joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004cdf8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rsi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x18004ce28
cvtsi2ss xmm0, rdx
jmp 0x18004ce3d
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.msvcrt.dll_ceilf
movss xmm1, dword [0x1800d8fec]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18004ce6b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18004ce6b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18004ce99
cmp rbx, 0x200
jae 0x18004ce96
shl rbx, 3
cmp rbx, rcx
jae 0x18004ce99
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
ja 0x18004d007
lea rax, [rbx - 1]
mov edi, 1
mov rbx, qword [rsi + 8]
or rax, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18000da00
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18004cfcb
mov rcx, qword [rcx]
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx edx, byte [r9 + rax + 0x10]
movabs r10, 0x100000001b3
xor r8, rdx
inc r9
imul r8, r10
cmp r9, 8
jb 0x18004cf11
mov r11, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x18]
and r11, r8
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x18004cf50
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x18004cfbf
mov r10, qword [rdi + r11*8 + 8]
mov rdx, qword [rax + 0x10]
cmp rdx, qword [r10 + 0x10]
jne 0x18004cf94
mov r10, qword [r10]
cmp r10, rax
je 0x18004cf49
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18004cf49
mov r10, qword [r10 + 8]
cmp rdx, qword [r10 + 0x10]
je 0x18004cfe1
cmp qword [rdi + r11*8], r10
jne 0x18004cf8a
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18004cf01
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18004cfbf
lea rcx, [0x1800ce0b0]
call fcn.1800924fc
int3

Function at 0x18004d310
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.9.virtual_32

Function at 0x18004d4b4
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.7.virtual_16
Function at 0x18004d514
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004d52c
Capabilities:
Delete file

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004d550
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x50
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004d568
Capabilities:
Delete file

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004d5d4
Capabilities:
Write file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004d5f8
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004d61c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004d640
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x40
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004d67c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.9.virtual_32

Function at 0x18004d70c
Capabilities:
Read file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.9.virtual_24

Function at 0x18004d820
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004d85c
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x38
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004d874
Capabilities:
Delete file

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004d88c
Capabilities:
Delete file

Disassembly:
sub rcx, 0x38
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004d8c8
Capabilities:
Write file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004d904
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004d928
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004d94c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004d970
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x48
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004da0c
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.9.virtual_24

Function at 0x18004db5c
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004db98
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x40
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004dbb0
Capabilities:
Delete file

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004dbd4
Capabilities:
Delete file

Disassembly:
sub rcx, 0x40
jmp method.IMySteamRemoteStorage.6.virtual_24
Function at 0x18004dc1c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004dc58
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004dc7c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004dcb8
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x50
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004de5c
Capabilities:
Read file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004debc
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004dec8
Capabilities:
Delete file

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004deec
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x48
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004df04
Capabilities:
Delete file

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004df34
Capabilities:
Delete file

Disassembly:
sub rcx, 0x48
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004df94
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004dfb8
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004dfdc
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x38
jmp method.IMySteamRemoteStorage.7.virtual_0
Function at 0x18005253c
Capabilities:
Check if file exists
Create directory

Disassembly:
push rbx
sub rsp, 0x240
lea rdx, [rsp + 0x130]
sub rdx, rcx
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x180052550
mov edx, 0x5c
lea rcx, [rsp + 0x130]
call qword [sym.imp.msvcrt.dll_strrchr]
mov edx, 0x2f
lea rcx, [rsp + 0x130]
mov rbx, rax
call qword [sym.imp.msvcrt.dll_strrchr]
cmp rax, rbx
cmova rbx, rax
test rbx, rbx
je 0x180052622
lea rdx, [0x1800cc018]
mov byte [rbx + 1], 0
lea rcx, [rsp + 0x130]
call qword [sym.imp.msvcrt.dll_strtok]
mov byte [rsp + 0x20], 0
jmp 0x18005261a
lea rcx, [rsp + 0x20]
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x1800525bd
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x1800525c7
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1800525f1
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [rsp + 0x20]
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x1800525f9
movzx eax, word [0x1800cc01c]
lea rdx, [0x1800cc014]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_strtok]
mov r8, rax
test rax, rax
jne 0x1800525b5
add rsp, 0x240
pop rbx
ret
Function at 0x180054b18
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_0

Function at 0x180054e78
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x18
jmp method.IMySteamApps.2.virtual_56

Function at 0x180054fb0
Capabilities:
Get common file path

Disassembly:
sub rcx, 0x10
jmp method.IMySteamApps.3.virtual_144

Function at 0x18005501c
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_16

Function at 0x180055190
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_8

Function at 0x1800553dc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_0

Function at 0x1800556c4
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x20
jmp method.IMySteamApps.2.virtual_56

Function at 0x1800557cc
Capabilities:
Get common file path

Disassembly:
sub rcx, 0x18
jmp method.IMySteamApps.3.virtual_144

Function at 0x180055964
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_8

Function at 0x180055c1c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.3.virtual_192

Function at 0x180055cdc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.3.virtual_184

Function at 0x180055d84
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamApps.2.virtual_56

Function at 0x180055e74
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x28
jmp method.IMySteamApps.2.virtual_56

Function at 0x180055eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.virtual_0

Function at 0x1800563cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.virtual_32

Function at 0x1800564f8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamApps.2.virtual_56

Function at 0x180056618
Capabilities:
Get common file path

Disassembly:
sub rcx, 8
jmp method.IMySteamApps.3.virtual_144

Function at 0x18005666c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_16
Function at 0x18005960c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, rdx
mov rsi, rcx
mov ecx, 0x20
call fcn.180093f5c
mov r8, qword [rbx]
mov qword [rax], r8
mov r8, qword [0x1801b6238]
mov qword [rax + 8], r8
movups xmm0, xmmword [rdi]
movdqu xmmword [rax + 0x10], xmm0
mov qword [rsp + 0x50], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1800596b8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x18005968e
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call fcn.180092950
int3
Function at 0x18005a65c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov r14, rdx
mov rdi, rcx
call fcn.18005c9d0
nop
lea rsi, [rdi + 0xc0]
mov rcx, rsi
call fcn.18007ef88
nop
lea rax, vtable.GlRender.0
mov qword [rdi], rax
lea rax, vtable.GlRender.1.0
mov qword [rsi], rax
lea rbx, [rdi + 0x168]
mov qword [rbp + 0x48], rbx
and dword [rbp + 0x40], 0
mov eax, dword [rbp + 0x40]
mov dword [rbx], eax
and qword [rbx + 8], 0
and qword [rbx + 0x10], 0
mov ecx, 0x60
call fcn.180093f5c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x18]
and qword [rcx], 0
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
mov qword [rbx + 0x30], 7
mov qword [rbx + 0x38], 8
mov dword [rbx], 0x3f800000
mov r8, qword [rbx + 8]
mov edx, 0x10
call fcn.18000da00
nop
mov byte [rbp - 0x18], 0x7b
mov byte [rbp - 0x17], 0x6b
mov byte [rbp - 0x16], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x15], 0x57
mov byte [rbp - 0x14], 0x7b
mov byte [rbp - 0x13], 0x65
mov byte [rbp - 0x12], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x11], 0x46
mov byte [rbp - 0x10], 0x79
mov byte [rbp - 0xf], 0x6a
mov byte [rbp - 0xe], 0x6a
mov byte [rbp - 0xd], 0x69
mov byte [rbp - 0xc], 0x76
mov byte [rbp - 0xb], 0x77
mov byte [rbp - 0xa], 0
mov al, byte [rbp - 0x18]
xor edx, edx
mov al, byte [rbp + rdx - 0x18]
sub al, 4
mov byte [rbp + rdx - 0x18], al
inc rdx
cmp rdx, 0xe
jb 0x18005a749
lea rdx, [rbp - 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18005a796
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005a520]
mov rdx, rax
mov rcx, rsi
call fcn.18007a8d8
mov qword [0x1801b6248], rdi
mov byte [rdi + 8], 1
mov rax, rdi
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18005bf78
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rdx, qword [0x1801b5a50]
mov rdi, rcx
mov r8d, dword [rdx + 0xe8]
sub r8d, 1
je 0x18005c129
cmp r8d, 1
jne 0x18005c147
mov byte [rbp - 0x30], 0x51
xor ebx, ebx
mov byte [rbp - 0x2f], 0x76
mov ecx, ebx
mov byte [rbp - 0x2e], 0x80
mov byte [rbp - 0x2d], 0x7d
mov byte [rbp - 0x2c], WSASetLastError
mov byte [rbp - 0x2b], 0x81
mov byte [rbp - 0x2a], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x29], 0x75
mov byte [rbp - 0x28], 0x5a
mov byte [rbp - 0x27], WSACleanup
mov byte [rbp - 0x26], 0x80
mov byte [rbp - 0x25], 0x80
mov byte [rbp - 0x24], WSASetLastError
mov byte [rbp - 0x23], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x22], WSACleanup
mov byte [rbp - 0x21], 0x4e
mov byte [rbp - 0x20], bl
mov al, byte [rbp - 0x30]
mov al, byte [rbp + rcx - 0x30]
sub al, 0xd
mov byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x10
jb 0x18005bff9
mov byte [rbp + 0x18], 0x59
mov rcx, rbx
mov byte [rbp + 0x19], 0x77
mov byte [rbp + 0x1a], 0x69
mov byte [rbp + 0x1b], 0x76
mov byte [rbp + 0x1c], 0x37
mov byte [rbp + 0x1d], 0x36
mov byte [rbp + 0x1e], bl
mov al, byte [rbp + 0x18]
mov al, byte [rbp + rcx + 0x18]
sub al, 4
mov byte [rbp + rcx + 0x18], al
inc rcx
cmp rcx, 6
jb 0x18005c02d
lea r8, [rbp - 0x30]
mov rcx, rdi
lea rdx, [rbp + 0x18]
call fcn.18007f804
mov rdx, rax
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005bb34]
mov rcx, rdi
call fcn.18007a8d8
mov byte [rbp - 0x1f], 0x51
mov rcx, rbx
mov byte [rbp - 0x1e], 0x76
mov byte [rbp - 0x1d], 0x80
mov byte [rbp - 0x1c], 0x7d
mov byte [rbp - 0x1b], WSASetLastError
mov byte [rbp - 0x1a], 0x81
mov byte [rbp - 0x19], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x18], 0x75
mov byte [rbp - 0x17], 0x5a
mov byte [rbp - 0x16], WSACleanup
mov byte [rbp - 0x15], 0x80
mov byte [rbp - 0x14], 0x80
mov byte [rbp - 0x13], WSASetLastError
mov byte [rbp - 0x12], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x11], WSACleanup
mov byte [rbp - 0x10], 0x64
mov byte [rbp - 0xf], bl
mov al, byte [rbp - 0x1f]
mov al, byte [rbp + rcx - 0x1f]
sub al, 0xd
mov byte [rbp + rcx - 0x1f], al
inc rcx
cmp rcx, 0x10
jb 0x18005c0b6
mov byte [rbp + 0x20], 0x5e
mov byte [rbp + 0x21], 0x7c
mov byte [rbp + 0x22], WSASetLastError
mov byte [rbp + 0x23], 0x7b
mov byte [rbp + 0x24], 0x3c
mov byte [rbp + 0x25], 0x3b
mov byte [rbp + 0x26], bl
mov al, byte [rbp + 0x20]
mov al, byte [rbp + rbx + 0x20]
sub al, 9
mov byte [rbp + rbx + 0x20], al
inc rbx
cmp rbx, 6
jb 0x18005c0e7
lea r8, [rbp - 0x1f]
mov rcx, rdi
lea rdx, [rbp + 0x20]
call fcn.18007f804
mov rdx, rax
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005bb34]
mov rcx, rdi
call fcn.18007a8d8
jmp 0x18005c147
xor r9d, r9d
lea rdx, [0x18005b6cc]
xor r8d, r8d
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x1801b67a8], rax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180061774
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
cmp byte [rcx + 9], 0
mov r15, r8
mov rdi, rcx
jne 0x18006192f
cmp qword [rcx + 0x178], 0
je 0x18006192f
and qword [rbp + 0x30], 0
lea r8, [rbp + 0x30]
call fcn.1800622f4
and qword [rbp - 0x38], 0
xor eax, eax
mov dword [rbp - 0x44], eax
mov qword [rbp + 0x48], rax
mov dword [rbp - 0x28], eax
mov qword [rbp - 0x18], rax
mov rax, qword [rdi + 0x170]
mov qword [rbp - 0x60], rax
mov rax, qword [rdi + 0x180]
mov qword [rbp - 0x58], rax
mov rax, qword [rdi + 0x178]
mov qword [rbp - 0x50], rax
mov eax, dword [rdi + 0x190]
mov dword [rbp - 0x48], eax
mov rax, qword [rdi + 0x188]
mov qword [rbp - 0x30], rax
mov eax, 2
mov dword [rbp - 0x24], eax
mov dword [rbp - 0x20], eax
lea rax, [sym.steam_api64.dll_SteamAPI_ISteamApps_RequestPublisherOwnedAppData]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x30]
and qword [rbp + 0x30], 0
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x1c], 1
lea rdx, [rbp + 0x30]
lea rcx, [0x18005e82c]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbp + 0x30]
test rax, rax
je 0x18006182a
mov qword [rdi + 0x168], rax
call fcn.180021994
mov rcx, qword [rdi + 0x168]
call fcn.18001eb98
mov rsi, qword [0x1801b5c60]
mov r14, qword [rdi + 0x1b0]
test rsi, rsi
je 0x180061875
inc dword [rsi + 0xf4]
mov ecx, 0xe8
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rbp + 0x30], rax
mov rbx, rax
test rax, rax
je 0x1800618a6
xor edx, edx
mov r8d, 0xe8
mov rcx, rax
call fcn.180095d60
mov qword [rbx + 0x60], 0x100
jmp 0x1800618a8
xor ebx, ebx
or dword [rsi + 0xc], 8
lea rax, str.imgui_impl_vulkan
movaps xmm0, xmmword [rbp - 0x60]
movaps xmm1, xmmword [rbp - 0x50]
mov qword [rsi + 0x90], rax
mov rax, qword [rbp + 0x48]
mov qword [rsi + 0xa0], rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x58], r14
movaps xmm0, xmmword [rbp - 0x40]
movups xmmword [rbx + 0x10], xmm1
mov dword [rbx + 0x88], eax
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rbx + 0x20], xmm0
movaps xmm0, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x30], xmm1
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx + 0x40], xmm0
movsd qword [rbx + 0x50], xmm1
call fcn.18001dea0
mov rcx, rdi
call fcn.18005d11c
mov rax, qword [r15 + 0x30]
mov ecx, dword [rax]
lea rax, [rcx + rcx*2]
mov rcx, qword [rdi + 0x1b8]
add rax, rax
mov rcx, qword [rcx + rax*8 + 8]
call fcn.18001d5b0
mov byte [rdi + 9], 1
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180063c1c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [0x1801b5c68]
mov rbx, rcx
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9d, dword [rbx + 0xc]
movabs rdx, 0xcbf29ce484222325
mov dword [rsp + 0x40], r9d
xor r8d, r8d
movzx eax, byte [rsp + r8 + 0x40]
movabs rcx, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, rcx
cmp r8, 4
jb 0x180063c5b
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x20]
and rax, rdx
add rax, rax
mov rdi, qword [rcx + rax*8 + 8]
cmp rdi, qword [rbp + 0x10]
je 0x180063cab
mov rcx, qword [rcx + rax*8]
jmp 0x180063ca3
cmp rdi, rcx
je 0x180063cab
mov rdi, qword [rdi + 8]
cmp r9d, dword [rdi + 0x10]
jne 0x180063c9a
jmp 0x180063cad
xor edi, edi
test rdi, rdi
je 0x180063d37
cmp rdi, qword [rbp + 0x10]
je 0x180063d37
mov rdx, qword [rdi + 0x20]
mov rsi, qword [rdi + 0x18]
jmp 0x180063ccf
cmp qword [rsi], rbx
je 0x180063cd4
add rsi, 8
cmp rsi, rdx
jne 0x180063cc6
cmp rsi, rdx
je 0x180063d16
lea rax, [rsi + 8]
jmp 0x180063cf2
mov rcx, qword [rax]
cmp rcx, rbx
je 0x180063cee
mov qword [rsi], rcx
add rsi, 8
add rax, 8
cmp rax, rdx
jne 0x180063cdf
cmp rsi, rdx
je 0x180063d16
mov rbx, qword [rdi + 0x20]
mov rcx, rsi
sub rbx, rdx
mov r8, rbx
call sub.msvcrt.dll_memmove
lea rax, [rbx + rsi]
mov qword [rdi + 0x20], rax
mov rax, qword [rdi + 0x20]
sub rax, qword [rdi + 0x18]
test rax, 0xfffffffffffffff8
jne 0x180063d37
lea rcx, [rbp + 8]
mov r8, rdi
lea rdx, [rsp + 0x40]
call fcn.18004311c
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x18006b2bc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x30]
mov byte [rax], 0
jmp fcn.180042ca4
Function at 0x18006d05c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, rdx
mov r14, rcx
xor edi, edi
xor ebx, ebx
xor esi, esi
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
jne 0x18006d0fd
cmp esi, edi
jne 0x18006d0b1
lea r15d, [rdi + 0x3e8]
mov edx, edi
mov r8d, r15d
mov rcx, rbx
call fcn.18006b564
test rax, rax
je 0x18006d139
mov rbx, rax
mov edi, r15d
call qword [sym.imp.msvcrt.dll__errno]
movsxd rcx, esi
mov r9, r14
add rcx, rbx
mov edx, 1
and dword [rax], 0
mov eax, edi
sub eax, esi
movsxd r8, eax
call qword [sym.imp.msvcrt.dll_fread]
mov rcx, r14
mov r15, rax
call qword [sym.imp.msvcrt.dll_ferror]
test eax, eax
jne 0x18006d142
mov rcx, r14
add esi, r15d
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
je 0x18006d08a
cmp esi, edi
jne 0x18006d180
lea r8d, [rdi + 1]
mov edx, edi
mov rcx, rbx
call fcn.18006b564
test rax, rax
jne 0x18006d17d
lea r8, [0x1801b1848]
mov edx, 0xc8
mov rcx, rbp
call fcn.180043f7c
test rbx, rbx
je 0x18006d135
mov rax, qword [fcn.180098448]
mov rcx, rbx
call rax
xor eax, eax
jmp 0x18006d1a9
lea r8, [0x1801b1870]
jmp 0x18006d117
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0
je 0x18006d15d
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.msvcrt.dll_strerror]
jmp 0x18006d164
lea rax, str.Error_reading_file
mov r9, rax
lea r8, [0x1801b1654]
mov edx, 0xc8
mov rcx, rbp
call fcn.180043f7c
jmp 0x18006d124
mov rbx, rax
movsxd rax, esi
mov rdx, rbp
mov rcx, rbx
mov byte [rax + rbx], 0
call fcn.18006c93c
mov rdi, rax
test rbx, rbx
je 0x18006d1a6
mov rdx, qword [fcn.180098448]
mov rcx, rbx
call rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret