joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800e29b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e29e9
xor al, al
jmp 0x1800e2b97
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e29fe
xor al, al
jmp 0x1800e2b97
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf790
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e2b8b
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800e2b87
int3
xor al, al
jmp 0x1800e2b97
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e2bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e2be9
xor al, al
jmp 0x1800e2d97
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e2bfe
xor al, al
jmp 0x1800e2d97
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf790
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e2d8b
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800e2d87
int3
xor al, al
jmp 0x1800e2d97
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e7780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x130], rax
mov rcx, qword [rbp + 0x160]
call fcn.1801610b0
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1800e77c2
xor eax, eax
jmp 0x1800e78c6
lea rdx, str.CreateInterface
mov rcx, qword [rbp + 8]
call fcn.1801609f0
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1800e78af
mov byte [rbp + 0x108], 0x5b
mov byte [rbp + 0x109], 0x69
mov byte [rbp + 0x10a], 0x6e
mov byte [rbp + 0x10b], 0x74
mov byte [rbp + 0x10c], 0x65
mov byte [rbp + 0x10d], 0x72
mov byte [rbp + 0x10e], 0x66
mov byte [rbp + 0x10f], 0x61
mov byte [rbp + 0x110], 0x63
mov byte [rbp + 0x111], 0x65
mov byte [rbp + 0x112], 0x73
mov byte [rbp + 0x113], 0x2e
mov byte [rbp + 0x114], 0x63
mov byte [rbp + 0x115], 0x70
mov byte [rbp + 0x116], 0x70
mov byte [rbp + 0x117], 0x3a
mov byte [rbp + 0x118], 0x34
mov byte [rbp + 0x119], 0x30
mov byte [rbp + 0x11a], 0x5d
mov byte [rbp + 0x11b], 0x20
mov byte [rbp + 0x11c], 0
lea rcx, [rbp + 0x108]
call fcn.1800e7720
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x128], rax
lea rdx, str.failed_to_get__CreateInterface__address
mov rcx, qword [rbp + 0x128]
call fcn.18015de80
xor eax, eax
jmp 0x1800e78c6
mov r8d, 7
mov edx, 3
mov rcx, qword [rbp + 0x28]
call fcn.1800e2e50
mov rax, qword [rax]
mov rcx, qword [rbp + 0x130]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x1800e84d0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
mov rbp, rsp
mov qword [rbp + 8], 0
jmp 0x1800e8500
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x1800e8556
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x1800e84f5
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1800ff100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x160], rax
movabs rdx, 0xcbf29ce484222325
mov rcx, qword [rbp + 0x190]
call fcn.1800d4af0
mov rcx, rax
call fcn.1800ff280
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
ja 0x1800ff25f
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x73
mov byte [rbp + 0xea], 0x63
mov byte [rbp + 0xeb], 0x68
mov byte [rbp + 0xec], 0x65
mov byte [rbp + 0xed], 0x6d
mov byte [rbp + 0xee], 0x61
mov byte [rbp + 0xef], 0x2e
mov byte [rbp + 0xf0], 0x63
mov byte [rbp + 0xf1], 0x70
mov byte [rbp + 0xf2], 0x70
mov byte [rbp + 0xf3], 0x3a
mov byte [rbp + 0xf4], 0x31
mov byte [rbp + 0xf5], 0x30
mov byte [rbp + 0xf6], 0x39
mov byte [rbp + 0xf7], 0x5d
mov byte [rbp + 0xf8], 0x20
mov byte [rbp + 0xf9], 0
lea rcx, [rbp + 0xe8]
call fcn.1800ceb30
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.not_find_schema:
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x150]
call fcn.18015dfd0
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x158]
call fcn.18015de80
xor eax, eax
test eax, eax
jne 0x1800ff25f
int3
mov eax, dword [rbp + 4]
mov rcx, qword [rbp + 0x160]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x180100600
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xd8
mov rbp, rsp
xor eax, eax
test eax, eax
je 0x18010062c
movsx eax, byte [rbp + 0xf8]
or eax, 0x20
mov dword [rbp + 0xc0], eax
jmp 0x180100639
movsx eax, byte [rbp + 0xf8]
mov dword [rbp + 0xc0], eax
mov eax, dword [rbp + 0xc0]
mov ecx, dword [rbp + 0xf0]
xor ecx, eax
mov eax, ecx
imul eax, eax, 0x1000193
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret

Function at 0x180101560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x168], rax
call fcn.18012af60
movzx eax, al
test eax, eax
jne 0x180101653
mov byte [rbp + 0xc8], 0x5b
mov byte [rbp + 0xc9], 0x66
mov byte [rbp + 0xca], 0x65
mov byte [rbp + 0xcb], 0x61
mov byte [rbp + 0xcc], 0x74
mov byte [rbp + 0xcd], 0x75
mov byte [rbp + 0xce], 0x72
mov byte [rbp + 0xcf], 0x65
mov byte [rbp + 0xd0], 0x73
mov byte [rbp + 0xd1], 0x2e
mov byte [rbp + 0xd2], 0x63
mov byte [rbp + 0xd3], 0x70
mov byte [rbp + 0xd4], 0x70
mov byte [rbp + 0xd5], 0x3a
mov byte [rbp + 0xd6], 0x33
mov byte [rbp + 0xd7], 0x35
mov byte [rbp + 0xd8], 0x5d
mov byte [rbp + 0xd9], 0x20
mov byte [rbp + 0xda], 0
lea rcx, [rbp + 0xc8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x158], rax
lea rdx, str.failed_to_setup_visuals
mov rcx, qword [rbp + 0x158]
call fcn.18015de80
xor al, al
jmp 0x180101749
mov byte [rbp + 0xf8], 0x5b
mov byte [rbp + 0xf9], 0x66
mov byte [rbp + 0xfa], 0x65
mov byte [rbp + 0xfb], 0x61
mov byte [rbp + 0xfc], 0x74
mov byte [rbp + 0xfd], 0x75
mov byte [rbp + 0xfe], 0x72
mov byte [rbp + 0xff], 0x65
mov byte [rbp + 0x100], 0x73
mov byte [rbp + 0x101], 0x2e
mov byte [rbp + 0x102], 0x63
mov byte [rbp + 0x103], 0x70
mov byte [rbp + 0x104], 0x70
mov byte [rbp + 0x105], 0x3a
mov byte [rbp + 0x106], 0x33
mov byte [rbp + 0x107], 0x38
mov byte [rbp + 0x108], 0x5d
mov byte [rbp + 0x109], 0x20
mov byte [rbp + 0x10a], 0
lea rcx, [rbp + 0xf8]
call fcn.1800df810
mov r8, rax
xor edx, edx
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x158], rax
mov cx, 0xa
call fcn.18015e710
mov word [rbp + 0x124], ax
movzx eax, word [rbp + 0x124]
mov word [rbp + 0x144], ax
movzx edx, word [rbp + 0x144]
mov rcx, qword [rbp + 0x158]
call fcn.18015df90
mov qword [rbp + 0x160], rax
lea rdx, str.features_VISUALS_completed
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov al, 1
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x18010ee00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0xf0], rax
mov eax, 0x28
mov eax, eax
mov ecx, dword [0x180379358]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x180378568], eax
jle 0x18010ee93
lea rcx, [0x180378568]
call fcn.1802254a0
cmp dword [0x180378568], 0xffffffff
jne 0x18010ee93
lea rdx, str.48_89_5C_24_08_48_89_74_24_10_57_48_83_EC_20_0F_B6_41_37_33
lea rcx, [0x180258d60]
call fcn.1801605c0
mov qword [0x180378560], rax
lea rcx, [0x180378568]
call fcn.180225440
cmp qword [0x180378560], 0
jne 0x18010ef48
mov byte [rbp + 0xc8], 0x5b
mov byte [rbp + 0xc9], 0x69
mov byte [rbp + 0xca], 0x74
mov byte [rbp + 0xcb], 0x72
mov byte [rbp + 0xcc], 0x61
mov byte [rbp + 0xcd], 0x63
mov byte [rbp + 0xce], 0x65
mov byte [rbp + 0xcf], 0x2e
mov byte [rbp + 0xd0], 0x68
mov byte [rbp + 0xd1], 0x3a
mov byte [rbp + 0xd2], 0x32
mov byte [rbp + 0xd3], 0x32
mov byte [rbp + 0xd4], 0x33
mov byte [rbp + 0xd5], 0x5d
mov byte [rbp + 0xd6], 0x20
mov byte [rbp + 0xd7], 0
lea rcx, [rbp + 0xc8]
call fcn.1800c78b0
mov r8, rax
mov dl, 2
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0xe8], rax
lea rdx, str.trace_filter_t_Invalid_signature_
mov rcx, qword [rbp + 0xe8]
call fcn.18015de80
cmp qword [0x180378560], 0
jne 0x18010ef55
int3
mov rax, qword [0x180378560]
mov qword [rbp + 0xe8], rax
movzx eax, word [rbp + 0x148]
mov word [rsp + 0x20], ax
movzx r9d, byte [rbp + 0x140]
mov r8, qword [rbp + 0x138]
mov rdx, qword [rbp + 0x130]
mov rcx, qword [rbp + 0x128]
call qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xf0]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x18011b220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x40]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0xf0], rax
mov eax, 0x28
mov eax, eax
mov ecx, dword [0x180379358]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x180378820], eax
jle 0x18011b2b3
lea rcx, [0x180378820]
call fcn.1802254a0
cmp dword [0x180378820], 0xffffffff
jne 0x18011b2b3
lea rdx, str.48_8B_C4_55_56_48_8D_A8_58_FF_FF_FF_48_81_EC_98_01_00_00_48
lea rcx, [0x180258d60]
call fcn.1801605c0
mov qword [0x180378818], rax
lea rcx, [0x180378820]
call fcn.180225440
cmp qword [0x180378818], 0
jne 0x18011b382
mov byte [rbp + 0xc8], 0x5b
mov byte [rbp + 0xc9], 0x69
mov byte [rbp + 0xca], 0x74
mov byte [rbp + 0xcb], 0x72
mov byte [rbp + 0xcc], 0x61
mov byte [rbp + 0xcd], 0x63
mov byte [rbp + 0xce], 0x65
mov byte [rbp + 0xcf], 0x2e
mov byte [rbp + 0xd0], 0x68
mov byte [rbp + 0xd1], 0x3a
mov byte [rbp + 0xd2], 0x32
mov byte [rbp + 0xd3], 0x34
mov byte [rbp + 0xd4], 0x31
mov byte [rbp + 0xd5], 0x5d
mov byte [rbp + 0xd6], 0x20
mov byte [rbp + 0xd7], 0
lea rcx, [rbp + 0xc8]
call fcn.1800c78b0
mov r8, rax
mov dl, 2
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0xe8], rax
lea rdx, str.ClipTraceToPlayers_creating_new_signature_
mov rcx, qword [rbp + 0xe8]
call fcn.18015de80
lea rdx, str.48_8B_C4_55_56_48_8D_A8_58
lea rcx, [0x180258d60]
call fcn.1801605c0
mov qword [0x180378818], rax
cmp qword [0x180378818], 0
jne 0x18011b38f
int3
mov rax, qword [0x180378818]
mov qword [rbp + 0xe8], rax
cvtsi2ss xmm0, dword [rbp + 0x150]
cvttss2si eax, dword [rbp + 0x158]
movss dword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], eax
movss xmm0, dword [rbp + 0x148]
movss dword [rsp + 0x20], xmm0
mov r9, qword [rbp + 0x140]
mov r8, qword [rbp + 0x138]
mov rdx, qword [rbp + 0x130]
mov rcx, qword [rbp + 0x128]
call qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xf0]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x180124e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x1f0
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x1c0], rax
call qword [0x180377b10]
test rax, rax
jne 0x180124f46
mov byte [rbp + 0x128], 0x5b
mov byte [rbp + 0x129], 0x63
mov byte [rbp + 0x12a], 0x63
mov byte [rbp + 0x12b], 0x73
mov byte [rbp + 0x12c], 0x70
mov byte [rbp + 0x12d], 0x6c
mov byte [rbp + 0x12e], 0x61
mov byte [rbp + 0x12f], 0x79
mov byte [rbp + 0x130], 0x65
mov byte [rbp + 0x131], 0x72
mov byte [rbp + 0x132], 0x69
mov byte [rbp + 0x133], 0x6e
mov byte [rbp + 0x134], 0x76
mov byte [rbp + 0x135], 0x65
mov byte [rbp + 0x136], 0x6e
mov byte [rbp + 0x137], 0x74
mov byte [rbp + 0x138], 0x6f
mov byte [rbp + 0x139], 0x72
mov byte [rbp + 0x13a], 0x79
mov byte [rbp + 0x13b], 0x2e
mov byte [rbp + 0x13c], 0x63
mov byte [rbp + 0x13d], 0x70
mov byte [rbp + 0x13e], 0x70
mov byte [rbp + 0x13f], 0x3a
mov byte [rbp + 0x140], 0x38
mov byte [rbp + 0x141], 0x5d
mov byte [rbp + 0x142], 0x20
mov byte [rbp + 0x143], 0
lea rcx, [rbp + 0x128]
call fcn.180125100
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x1b8], rax
lea rdx, str.failed_to_get_client_system
mov rcx, qword [rbp + 0x1b8]
call fcn.18015de80
xor eax, eax
jmp 0x180124fca
call qword [0x180377b10]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x180124f5b
xor eax, eax
jmp 0x180124fca
mov rcx, qword [rbp + 8]
call fcn.180125160
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x180124f73
xor eax, eax
jmp 0x180124fca
lea rdx, [rbp + 0x168]
mov rcx, qword [rbp + 0x1f0]
call fcn.1800f1a30
lea rcx, [rbp + 0x1a0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8b, 1
lea rdx, [rbp + 0x1a0]
mov rcx, qword [rbp + 0x28]
call fcn.18013a9e0
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x180124fbc
xor eax, eax
jmp 0x180124fca
mov edx, 1
mov rcx, qword [rbp + 0x48]
call fcn.18013a890
mov rcx, qword [rbp + 0x1c0]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x1d0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x18012af60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1803788e0]
call fcn.18012ae40
mov rcx, rax
call fcn.18012b6f0
movzx eax, al
test eax, eax
jne 0x18012b05b
mov byte [rbp + 0xc8], 0x5b
mov byte [rbp + 0xc9], 0x76
mov byte [rbp + 0xca], 0x69
mov byte [rbp + 0xcb], 0x73
mov byte [rbp + 0xcc], 0x75
mov byte [rbp + 0xcd], 0x61
mov byte [rbp + 0xce], 0x6c
mov byte [rbp + 0xcf], 0x73
mov byte [rbp + 0xd0], 0x2e
mov byte [rbp + 0xd1], 0x63
mov byte [rbp + 0xd2], 0x70
mov byte [rbp + 0xd3], 0x70
mov byte [rbp + 0xd4], 0x3a
mov byte [rbp + 0xd5], 0x31
mov byte [rbp + 0xd6], 0x39
mov byte [rbp + 0xd7], 0x5d
mov byte [rbp + 0xd8], 0x20
mov byte [rbp + 0xd9], 0
lea rcx, [rbp + 0xc8]
call fcn.1800ceb30
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x158], rax
lea rdx, str.failed_to_initialize_DrawObject_chams__swapping_to_K3V
mov rcx, qword [rbp + 0x158]
call fcn.18015de80
mov al, 1
jmp 0x18012b14a
mov byte [rbp + 0xf8], 0x5b
mov byte [rbp + 0xf9], 0x76
mov byte [rbp + 0xfa], 0x69
mov byte [rbp + 0xfb], 0x73
mov byte [rbp + 0xfc], 0x75
mov byte [rbp + 0xfd], 0x61
mov byte [rbp + 0xfe], 0x6c
mov byte [rbp + 0xff], 0x73
mov byte [rbp + 0x100], 0x2e
mov byte [rbp + 0x101], 0x63
mov byte [rbp + 0x102], 0x70
mov byte [rbp + 0x103], 0x70
mov byte [rbp + 0x104], 0x3a
mov byte [rbp + 0x105], 0x32
mov byte [rbp + 0x106], 0x32
mov byte [rbp + 0x107], 0x5d
mov byte [rbp + 0x108], 0x20
mov byte [rbp + 0x109], 0
lea rcx, [rbp + 0xf8]
call fcn.1800ceb30
mov r8, rax
xor edx, edx
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x158], rax
mov cx, 0xa
call fcn.18015e710
mov word [rbp + 0x124], ax
movzx eax, word [rbp + 0x124]
mov word [rbp + 0x144], ax
movzx edx, word [rbp + 0x144]
mov rcx, qword [rbp + 0x158]
call fcn.18015df90
mov qword [rbp + 0x160], rax
lea rdx, str.chams_initialization_completed
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov al, 1
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x18013a6e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0xf0], rax
mov eax, 0x28
mov eax, eax
mov ecx, dword [0x180379358]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x180378b08], eax
jle 0x18013a77e
lea rcx, [0x180378b08]
call fcn.1802254a0
cmp dword [0x180378b08], 0xffffffff
jne 0x18013a77e
lea rdx, str.E9_________F6_43_5B_FD
lea rcx, [0x180258d60]
call fcn.1801605c0
xor r8d, r8d
mov edx, 1
mov rcx, rax
call fcn.1800e6b90
mov qword [0x180378bf8], rax
lea rcx, [0x180378b08]
call fcn.180225440
cmp qword [0x180378bf8], 0
jne 0x18013a845
mov byte [rbp + 0xc8], 0x5b
mov byte [rbp + 0xc9], 0x65
mov byte [rbp + 0xca], 0x6e
mov byte [rbp + 0xcb], 0x74
mov byte [rbp + 0xcc], 0x69
mov byte [rbp + 0xcd], 0x74
mov byte [rbp + 0xce], 0x79
mov byte [rbp + 0xcf], 0x2e
mov byte [rbp + 0xd0], 0x63
mov byte [rbp + 0xd1], 0x70
mov byte [rbp + 0xd2], 0x70
mov byte [rbp + 0xd3], 0x3a
mov byte [rbp + 0xd4], 0x37
mov byte [rbp + 0xd5], 0x31
mov byte [rbp + 0xd6], 0x30
mov byte [rbp + 0xd7], 0x5d
mov byte [rbp + 0xd8], 0x20
mov byte [rbp + 0xd9], 0
lea rcx, [rbp + 0xc8]
call fcn.1800ceb30
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0xe8], rax
lea rdx, str._C_BaseEntity::ComputeHitboxSurroundingBox__C_HOOK::ComputeHitboxSurroundingBox___null
mov rcx, qword [rbp + 0xe8]
call fcn.18015de80
xor al, al
jmp 0x18013a86e
mov rax, qword [0x180378bf8]
mov qword [rbp + 0xe8], rax
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xf0]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x18013c570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0xf0], rax
cmp qword [0x180377b28], 0
jne 0x18013c65c
mov byte [rbp + 0xc8], 0x5b
mov byte [rbp + 0xc9], 0x65
mov byte [rbp + 0xca], 0x6e
mov byte [rbp + 0xcb], 0x74
mov byte [rbp + 0xcc], 0x69
mov byte [rbp + 0xcd], 0x74
mov byte [rbp + 0xce], 0x79
mov byte [rbp + 0xcf], 0x2e
mov byte [rbp + 0xd0], 0x63
mov byte [rbp + 0xd1], 0x70
mov byte [rbp + 0xd2], 0x70
mov byte [rbp + 0xd3], 0x3a
mov byte [rbp + 0xd4], 0x37
mov byte [rbp + 0xd5], 0x36
mov byte [rbp + 0xd6], 0x33
mov byte [rbp + 0xd7], 0x5d
mov byte [rbp + 0xd8], 0x20
mov byte [rbp + 0xd9], 0
lea rcx, [rbp + 0xc8]
call fcn.1800ceb30
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0xe8], rax
lea rdx, str.error_getting_meshgroupmask
mov rcx, qword [rbp + 0xe8]
call fcn.18015de80
mov rax, qword [0x180377b28]
mov qword [rbp + 0xe8], rax
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xf0]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x180140700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0xf0], rax
movzx eax, byte [0x180378d08]
test eax, eax
jne 0x180140730
jmp 0x180140832
call fcn.18001cb10
mov rcx, qword [rax + 0x30]
call fcn.1800736b0
call fcn.18001cb10
mov rax, qword [rax + 0x30]
mov qword [rax + 8], 0
mov rcx, qword [0x180378378]
call fcn.1800066f0
mov rcx, qword [0x180378d10]
call fcn.1800066f0
mov rcx, qword [0x180378d18]
call fcn.1800066f0
call fcn.180089400
call fcn.180089cb0
xor ecx, ecx
call fcn.180017ca0
mov byte [rbp + 0xc8], 0x5b
mov byte [rbp + 0xc9], 0x64
mov byte [rbp + 0xca], 0x72
mov byte [rbp + 0xcb], 0x61
mov byte [rbp + 0xcc], 0x77
mov byte [rbp + 0xcd], 0x2e
mov byte [rbp + 0xce], 0x63
mov byte [rbp + 0xcf], 0x70
mov byte [rbp + 0xd0], 0x70
mov byte [rbp + 0xd1], 0x3a
mov byte [rbp + 0xd2], 0x36
mov byte [rbp + 0xd3], 0x30
mov byte [rbp + 0xd4], 0x37
mov byte [rbp + 0xd5], 0x5d
mov byte [rbp + 0xd6], 0x20
mov byte [rbp + 0xd7], 0
lea rcx, [rbp + 0xc8]
call fcn.1800c78b0
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0xe8], rax
lea rdx, str._Destroy__unloaded
mov rcx, qword [rbp + 0xe8]
call fcn.18015de80
mov byte [0x180378d08], 0
mov rcx, qword [rbp + 0xf0]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret