joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d9f0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0xc8
mov rax, qword [0x140033040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
cmp dword [0x140035054], 0
je 0x14000da68
test ecx, ecx
je 0x14000da3f
or dword [0x140035118], 1
mov ecx, 0x9823ae8d
call fcn.14000db10
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14000e290
add rsp, 0xc8
ret
and dword [0x140035118], 0xfffffffe
mov ecx, 0x9823ae8d
call fcn.14000db10
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14000e290
add rsp, 0xc8
ret
xorps xmm0, xmm0
lea r8, str.km.left__d__r
xor eax, eax
mov r9d, ecx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0xa0], rax
movups xmmword [rsp + 0x30], xmm0
lea edx, [rax + 0x78]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
call fcn.14000d500
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14000dac1
mov rcx, qword [0x140035060]
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14000e290
add rsp, 0xc8
ret

Function at 0x14000db10
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140033040]
xor rax, rsp
mov qword [rsp + 0x48], rax
inc dword [0x1400350d8]
mov dword [0x1400350dc], ecx
call fcn.140015828
movups xmm0, xmmword [0x140035118]
mov rcx, qword [0x140035068]
xor r9d, r9d
movups xmm1, xmmword [0x140035128]
lea rdx, [0x1400350d0]
mov dword [0x1400350d4], eax
movaps xmmword [0x1400350e0], xmm0
lea rax, [0x140035070]
movups xmm0, xmmword [0x140035138]
lea r8d, [r9 + 0x48]
mov dword [rsp + 0x28], socket
movaps xmmword [0x1400350f0], xmm1
movsd xmm1, qword [0x140035148]
movaps xmmword [0x140035100], xmm0
movsd qword [0x140035110], xmm1
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
mov rcx, qword [0x140035068]
lea rdx, [0x140035080]
xor eax, eax
mov dword [rsp + 0x30], socket
mov qword [0x14003511c], rax
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8d, 0x400
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x38], xmm0
call qword [sym.imp.WS2_32.dll_recvfrom]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000e290
add rsp, 0x58
ret
Function at 0x14000ed54
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000ed9e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ed9e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ed9e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ed9e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ed9e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000eda0
xor al, al
add rsp, 0x28
ret

Function at 0x140016d88
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140016b84
Function at 0x14001c510
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14001c540
xor eax, eax
jmp 0x14001c603
mov rbp, rbx
cmp word [rax], si
je 0x14001c565
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14001c54c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14001c548
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14001c430
movsxd r14, eax
test eax, eax
jne 0x14001c5a3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14001c539
mov rcx, r14
call fcn.14001885c
mov rdi, rax
test rax, rax
jne 0x14001c5bc
xor ecx, ecx
call fcn.140017be4
jmp 0x14001c598
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14001c430
test eax, eax
jne 0x14001c5ed
mov rcx, rdi
call fcn.140017be4
jmp 0x14001c5f7
xor ecx, ecx
call fcn.140017be4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14002092c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140020942
mov al, 1
jmp 0x1400209a2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140020953
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400209a0
mov ecx, dword [rcx + 0x18]
nop
call fcn.14001ce30
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400209a0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400209a0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400209a0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400209a2
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140021624
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14001586c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400216ae
cmp byte [rbp - 0x21], r15b
je 0x1400216a9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400216e4
call fcn.140017e34
test eax, eax
jne 0x1400216d0
cmp byte [rbp - 0x21], r15b
je 0x1400216c8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400216e4
cmp byte [rbp - 0x21], r15b
je 0x1400216e1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14001ab7c
test eax, eax
jne 0x140021784
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14001586c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140021723
cmp byte [rbp - 0x21], r15b
je 0x140021758
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140021758
call fcn.140017e34
test eax, eax
jne 0x140021744
cmp byte [rbp - 0x21], r15b
je 0x14002173d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140021758
cmp byte [rbp - 0x21], r15b
je 0x140021755
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14001ab7c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140021784
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140021787
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140021795
mov rcx, rdi
call fcn.140017be4
cmp byte [rbp + 0x3f], r15b
je 0x1400217a4
mov rcx, qword [rbp + 0x27]
call fcn.140017be4
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140023db0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140023dd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140023dd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1800023b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x40
add r8d, 0xfffffffd
mov rbx, rdx
cmp r8d, 0x1c
ja case.0x1800023e7.11
lea rdx, [0x180000000]
movsxd rax, r8d
mov ecx, dword [rdx + rax*4 + 0x25f4]
add rcx, rdx
jmp rcx
mov dword [rbp + 0x10], 0x7a634c43
lea rdx, [rbp + 0x11]
mov word [rbp + 0x14], 0x4120
mov byte [rbp + 0x16], 0
jmp 0x1800025dd
mov dword [rbp + 0x10], 0x7a634c56
lea rdx, [rbp + 0x11]
mov word [rbp + 0x14], 0x4220
mov byte [rbp + 0x16], 0
jmp 0x1800025dd
mov dword [rbp + 0x10], 0x6d72417e
lea rdx, [rbp + 0x11]
mov dword [rbp + 0x14], 0x79726f
jmp 0x1800025dd
mov dword [rbp - 0x18], 0x36303130
mov dword [rbp - 0x14], 0x6f6f5220
mov word [rbp - 0x10], 0x6d
jmp 0x1800025d9
mov dword [rbp - 0x18], 0x34313924
mov dword [rbp - 0x14], 0x6f6f5220
mov word [rbp - 0x10], 0x6d
jmp 0x1800025d9
movdqa xmm0, xmmword [0x180059420]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 8], 0
jmp 0x1800025d9
mov dword [rbp - 0x18], 0x696f5468
mov dword [rbp - 0x14], 0x7374656c
jmp 0x1800025d5
mov dword [rbp + 0x10], 0x7a634c6b
lea rdx, [rbp + 0x11]
mov word [rbp + 0x14], 0x4120
mov byte [rbp + 0x16], 0
jmp 0x1800025dd
mov dword [rbp + 0x10], 0x7a634c1b
lea rdx, [rbp + 0x11]
mov word [rbp + 0x14], 0x4220
mov byte [rbp + 0x16], 0
jmp 0x1800025dd
mov dword [rbp - 0x18], 0x706c414a
mov dword [rbp - 0x14], 0x57206168
mov dword [rbp - 0x10], 0x65687261
mov word [rbp - 0xc], 0x6461
mov byte [rbp - 0xa], 0
jmp 0x1800025d9
mov dword [rbp + 0x10], 0x39373042
lea rdx, [rbp + 0x11]
mov byte [rbp + 0x14], 0
jmp 0x1800025dd
mov dword [rbp - 0x18], 0x63694d2b
mov dword [rbp - 0x14], 0x48206f72
mov word [rbp - 0x10], 0x4449
mov byte [rbp - 0xe], 0
jmp 0x1800025d9
mov dword [rbp - 0x18], 0x7a634c4b
mov dword [rbp - 0x14], 0x6d724120
mov dword [rbp - 0x10], 0x79726f
jmp 0x1800025d9
mov dword [rbp + 0x10], 0x7365541b
lea rdx, [rbp + 0x11]
mov word [rbp + 0x14], 0x616c
mov byte [rbp + 0x16], 0
jmp 0x1800025dd
mov dword [rbp + 0x20], 0x545004
lea rdx, [rbp + 0x21]
jmp 0x1800025dd
mov dword [rbp - 0x18], 0x616c470b
mov dword [rbp - 0x14], 0x52207373
mov dword [rbp - 0x10], 0x6d6f6f
jmp 0x1800025d9
mov dword [rbp + 0x10], 0x74614755
lea rdx, [rbp + 0x11]
mov dword [rbp + 0x14], 0x412065
jmp 0x1800025dd
mov dword [rbp + 0x10], 0x74614735
lea rdx, [rbp + 0x11]
mov dword [rbp + 0x14], 0x422065
jmp 0x1800025dd
mov dword [rbp - 0x18], 0x746e497e
mov dword [rbp - 0x14], 0x6f637265
mov word [rbp - 0x10], 0x6d
jmp 0x1800025d9
mov dword [rbp - 0x18], 0x3033331a
mov dword [rbp - 0x14], 0x6f6f5220
mov word [rbp - 0x10], 0x6d
jmp 0x1800025d9
mov dword [rbp - 0x18], 0x6b6e555b
mov dword [rbp - 0x14], 0x6e776f6e
mov byte [rbp - 0x10], 0
lea rdx, [rbp - 0x17]
mov rcx, rbx
call fcn.180002ca0
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x1800061f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x58]
xor r15d, r15d
mov r11, qword [rsp + 0x70]
mov r13, rdx
mov rax, qword [rsp + 0x60]
mov qword [r14], r8
mov qword [r11], rax
mov rdi, qword [r14]
cmp rdi, r9
je 0x180006383
mov r12, qword [rsp + 0x68]
lea r8d, [r15 + 1]
mov rsi, qword [r11]
mov r9d, 0x3ff
mov r10d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x180006383
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rdi]
cmp r8w, dx
jae 0x180006289
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x1800063a7
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x18000629f
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x18000629f
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x1800062b2
movzx r9d, al
mov r10d, r15d
mov ebx, r15d
jmp 0x1800062fd
mov r9d, eax
cmp eax, 0x800
jae 0x1800062cc
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x1800062fd
cmp eax, 0x10000
jae 0x1800062e6
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov ebx, r10d
jmp 0x1800062fd
shr r9d, 0x12
mov r10d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdx, r12
sub rdx, rsi
mov ecx, r8d
cmp rdx, rcx
jl 0x180006383
lea rcx, [rdi + 2]
mov qword [r14], rcx
test bpl, bpl
jne 0x180006321
cmp r10d, 3
jae 0x18000632d
mov rcx, qword [r11]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jle 0x18000635e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax + rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jg 0x180006340
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rdi, qword [r14]
cmp rdi, qword [rsp + 0x50]
jne 0x18000623e
mov rax, qword [rsp + 0x48]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, 2
jmp 0x180006392
Function at 0x180006ef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movzx eax, word [rcx + 0x3c]
xor r10d, r10d
mov r11, rdx
mov rdi, rcx
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov ebx, dword [r8 + 0x20]
mov ebp, dword [r8 + 0x1c]
add rbx, rcx
mov r14d, dword [r8 + 0x24]
add rbp, rcx
mov esi, dword [r8 + 0x18]
add r14, rcx
test esi, esi
je 0x180006f8c
nop dword [rax + rax]
mov eax, dword [rbx]
add rax, rdi
je 0x180006f7b
test r11, r11
je 0x180006f80
movsx edx, byte [r11]
movsx r8d, byte [rax]
sub r8d, edx
jne 0x180006f76
mov r9, r11
sub r9, rax
nop
test dl, dl
je 0x180006f76
movsx edx, byte [r9 + rax + 1]
inc rax
movsx r8d, byte [rax]
sub r8d, edx
je 0x180006f60
test r8d, r8d
jmp 0x180006f7e
test r11, r11
je 0x180006fa5
inc r10d
add rbx, 4
cmp r10d, esi
jb 0x180006f40
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
movsxd rax, r10d
movzx ecx, word [r14 + rax*2]
mov eax, dword [rbp + rcx*4]
add rax, rdi
jmp 0x180006f8e

Function at 0x180006fc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
movzx eax, word [rcx + 0x3c]
xor r10d, r10d
mov rbx, rcx
mov edx, dword [rax + rcx + 0x88]
add rdx, rcx
mov r11d, dword [rdx + 0x20]
mov esi, dword [rdx + 0x1c]
add r11, rcx
mov ebp, dword [rdx + 0x24]
add rsi, rcx
mov edi, dword [rdx + 0x18]
add rbp, rcx
test edi, edi
je 0x180007046
mov eax, dword [r11]
add rax, rbx
je 0x18000703a
movsx edx, byte [rax]
sub edx, 0x69
jne 0x180007036
lea r9, str.il2cpp_string_new_len
mov r8b, 0x69
sub r9, rax
nop
test r8b, r8b
je 0x180007036
movsx r8d, byte [r9 + rax + 1]
inc rax
movsx edx, byte [rax]
sub edx, r8d
je 0x180007020
test edx, edx
je 0x18000705d
inc r10d
add r11, 4
cmp r10d, edi
jb 0x180007002
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movsxd rax, r10d
movzx ecx, word [rbp + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, rbx
jmp 0x180007048
Function at 0x180007070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
movzx eax, word [rcx + 0x3c]
xor r10d, r10d
mov rbx, rcx
mov edx, dword [rax + rcx + 0x88]
add rdx, rcx
mov r11d, dword [rdx + 0x20]
mov esi, dword [rdx + 0x1c]
add r11, rcx
mov ebp, dword [rdx + 0x24]
add rsi, rcx
mov edi, dword [rdx + 0x18]
add rbp, rcx
test edi, edi
je 0x1800070f6
mov eax, dword [r11]
add rax, rbx
je 0x1800070ea
movsx edx, byte [rax]
sub edx, 0x69
jne 0x1800070e6
lea r9, str.il2cpp_thread_attach
mov r8b, 0x69
sub r9, rax
nop
test r8b, r8b
je 0x1800070e6
movsx r8d, byte [r9 + rax + 1]
inc rax
movsx edx, byte [rax]
sub edx, r8d
je 0x1800070d0
test edx, edx
je 0x18000710d
inc r10d
add r11, 4
cmp r10d, edi
jb 0x1800070b2
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movsxd rax, r10d
movzx ecx, word [rbp + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, rbx
jmp 0x1800070f8

Function at 0x180007120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
movzx eax, word [rcx + 0x3c]
xor r10d, r10d
mov rbx, rcx
mov edx, dword [rax + rcx + 0x88]
add rdx, rcx
mov r11d, dword [rdx + 0x20]
mov esi, dword [rdx + 0x1c]
add r11, rcx
mov ebp, dword [rdx + 0x24]
add rsi, rcx
mov edi, dword [rdx + 0x18]
add rbp, rcx
test edi, edi
je 0x1800071a6
mov eax, dword [r11]
add rax, rbx
je 0x18000719a
movsx edx, byte [rax]
sub edx, 0x69
jne 0x180007196
lea r9, str.il2cpp_type_get_object
mov r8b, 0x69
sub r9, rax
nop
test r8b, r8b
je 0x180007196
movsx r8d, byte [r9 + rax + 1]
inc rax
movsx edx, byte [rax]
sub edx, r8d
je 0x180007180
test edx, edx
je 0x1800071bd
inc r10d
add r11, 4
cmp r10d, edi
jb 0x180007162
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movsxd rax, r10d
movzx ecx, word [rbp + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, rbx
jmp 0x1800071a8

Function at 0x180008c70
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180008ccd
lea rbx, [0x180051540]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180008cb4
cmp r10, 2
jb 0x180008cb4
cmp byte [r9], r8b
jne 0x180008cb4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180008c90
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180008d0f
lea rbx, [0x180051540]
cmp r8b, 0x23
jne 0x180008cf3
cmp byte [r9], r8b
jne 0x180008cf3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180008ce0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x180008f80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x180008faf
mov r8d, 0x599
lea rdx, str.C:UsersXprtDownloadsCyrix_CheatsCyrix_SCP_SL_Private__ChasePlaysImGui_DirectX_11_Kiero_Hookimguiimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x180008fbb
mov qword [rdi], 0
lea rdx, [0x180051200]
mov rcx, rbx
call fcn.180008d20
mov rbx, rax
test rax, rax
jne 0x180008fdd
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1800090b4
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800090b4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1800090b4
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800090b4
cmp rsi, 0xffffffffffffffff
je 0x1800090b4
mov rax, qword [0x180062dc8]
test rax, rax
je 0x180009051
inc dword [rax + 0x3bc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x1800090b4
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x1800090a1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x180062dc8]
test rax, rax
je 0x180009096
dec dword [rax + 0x3bc]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800090bd
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x1800090af
mov qword [rdi], rsi
mov rax, rbp
jmp 0x1800090bf
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18000aff0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xc0], 0
mov rbx, rcx
mov edi, edx
jg 0x18000b026
mov r8d, 0x502
lea rdx, str.C:UsersXprtDownloadsCyrix_CheatsCyrix_SCP_SL_Private__ChasePlaysImGui_DirectX_11_Kiero_Hookimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd r8, dword [rbx + 0xc0]
mov rax, qword [rbx + 0xc8]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x180051540]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x180062dc8]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1a60], edx
jne 0x18000b0a0
mov dword [rax + 0x1a64], edx
cmp dword [rax + 0x1a9c], edx
jne 0x18000b0af
mov byte [rax + 0x1aa0], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x18000dd60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
cmp byte [rcx], 0
mov rbx, rcx
jne 0x18000dd7b
cmp byte [rcx + 0x2ef4], 0
je 0x18000dd95
mov r8d, 0xed0
lea rdx, str.C:UsersXprtDownloadsCyrix_CheatsCyrix_SCP_SL_Private__ChasePlaysImGui_DirectX_11_Kiero_Hookimguiimgui.cpp
lea rcx, str._g.Initialized___g.SettingsLoaded
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
lea r8, [0x18004f959]
mov dword [rsp + 0x2c], eax
lea r11, [0x180051540]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, str.Window
mov edx, r10d
mov qword [rsp + 0x20], rax
mov r9b, 0x57
cmp r9b, 0x23
jne 0x18000ddd9
cmp byte [r8], r9b
jne 0x18000ddd9
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x18000ddc6
mov ecx, dword [rbx + 0x2f14]
lea rax, [0x18001a900]
mov edi, dword [rbx + 0x2f10]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x18001a9b0]
mov qword [rsp + 0x38], rax
lea rax, [0x18001aa90]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x18000dedb
inc edi
test ecx, ecx
je 0x18000de45
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x18000de4a
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x18000dedb
mov rax, qword [0x180062dc8]
mov qword [rsp + 0x60], rsi
test rax, rax
je 0x18000de6e
inc dword [rax + 0x3bc]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, qword [rbx + 0x2f18]
mov rsi, rax
test rdx, rdx
je 0x18000dec9
movsxd rcx, dword [rbx + 0x2f10]
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0x2f18]
test rcx, rcx
je 0x18000dec3
mov rax, qword [0x180062dc8]
test rax, rax
je 0x18000dec3
dec dword [rax + 0x3bc]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2f18], rsi
mov rsi, qword [rsp + 0x60]
mov dword [rbx + 0x2f14], edi
movsxd rax, dword [rbx + 0x2f10]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2f18]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2f10]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret