joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180212000
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x80
mov rbx, rcx
mov rcx, qword [0x1803cd030]
call fcn.18025f340
mov rcx, qword [0x1803cd030]
movabs rdx, 0x9de624d2fc4b603f
call fcn.18025f4a0
mov rax, qword [0x1803cd030]
lea r10, str.player_zero
mov rdx, qword [rax]
lea rax, str.mp_m_freemode_01
cmp dword [rdx], 0
cmovne r10, rax
xor r11d, r11d
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r10 + rax], r11b
jne 0x180212057
add rax, r10
cmp r10, rax
je 0x1802120a8
nop dword [rax + rax]
movzx r9d, byte [r10]
movzx ecx, r9b
or cl, 0x20
movzx edx, cl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova edx, r9d
inc r10
movsx ecx, dl
add ecx, r11d
imul r11d, ecx, 0x401
mov ecx, r11d
shr ecx, 6
xor r11d, ecx
cmp r10, rax
jne 0x180212070
movups xmm0, xmmword [rbx + 8]
lea eax, [r11 + r11*8]
movsd xmm2, qword [rbx + 0x18]
lea r8, [rsp + 0x40]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
lea rax, vtable.std::_Func_impl_no_alloc_class__public:_void___cdecl__void___cdecl_Base::submenus::teleport::objective_class_Vector3_::_5::_lambda_1_::operator___void_const___ptr64::_2::_lambda_1___void___.0
imul edx, ecx, 0x8001
mov rcx, qword [0x18041b098]
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x30]
mov dword [rsp + 0x20], edx
movups xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x78], rax
unpcklpd xmm1, xmm2
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm1
call fcn.180130890
add rsp, 0x80
pop rbx
ret

Function at 0x180212120
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x80
mov rbx, rcx
mov rcx, qword [0x1803cd030]
call fcn.18025f340
mov rcx, qword [0x1803cd030]
movabs rdx, 0x9de624d2fc4b603f
call fcn.18025f4a0
mov rax, qword [0x1803cd030]
lea r10, str.player_zero
mov rdx, qword [rax]
lea rax, str.mp_m_freemode_01
cmp dword [rdx], 0
cmovne r10, rax
xor r11d, r11d
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r10 + rax], r11b
jne 0x180212177
add rax, r10
cmp r10, rax
je 0x1802121c8
nop dword [rax + rax]
movzx r9d, byte [r10]
movzx ecx, r9b
or cl, 0x20
movzx edx, cl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova edx, r9d
inc r10
movsx ecx, dl
add ecx, r11d
imul r11d, ecx, 0x401
mov ecx, r11d
shr ecx, 6
xor r11d, ecx
cmp r10, rax
jne 0x180212190
movups xmm0, xmmword [rbx + 8]
lea eax, [r11 + r11*8]
movsd xmm2, qword [rbx + 0x18]
lea r8, [rsp + 0x40]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
lea rax, vtable.std::_Func_impl_no_alloc_class__public:_void___cdecl__void___cdecl_Base::submenus::teleport::teleport_class_Vector3_::_5::_lambda_1_::operator___void_const___ptr64::_2::_lambda_1___void___.0
imul edx, ecx, 0x8001
mov rcx, qword [0x18041b098]
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x30]
mov dword [rsp + 0x20], edx
movups xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x78], rax
unpcklpd xmm1, xmm2
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm1
call fcn.180130890
add rsp, 0x80
pop rbx
ret
Function at 0x180212670
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 8]
lea rcx, str.Public
cmp rax, rcx
jne 0x180212687
xor ecx, ecx
jmp fcn.1800e4e10
lea rcx, str.New_Public
cmp rax, rcx
jne 0x18021269d
mov ecx, 1
jmp fcn.1800e4e10
lea rcx, str.Closed_Crew
cmp rax, rcx
jne 0x1802126b3
mov ecx, 2
jmp fcn.1800e4e10
lea rcx, str.Crew
cmp rax, rcx
je 0x180212723
lea rcx, str.Friends
cmp rax, rcx
jne 0x1802126d5
mov ecx, 6
jmp fcn.1800e4e10
lea rcx, str.Find_Friend
cmp rax, rcx
jne 0x1802126eb
mov ecx, 9
jmp fcn.1800e4e10
lea rcx, str.Solo
cmp rax, rcx
jne 0x180212701
mov ecx, 0xa
jmp fcn.1800e4e10
lea rcx, str.Invite_Only
cmp rax, rcx
jne 0x180212717
mov ecx, 0xb
jmp fcn.1800e4e10
lea rcx, str.Join_Crew
cmp rax, rcx
jne 0x18021272d
mov ecx, 3
jmp fcn.1800e4e10
ret

Function at 0x180212ba0
Capabilities:
Encode data using xor

Disassembly:
movsxd rdx, dword [rcx + 8]
mov rax, qword [0x18041f580]
shl rdx, 6
add rax, rdx
cmp qword [rax + 0x38], 0x10
lea r9, [rax + 0x20]
jb 0x180212bc1
mov r9, qword [rax + 0x20]
mov r11, qword [rax + 0x30]
xor r10d, r10d
add r11, r9
cmp r9, r11
je 0x180212c06
movzx r8d, byte [r9]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r9
movsx eax, cl
add eax, r10d
imul r10d, eax, 0x401
mov eax, r10d
shr eax, 6
xor r10d, eax
cmp r9, r11
jne 0x180212bd0
lea eax, [r10 + r10*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
mov dword [0x1803cda0c], eax
ret
Function at 0x1802131e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
xor edi, edi
movups xmm0, xmmword [rcx]
movaps xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rcx + 0x10]
movaps xmmword [rbp - 9], xmm1
lea rdx, [rcx + 0x20]
lea rcx, [rbp + 7]
call fcn.18013cda0
nop
lea rdx, [rbx + 0x40]
lea rcx, [rbp + 0x27]
call fcn.1800be2c0
nop
lea ecx, [rdi + 0x60]
call fcn.1802697d0
mov rbx, rax
mov qword [rbp - 0x39], rax
test rax, rax
je 0x1801f06c8
movaps xmm0, xmmword [rbp - 0x19]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [rbp - 9]
movups xmmword [rax + 0x10], xmm1
lea rcx, [rax + 0x20]
lea rdx, [rbp + 7]
call fcn.18013cda0
movaps xmm0, xmmword [rbp + 0x27]
movups xmmword [rbx + 0x40], xmm0
movaps xmm1, xmmword [rbp + 0x37]
movups xmmword [rbx + 0x50], xmm1
movdqa xmm0, xmmword [0x18029c040]
movdqa xmmword [rbp + 0x37], xmm0
mov byte [rbp + 0x27], dil
jmp 0x1801f06cb
mov rbx, rdi
mov qword [rbp - 0x39], rbx
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea r8, [0x1801c75f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x29], rax
test rax, rax
je 0x1801f079d
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x1801f073b
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801f0736
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1801f0736
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18026980c
movdqa xmm0, xmmword [0x18029c040]
movdqa xmmword [rbp + 0x37], xmm0
mov byte [rbp + 0x27], 0
lea rcx, [rbp + 7]
call fcn.18013d160
cmp dword [rbp - 0x21], 0
je 0x1801f0792
movaps xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rbp - 0x39], xmm0
lea rcx, [rbp - 0x39]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1801f0792
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180269d00
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rbp - 0x21], edi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
add rcx, 8
jmp 0x1801f0620
Function at 0x180213c20
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180213d8c
cmp byte [0x18041b6d0], 0
jne 0x180213d8c
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea rdx, [0x1803d9028]
lea rcx, [rsp + 0x70]
call fcn.1800be2c0
mov rdi, rax
mov qword [rsp + 0x68], rax
mov rcx, qword [0x1803cd030]
call fcn.18025f340
movabs rdx, 0x4f8644af03d0e0d6
mov rcx, qword [0x1803cd030]
call fcn.18025f4a0
mov rcx, qword [0x1803cd030]
mov rdx, qword [rcx]
mov ebx, dword [rdx]
lea rax, [0x1803cd488]
mov qword [rsp + 0x90], rax
mov rdx, rdi
lea rcx, [rsp + 0x98]
call fcn.1800be2c0
mov dword [rsp + 0xb8], ebx
lea rax, vtable.std::_Func_impl_no_alloc_class__public:_void___cdecl_Base::chat_commands::execute_int__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64::_2::_lambda_1___void___.0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
movups xmm1, xmmword [rsp + 0x98]
movups xmmword [rsp + 0x38], xmm1
movups xmm0, xmmword [rsp + 0xa8]
movups xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x18029c040]
movdqu xmmword [rsp + 0xa8], xmm1
mov byte [rsp + 0x98], 0
mov dword [rsp + 0x58], ebx
lea rax, [rsp + 0x28]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x28]
lea rcx, [0x1803cd040]
call fcn.1800e5450
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x180213d79
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x180213d74
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180213dad
mov rcx, r8
call fcn.18026980c
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180269d00
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x180216740
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rcx
xor r14d, r14d
movups xmm0, xmmword [rcx]
movaps xmmword [rbp - 0x29], xmm0
movups xmm1, xmmword [rcx + 0x10]
movaps xmmword [rbp - 0x19], xmm1
lea rdx, [rcx + 0x20]
lea rcx, [rbp - 9]
call fcn.18013cda0
nop
mov rax, qword [rbx + 0x40]
mov qword [rbp + 0x17], rax
lea rdx, [rbx + 0x48]
lea rcx, [rbp + 0x1f]
call fcn.1801d3540
nop
lea ecx, [r14 + 0x60]
call fcn.1802697d0
mov rsi, rax
mov qword [rbp - 0x49], rax
test rax, rax
je 0x1801f8d76
movaps xmm0, xmmword [rbp - 0x29]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [rbp - 0x19]
movups xmmword [rax + 0x10], xmm1
lea rcx, [rax + 0x20]
lea rdx, [rbp - 9]
call fcn.18013cda0
mov rax, qword [rbp + 0x17]
mov qword [rsi + 0x40], rax
mov rdx, qword [rbp + 0x2f]
mov edi, r14d
mov qword [rbp + 0x2f], r14
mov rcx, qword [rbp + 0x27]
mov qword [rbp + 0x27], r14
mov rax, qword [rbp + 0x1f]
mov ebx, r14d
mov qword [rbp + 0x1f], rbx
mov qword [rsi + 0x48], rax
mov qword [rsi + 0x50], rcx
mov qword [rsi + 0x58], rdx
jmp 0x1801f8d81
mov rsi, r14
mov rdi, qword [rbp + 0x2f]
mov rbx, qword [rbp + 0x1f]
mov qword [rbp - 0x49], rsi
lea rax, [rbp - 0x31]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rsi
lea r8, [0x1801c7670]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x39], rax
test rax, rax
je 0x1801f8e58
test rbx, rbx
je 0x1801f8e04
sub rdi, rbx
sar rdi, 3
lea rdx, [rdi*8]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1801f8df0
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1801f8df0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.18026980c
mov qword [rbp + 0x1f], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x27], xmm0
lea rcx, [rbp - 9]
call fcn.18013d160
cmp dword [rbp - 0x31], 0
je 0x1801f8e4d
movaps xmm0, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x49], xmm0
lea rcx, [rbp - 0x49]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1801f8e4d
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.180269d00
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rbp - 0x31], r14d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
add rcx, 8
jmp 0x1801f8cb0
Function at 0x180216750
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [rcx + 8]
movaps xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rcx + 0x18]
movaps xmmword [rsp + 0x60], xmm1
lea rdx, [rcx + 0x28]
lea rcx, [rsp + 0x70]
call fcn.18013cda0
nop
mov ecx, 0x40
call fcn.1802697d0
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1802167c4
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rax + 0x10], xmm1
lea rcx, [rax + 0x20]
lea rdx, [rsp + 0x70]
call fcn.18013cda0
jmp 0x1802167c6
xor ebx, ebx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x1801c76b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180216849
lea rcx, [rsp + 0x70]
call fcn.18013d160
cmp dword [rsp + 0x48], 0
je 0x18021683e
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x18021683e
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180269d00
add rsp, 0xa0
pop rbx
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x48], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x180218870
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0xd0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
lea rdx, [rax - 0x68]
mov rcx, qword [0x18041b0b8]
call fcn.1800fbe60
nop
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
cmp rdi, rsi
je 0x18021899a
movabs rbp, 0xa794a5a57f8df91
movss xmm7, dword [0x1802a3030]
xorps xmm6, xmm6
movss xmm8, dword [0x180298e70]
nop word [rax + rax]
mov ebx, dword [rdi]
mov rcx, qword [0x1803cd030]
call fcn.18025f340
mov rdx, qword [0x1803cd030]
mov ecx, dword [rdx + 8]
mov rax, qword [rdx + 0x10]
mov dword [rax + rcx*8], ebx
inc dword [rdx + 8]
mov rdx, rbp
mov rcx, qword [0x1803cd030]
call fcn.18025f4a0
mov rax, qword [0x1803cd030]
mov rcx, qword [rax]
movups xmm2, xmmword [rcx]
movsd xmm1, qword [rcx + 0x10]
xorps xmm1, xmm7
movaps xmm0, xmm2
shufps xmm0, xmm2, 0xaa
xorps xmm0, xmm7
xorps xmm2, xmm7
movss dword [rsp + 0x68], xmm6
movss dword [rsp + 0x60], xmm6
movss dword [rsp + 0x58], xmm6
movss dword [rsp + 0x50], xmm6
movss dword [rsp + 0x48], xmm6
movss dword [rsp + 0x40], xmm6
movss dword [rsp + 0x38], xmm8
movss dword [rsp + 0x30], xmm1
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x20], xmm2
mov edx, 0x5dc
mov r9d, 1
mov r8d, 0x7d0
mov ecx, ebx
call fcn.1800e96e0
add rdi, 4
cmp rdi, rsi
jne 0x1802188e0
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x1802189de
mov rdx, qword [rsp + 0x80]
sub rdx, rdi
and rdx, 0xfffffffffffffffc
mov rax, rdi
cmp rdx, 0x1000
jb 0x1802189d6
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1802189d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.18026980c
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop rdi
ret
Function at 0x180218d10
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [rcx + 8]
movaps xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rcx + 0x18]
movaps xmmword [rsp + 0x60], xmm1
lea rdx, [rcx + 0x28]
lea rcx, [rsp + 0x70]
call fcn.18013cda0
nop
mov ecx, 0x40
call fcn.1802697d0
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180218d84
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rax + 0x10], xmm1
lea rcx, [rax + 0x20]
lea rdx, [rsp + 0x70]
call fcn.18013cda0
jmp 0x180218d86
xor ebx, ebx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x1801c76f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180218e09
lea rcx, [rsp + 0x70]
call fcn.18013d160
cmp dword [rsp + 0x48], 0
je 0x180218dfe
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x180218dfe
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180269d00
add rsp, 0xa0
pop rbx
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x48], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x180219bc0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [rcx + 8]
movaps xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rcx + 0x18]
movaps xmmword [rsp + 0x60], xmm1
lea rdx, [rcx + 0x28]
lea rcx, [rsp + 0x70]
call fcn.18013cda0
nop
mov ecx, 0x40
call fcn.1802697d0
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180219c34
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rax + 0x10], xmm1
lea rcx, [rax + 0x20]
lea rdx, [rsp + 0x70]
call fcn.18013cda0
jmp 0x180219c36
xor ebx, ebx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x1801c7730]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180219cb9
lea rcx, [rsp + 0x70]
call fcn.18013d160
cmp dword [rsp + 0x48], 0
je 0x180219cae
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x180219cae
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180269d00
add rsp, 0xa0
pop rbx
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x48], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x18021abe0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [rcx + 8]
movaps xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rcx + 0x18]
movaps xmmword [rsp + 0x60], xmm1
lea rdx, [rcx + 0x28]
lea rcx, [rsp + 0x70]
call fcn.18013cda0
nop
mov ecx, 0x40
call fcn.1802697d0
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18021ac54
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rax + 0x10], xmm1
lea rcx, [rax + 0x20]
lea rdx, [rsp + 0x70]
call fcn.18013cda0
jmp 0x18021ac56
xor ebx, ebx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x1801c7770]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18021acd9
lea rcx, [rsp + 0x70]
call fcn.18013d160
cmp dword [rsp + 0x48], 0
je 0x18021acce
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x18021acce
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180269d00
add rsp, 0xa0
pop rbx
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x48], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1802289d0
Capabilities:
Encode data using xor

Disassembly:
lea rcx, str.freemode
jmp 0x1802289d0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, 0xffffffffffffffff
mov r10d, esi
mov r9, rdi
mov rbx, rcx
inc r9
cmp byte [rcx + r9], sil
jne 0x1802289f1
add r9, rbx
cmp rbx, r9
je 0x180228a46
mov r11, rbx
nop word [rax + rax]
movzx r8d, byte [r11]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r11
movsx eax, cl
add eax, r10d
imul r10d, eax, 0x401
mov eax, r10d
shr eax, 6
xor r10d, eax
cmp r11, r9
jne 0x180228a10
lea eax, [r10 + r10*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
call fcn.1800e4110
nop dword [rax]
inc rdi
cmp byte [rbx + rdi], sil
jne 0x180228a60
add rdi, rbx
cmp rbx, rdi
je 0x180228aa3
movzx r8d, byte [rbx]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc rbx
movsx eax, cl
add eax, esi
imul esi, eax, 0x401
mov eax, esi
shr eax, 6
xor esi, eax
cmp rbx, rdi
jne 0x180228a71
lea eax, [rsi + rsi*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov rax, qword [section..data]
imul r8d, ecx, 0x8001
mov rcx, qword [rax + 0x320]
mov rdx, qword [rcx]
movzx eax, word [rcx + 8]
lea rcx, [rdx + rax*8]
cmp rdx, rcx
je 0x180228b34
mov rax, qword [rdx]
test rax, rax
je 0x180228af3
cmp dword [rax + 8], 0
je 0x180228af3
cmp qword [rax + 0x118], 0
je 0x180228af3
cmp dword [rax + 0x128], r8d
je 0x180228b0c
add rdx, 8
cmp rdx, rcx
jne 0x180228ad2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rax + 0x120]
test rcx, rcx
je 0x180228b34
cmp byte [0x18041f1cc], 0
movzx eax, byte [rcx + 0x192]
jne 0x180228b2c
or al, 0x80
jmp 0x180228b2e
and al, 0x7f
mov byte [rcx + 0x192], al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180229c50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
mov rbp, qword [0x18041f690]
xor ebx, ebx
mov rsi, qword [0x18041f688]
mov rax, rbp
sub rax, rsi
mov r14d, ecx
sar rax, 4
test rax, rax
je 0x180229d24
mov qword [rsp + 0x10], rdi
xor edi, edi
nop
mov r10, qword [rdi + rsi + 8]
xor r11d, r11d
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [r10 + rax], r11b
jne 0x180229ca0
add rax, r10
cmp r10, rax
je 0x180229ce9
movzx r9d, byte [r10]
movzx ecx, r9b
or cl, 0x20
movzx edx, cl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova edx, r9d
inc r10
movsx ecx, dl
add ecx, r11d
imul r11d, ecx, 0x401
mov ecx, r11d
shr ecx, 6
xor r11d, ecx
cmp r10, rax
jne 0x180229cb1
lea eax, [r11 + r11*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
cmp eax, r14d
je 0x180229d1d
inc ebx
mov rcx, rbp
sub rcx, rsi
movsxd rax, ebx
sar rcx, 4
add rdi, 0x10
cmp rax, rcx
jb 0x180229c90
jmp 0x180229d1f
mov eax, ebx
mov rdi, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
pop r14
ret