dword [rcx + r9 + 0x18]
test r10, r10
je 0x18000b8d1
mov r11d, dword [rcx + r9 + 0x20]
add r11, rcx
lea rbx, [rcx + 1]
dec r10
mov r14d, r10d
mov r15d, dword [r11 + r14*4]
mov r12b, byte [rcx + r15]
test r12b, r12b
je 0x18000b8cc
add r15, rbx
mov ebp, 0x8656c6a2
movsx r12d, r12b
lea r13d, [r12 - 0x41]
mov edi, r12d
or edi, 0x20
cmp r13b, 0x1a
cmovae edi, r12d
xor edi, ebp
imul ebp, edi, 0x1000193
mov r12b, byte [r15]
inc r15
test r12b, r12b
jne 0x18000b89a
cmp ebp, 0x4bfd695d
je 0x18000b8e8
test r14, r14
jne 0x18000b87f
mov r8, qword [r8]
cmp r8, rdx
je 0x18000b903
mov rcx, qword [r8 + 0x30]
test rcx, rcx
jne 0x18000b858
jmp 0x18000b903
mov eax, dword [rcx + r9 + 0x1c]
mov edx, dword [rcx + r9 + 0x24]
add rax, rcx
add rdx, rcx
movzx edx, word [rdx + r14*2]
mov eax, dword [rax + rdx*4]
add rax, rcx
mov qword [0x1800118d0], rax
mov rdi, qword [rsp + 0x20]
mov edx, 0x10
mov rcx, rdi
call rax
test eax, eax
je 0x18000b922
xorps xmm0, xmm0
jmp 0x18000b925
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x18000c091
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rcx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x20
xor esi, esi
mov r14, rbx
mov r14, qword [r14]
cmp r14, rbx
je 0x18000c0db
test rdi, rdi
je 0x18000c0d7
mov rdx, qword [r14 + 0x50]
mov rcx, rdi
xor r8d, r8d
call fcn.18000c172
test al, al
je 0x18000c0b7
mov rsi, qword [r14 + 0x20]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x18000c0e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov r14d, dword [rcx + rax + 0x88]
cmp dword [rcx + r14 + 0x18], 0
je 0x18000c14e
mov rbx, rdx
mov rsi, rcx
xor edi, edi
xor r15d, r15d
mov eax, dword [rsi + r14 + 0x20]
mov ecx, dword [rsi + r14 + 0x24]
add rcx, rsi
movzx r12d, word [rcx + r15*2]
add rax, rsi
mov edx, dword [rax + r15*4]
add rdx, rsi
mov rcx, rbx
mov r8b, 1
call fcn.18000c1d5
test al, al
jne 0x18000c152
inc r15
mov eax, dword [rsi + r14 + 0x18]
cmp r15, rax
jb 0x18000c114
jmp 0x18000c161
xor edi, edi
jmp 0x18000c161
mov eax, dword [rsi + r14 + 0x1c]
add rax, rsi
mov edi, dword [rax + r12*4]
add rdi, rsi
mov rax, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x18000cd7e
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rax, qword [0x1800118d0]
test rax, rax
jne 0x18000ce71
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax]
mov rcx, qword [rdx + 0x30]
xor eax, eax
mov r8, rdx
movsxd r9, dword [rcx + 0x3c]
mov r9d, dword [rcx + r9 + 0x88]
test r9, r9
je 0x18000ce39
mov r10d, dword [rcx + r9 + 0x18]
test r10, r10
je 0x18000ce39
mov r11d, dword [rcx + r9 + 0x20]
add r11, rcx
lea rdi, [rcx + 1]
dec r10
mov ebx, r10d
mov r14d, dword [r11 + rbx*4]
mov r15b, byte [rcx + r14]
test r15b, r15b
je 0x18000ce34
add r14, rdi
mov ebp, 0x8656c6a2
movsx r15d, r15b
lea r12d, [r15 - 0x41]
mov r13d, r15d
or r13d, 0x20
cmp r12b, 0x1a
cmovae r13d, r15d
xor r13d, ebp
imul ebp, r13d, 0x1000193
mov r15b, byte [r14]
inc r14
test r15b, r15b
jne 0x18000ce00
cmp ebp, 0x4bfd695d
je 0x18000ce50
test rbx, rbx
jne 0x18000cde5
mov r8, qword [r8]
cmp r8, rdx
je 0x18000ce6a
mov rcx, qword [r8 + 0x30]
test rcx, rcx
jne 0x18000cdbe
jmp 0x18000ce6a
mov eax, dword [rcx + r9 + 0x1c]
mov edx, dword [rcx + r9 + 0x24]
add rax, rcx
add rdx, rcx
movzx edx, word [rdx + rbx*2]
mov eax, dword [rax + rdx*4]
add rax, rcx
mov qword [0x1800118d0], rax
mov edx, 8
mov rcx, rsi
call rax
test eax, eax
je 0x18000ce83
xor eax, eax
jmp 0x18000ce86
mov rax, qword [rsi]
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140002f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
nop dword [rax + rax]
mov r9d, dword [rdi + 0x64]
mov r8d, dword [rdi + 0x3c]
mov ecx, dword [rdi + 0x48]
lea eax, [r8 + r9]
cmp eax, ecx
jbe 0x140002f54
mov r9d, ecx
sub r9d, r8d
cmp r9d, 3
jae 0x140002f54
mov rcx, rdi
call fcn.1400031f0
test eax, eax
jne 0x1400030e7
jmp 0x1400030da
xor r13d, r13d
mov ecx, r8d
sub ecx, dword [rdi + 0x60]
mov rbx, r8
cmp r8d, dword [rdi + 0x60]
mov r12d, 2
mov r15d, r12d
cmova r13d, ecx
add rbx, qword [rdi + 0x30]
movzx eax, byte [rbx]
movzx ecx, byte [rbx + 1]
shl rcx, 8
xor rcx, rax
mov rax, qword [rdi + 0x68]
mov r10d, dword [rax + rcx*4]
mov dword [rax + rcx*4], r8d
mov eax, dword [rdi + 0x5c]
mov rdx, qword [rdi + 0x70]
add eax, eax
mov ebp, dword [rdi + 0x78]
mov qword [rsp + 0x60], rdx
lea rsi, [rdx + rax*4]
lea r14, [rsi + 4]
cmp r10d, r13d
jbe 0x140003053
mov eax, ebp
dec ebp
test eax, eax
je 0x140003053
mov ecx, dword [rdi + 0x3c]
mov eax, dword [rdi + 0x5c]
sub ecx, r10d
cmp ecx, eax
ja 0x140002fce
sub eax, ecx
jmp 0x140002fd3
sub eax, ecx
add eax, dword [rdi + 0x60]
add eax, eax
mov r8d, r10d
add r8, qword [rdi + 0x30]
cmp r15d, r12d
lea r11, [rdx + rax*4]
mov eax, r12d
cmovb eax, r15d
movzx ecx, byte [rax + rbx]
cmp byte [rax + r8], cl
jne 0x14000301f
inc eax
cmp eax, r9d
je 0x140003011
nop dword [rax + rax]
movzx ecx, byte [rax + rbx]
cmp byte [rax + r8], cl
jne 0x14000301f
inc eax
cmp eax, r9d
jne 0x140003000
mov eax, dword [r11]
mov dword [rsi], eax
mov eax, dword [r11 + 4]
mov dword [r14], eax
jmp 0x140003060
movzx ecx, byte [rax + rbx]
cmp byte [rax + r8], cl
jae 0x140003038
mov dword [rsi], r10d
mov r12d, eax
lea rsi, [r11 + 4]
mov r11, rsi
jmp 0x140003041
mov dword [r14], r10d
mov r15d, eax
mov r14, r11
mov r10d, dword [r11]
cmp r10d, r13d
jbe 0x140003053
mov rdx, qword [rsp + 0x60]
jmp 0x140002fb1
mov dword [rsi], 0
mov dword [r14], 0
mov eax, dword [rdi + 0x5c]
inc eax
mov dword [rdi + 0x5c], eax
cmp eax, dword [rdi + 0x60]
jne 0x140003074
mov dword [rdi + 0x5c], 0
mov ecx, dword [rdi + 0x3c]
inc ecx
mov dword [rdi + 0x3c], ecx
cmp ecx, dword [rdi + 0x20]
jbe 0x1400030c9
mov r8, qword [rdi + 0x30]
mov eax, ecx
add rax, r8
cmp rax, qword [rdi + 0x28]
jbe 0x1400030bc
mov eax, r8d
sub eax, dword [rdi + 0x40]
sub eax, dword [rdi + 0x10]
add ecx, eax
mov eax, dword [rdi + 0x48]
lea ebx, [rcx - 1]
cmove ebx, ecx
mov rcx, qword [rdi + 0x10]
sub eax, ebx
sub eax, ecx
add r8d, eax
lea rdx, [rbx + rcx]
call fcn.1400c7540
sub qword [rdi + 0x30], rbx
lea rcx, [rdi + 8]
call fcn.140002850
test eax, eax
jne 0x1400030e7
cmp dword [rdi + 0x3c], 0x7fffffff
jne 0x1400030da
mov rcx, rdi
call fcn.140003100
add dword [rsp + 0x68], 0xffffffff
jne 0x140002f20
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret