joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008e0b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14008e20a
mov dword [rbp - 0x30], 0x2d2d4352
mov dword [rbp - 0x2c], 0xf7babac9
mov dword [rbp - 0x28], 0x61726f43
mov dword [rbp - 0x24], 0x776f7242
mov dword [rbp - 0x20], 0x2d756e45
mov dword [rbp - 0x1c], 0x61746144
mov dword [rbp - 0x18], 0x37313630
mov dword [rbp - 0x14], 0x30313032
mov eax, 1
movd xmm2, eax
movdqu xmm1, xmmword [rbp - 0x30]
pslld xmm1, xmm2
xorps xmm0, xmm0
paddd xmm0, xmmword [0x140132040]
paddd xmm0, xmm1
movdqu xmmword [rbp - 0x30], xmm0
movdqu xmm1, xmmword [rbp - 0x20]
pslld xmm1, xmm2
movdqa xmm0, xmmword [0x140132050]
paddd xmm0, xmmword [0x140132040]
paddd xmm0, xmm1
movdqu xmmword [rbp - 0x20], xmm0
mov rax, qword [rdx]
mov qword [rdx + 8], rax
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rax
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, rdx
test rdx, rdx
je 0x14008e1e9
lea r9, [rbp - 0x48]
mov r8d, eax
lea rcx, [rbp - 0x30]
call fcn.140086840
test al, al
je 0x14008e1e9
mov rbx, qword [rbp - 0x48]
cmp rbx, qword [rbp - 0x40]
je 0x14008e1ed
mov rdx, rdi
mov ecx, 0xa
call fcn.1400a2fa0
mov ecx, dword [rbp - 0x40]
sub ecx, ebx
mov rdx, rdi
call fcn.1400a2fa0
mov r9, qword [rbp - 0x40]
mov r8, rbx
mov rdx, qword [rdi + 8]
mov rcx, rdi
call fcn.140076580
jmp 0x14008e1ed
mov rbx, qword [rbp - 0x48]
test rbx, rbx
je 0x14008e20a
mov rcx, rbx
call fcn.1400bd20c
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], 0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bcae0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14008e230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
sub rsp, 0x58
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rcx]
mov r10, rcx
mov rcx, qword [rcx + 8]
mov rsi, r8
mov rbx, rdx
cmp rax, rcx
je 0x14008e44a
mov rdx, qword [rdx]
sub rcx, rax
cmp rdx, rcx
jae 0x14008e44a
lea rax, [rdx + 5]
cmp rax, rcx
ja 0x14008e44a
lea r8, [rdx + 1]
mov qword [rbx], r8
mov rax, qword [r10]
cmp byte [rdx + rax], 2
jne 0x14008e44a
lea rcx, [r8 + 1]
mov qword [rbx], rcx
mov rax, qword [r10]
movzx r9d, byte [rax + r8]
lea rdx, [rcx + 1]
mov qword [rbx], rdx
mov rax, qword [r10]
shl r9d, 0x18
movzx ecx, byte [rax + rcx]
lea r8, [rdx + 1]
mov qword [rbx], r8
mov rax, qword [r10]
shl ecx, 0x10
or r9d, ecx
movzx ecx, byte [rax + rdx]
lea rdx, [r8 + 1]
mov qword [rbx], rdx
mov r11, qword [r10]
shl ecx, 8
movzx eax, byte [r11 + r8]
or r9d, ecx
or r9d, eax
cmp r9d, 0xa
jne 0x14008e44a
mov rcx, qword [r10 + 8]
lea rax, [rdx + 5]
sub rcx, r11
cmp rax, rcx
ja 0x14008e44a
lea r8, [rdx + 1]
mov qword [rbx], r8
mov rax, qword [r10]
cmp byte [rdx + rax], 2
jne 0x14008e44a
lea rcx, [r8 + 1]
mov qword [rsp + 0x50], rdi
mov qword [rbx], rcx
mov rax, qword [r10]
lea rdx, [rcx + 1]
movzx r11d, byte [rax + r8]
mov qword [rbx], rdx
mov rax, qword [r10]
movzx ecx, byte [rax + rcx]
lea r8, [rdx + 1]
shl r11d, 0x18
mov qword [rbx], r8
mov rax, qword [r10]
shl ecx, 0x10
or r11d, ecx
movzx ecx, byte [rax + rdx]
shl ecx, 8
or r11d, ecx
lea rcx, [r8 + 1]
mov qword [rbx], rcx
mov rdx, qword [r10]
movzx eax, byte [rdx + r8]
or r11d, eax
mov rax, qword [r10 + 8]
sub rax, rcx
mov edi, r11d
sub rax, rdx
cmp rdi, rax
jbe 0x14008e38d
xor al, al
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400bcae0
add rsp, 0x58
pop rsi
pop rbx
ret
xorps xmm0, xmm0
mov eax, 1
mov dword [rsp + 0x20], 0x2d2d4352
mov dword [rsp + 0x24], 0xf7babac9
mov dword [rsp + 0x28], 0x61726f43
mov dword [rsp + 0x2c], 0x776f7242
movd xmm2, eax
paddd xmm0, xmmword [0x140132040]
movdqu xmm1, xmmword [rsp + 0x20]
mov rax, qword [rsi]
mov dword [rsp + 0x30], 0x2d756e45
mov dword [rsp + 0x34], 0x61746144
pslld xmm1, xmm2
paddd xmm0, xmm1
mov dword [rsp + 0x38], 0x37313630
mov dword [rsp + 0x3c], 0x30313032
mov qword [rsi + 8], rax
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x140132050]
paddd xmm0, xmmword [0x140132040]
movdqu xmm1, xmmword [rsp + 0x30]
mov rdx, qword [rbx]
pslld xmm1, xmm2
paddd xmm0, xmm1
movdqu xmmword [rsp + 0x30], xmm0
add rdx, qword [r10]
jne 0x14008e432
xor al, al
add qword [rbx], rdi
jmp 0x14008e374
lea rcx, [rsp + 0x20]
mov r9, rsi
mov r8d, r11d
call fcn.140086a60
add qword [rbx], rdi
jmp 0x14008e374
xor al, al
jmp 0x14008e379
Function at 0x1400a7930
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x110
mov dword [rsp + 0x20], 0x114
call fcn.1400c2130
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1400a7993
cmp dword [rsp + 0x24], 6
jb 0x1400a7993
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400bcae0
add rsp, 0x158
ret
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400bcae0
add rsp, 0x158
ret
Function at 0x1400a90c0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, r8
mov rdi, rdx
mov qword [rbp - 0x30], rdx
xor r12d, r12d
mov dword [rbp - 0x3c], r12d
lea edx, [r12 + 0x25]
xor r8d, r8d
mov rcx, rsi
call fcn.14001b000
xor r8d, r8d
mov rdx, rsi
cmp rax, 0xffffffffffffffff
jne 0x1400a9145
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r12
mov word [rdi], r12w
or r9, rax
mov rcx, rdi
call fcn.140006b90
nop
mov dword [rbp - 0x3c], 1
jmp 0x1400a92c3
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 0x10], 7
mov qword [rbp - 0x18], r12
mov word [rbp - 0x28], r12w
or rbx, 0xffffffffffffffff
mov r9, rbx
lea rcx, [rbp - 0x28]
call fcn.140006b90
nop
cmp qword [rsi + 0x18], 8
jb 0x1400a917b
mov rcx, qword [rsi]
jmp 0x1400a917e
mov rcx, rsi
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r15d, eax
test eax, eax
jne 0x1400a91b6
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r12
mov word [rdi], r12w
mov r9, rbx
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.140006b90
jmp 0x1400a929b
lea ecx, [rax + 2]
mov eax, 2
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.1400bbc88
mov r14, rax
cmp qword [rsi + 0x18], 8
jb 0x1400a91da
mov rsi, qword [rsi]
lea r8d, [r15 + 1]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1400a922a
cmp eax, r15d
ja 0x1400a922a
mov eax, eax
mov word [r14 + rax*2], r12w
cmp word [r14], 0
jne 0x1400a9210
mov rbx, r12
jmp 0x1400a921b
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x1400a9210
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 0x28]
call fcn.140006900
mov rcx, r14
call fcn.1400bd2dc
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r12
mov word [rdi], r12w
mov rbx, qword [rbp - 0x10]
cmp rbx, 8
jae 0x1400a926a
mov r8, qword [rbp - 0x18]
inc r8
je 0x1400a927e
add r8, r8
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.1400bcb10
mov rbx, qword [rbp - 0x10]
jmp 0x1400a927e
lea r8, [rbp - 0x28]
mov rdx, rdi
lea rcx, [rbp - 0x40]
call fcn.140006f90
mov qword [rbp - 0x28], r12
mov rax, qword [rbp - 0x18]
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rbx
mov qword [rbp - 0x10], 7
mov qword [rbp - 0x18], r12
mov word [rbp - 0x28], r12w
mov dword [rbp - 0x3c], 1
cmp qword [rbp - 0x10], 8
jb 0x1400a92b2
mov rcx, qword [rbp - 0x28]
call fcn.1400bd20c
mov word [rbp - 0x28], r12w
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], 7
mov rax, rdi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bcae0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400bb930
Capabilities:
Hash data with md5

Disassembly:
push rbx
mov eax, 0x20
call fcn.1400c20d0
sub rsp, rax
lea r8d, [rax + 0x3c]
xor edx, edx
mov rbx, rcx
call fcn.1400c2130
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1400c6214
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400c607c
Function at 0x180002fc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x70
cmp qword [rcx + 0xe8], 0
mov rbx, rcx
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
movaps xmmword [rsp + 0x50], xmm7
movaps xmm7, xmm2
jne 0x180003001
mov r8d, 0x62b
lea rdx, str.C:UsersPhillipDesktopCheat_DevlopmentUnrealUE_4OHDidk___21414___Copyohd_internalImGui_DirectX_11_Kiero_Hookimguiimgui.cpp
lea rcx, str.Ctx___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp byte [rbx + 0x2b81], 0
mov rbp, qword [rbx + 0xe8]
je 0x1800031d0
movss xmm1, dword [0x18009bf88]
xorps xmm2, xmm2
comiss xmm7, xmm1
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x90], r14
jbe 0x180003055
comiss xmm7, xmm2
cvttss2si eax, xmm7
jae 0x18000304e
movd xmm0, eax
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm7
jp 0x18000304c
je 0x18000304e
dec eax
movd xmm7, eax
cvtdq2ps xmm7, xmm7
comiss xmm6, xmm1
jbe 0x18000307a
comiss xmm6, xmm2
cvttss2si eax, xmm6
jae 0x180003073
movd xmm0, eax
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm6
jp 0x180003071
je 0x180003073
dec eax
movd xmm6, eax
cvtdq2ps xmm6, xmm6
lea r14, [rbp + 0x3f88]
mov qword [rsp + 0x88], rdi
mov ebx, dword [r14]
sub ebx, 1
movsxd rsi, ebx
js 0x1800030d1
imul rdi, rsi, 0x1c
cmp ebx, dword [r14]
jl 0x1800030b7
mov r8d, 0x79a
lea rdx, str.C:UsersPhillipDesktopCheat_DevlopmentUnrealUE_4OHDidk___21414___Copyohd_internalImGui_DirectX_11_Kiero_Hookimguiimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [r14 + 8]
cmp dword [rdi + rax], 1
je 0x180003167
dec ebx
sub rdi, 0x1c
sub rsi, 1
jns 0x180003098
movsd xmm0, qword [rbp + 0xf8]
lea rax, [rsp + 0x28]
movsd qword [rsp + 0x28], xmm0
movss xmm0, dword [rax]
ucomiss xmm0, xmm6
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
movss xmm1, dword [rax + 4]
jp 0x18000310f
jne 0x18000310f
ucomiss xmm1, xmm7
jp 0x18000310f
je 0x1800031c8
mov eax, dword [rbp + 0x3fac]
mov dword [rsp + 0x38], eax
inc eax
mov dword [rbp + 0x3fac], eax
mov ecx, dword [r14]
mov r8d, dword [r14 + 4]
mov eax, dword [rbp + 0x3fa8]
movss dword [rsp + 0x3c], xmm6
movss dword [rsp + 0x40], xmm7
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x44], eax
cmp ecx, r8d
jne 0x18000319d
inc ecx
test r8d, r8d
je 0x180003189
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x18000318e
movss xmm0, dword [rdi + rax + 0xc]
movss xmm1, dword [rdi + rax + 0x10]
lea rax, [rsp + 0x20]
movss dword [rsp + 0x20], xmm0
movss dword [rsp + 0x24], xmm1
jmp 0x1800030e4
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, r14
call fcn.180021b50
movsxd rax, dword [r14]
movups xmm0, xmmword [rsp + 0x30]
movsd xmm1, qword [rsp + 0x40]
imul rcx, rax, 0x1c
mov rax, qword [r14 + 8]
movups xmmword [rcx + rax], xmm0
movsd qword [rcx + rax + 0x10], xmm1
mov dword [rcx + rax + 0x18], 0
inc dword [r14]
mov r14, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x50]
add rsp, 0x70
pop rbp
ret
Function at 0x180003a90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180003aed
lea rbx, [0x18008e150]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180003ad4
cmp r10, 2
jb 0x180003ad4
cmp byte [r9], r8b
jne 0x180003ad4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180003ab0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180003b2f
lea rbx, [0x18008e150]
cmp r8b, 0x23
jne 0x180003b13
cmp byte [r9], r8b
jne 0x180003b13
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180003b00
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x180003cf0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov rbx, rcx
test rcx, rcx
jne 0x180003d25
mov r8d, 0x866
lea rdx, str.C:UsersPhillipDesktopCheat_DevlopmentUnrealUE_4OHDidk___21414___Copyohd_internalImGui_DirectX_11_Kiero_Hookimguiimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor r14d, r14d
test rsi, rsi
je 0x180003d30
mov qword [rsi], r14
lea rdx, [0x18008d918]
mov rcx, rbx
call fcn.180003b40
mov rbx, rax
test rax, rax
jne 0x180003d58
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x180003e82
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180003e82
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180003e82
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180003e82
cmp rdi, 0xffffffffffffffff
je 0x180003e82
mov rcx, rdi
call fcn.180007830
mov rbp, rax
test rax, rax
je 0x180003e82
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x180003e6f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x1800ac5d8]
test r8, r8
je 0x180003e64
movsx rdx, word [r8 + 0x60d8]
lea rcx, [r8 + 0x60dc]
mov r9d, dword [r8 + 0x3f68]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x180003e59
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60d8], cx
movsx rax, cx
lea rcx, [r8 + 0x60dc]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x60d4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180003e8b
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x180003e7d
mov qword [rsi], rdi
mov rax, rbp
jmp 0x180003e8d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180012e60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rdi, edx
mov r15, rcx
mov esi, edi
mov ebp, edi
mov r14d, edi
shr esi, 0x18
shr ebp, 0x10
shr r14d, 8
cmp dword [rcx + 0x100], 0
jg 0x180012eaa
mov r8d, 0x7a3
lea rdx, str.C:UsersPhillipDesktopCheat_DevlopmentUnrealUE_4OHDidk___21414___Copyohd_internalImGui_DirectX_11_Kiero_Hookimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rcx, dword [r15 + 0x100]
lea rdx, [0x18008e150]
mov rax, qword [r15 + 0x108]
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r14b
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, bpl
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, esi
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [r15]
not ebx
cmp dword [rcx + 0x405c], ebx
jne 0x180012f1f
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.1800204e0
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180012f40
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x100], 0
mov rdi, rdx
mov rbx, rcx
jg 0x180012f73
mov r8d, 0x7a3
lea rdx, str.C:UsersPhillipDesktopCheat_DevlopmentUnrealUE_4OHDidk___21414___Copyohd_internalImGui_DirectX_11_Kiero_Hookimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movss xmm2, dword [rbx + 0x120]
lea r9, [0x18008e150]
movss xmm0, dword [rdi]
movsxd rcx, dword [rbx + 0x100]
subss xmm0, xmm2
mov rax, qword [rbx + 0x108]
movss xmm3, dword [rbx + 0x124]
movss xmm1, dword [rdi + 4]
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0x20]
movss xmm0, dword [rdi + 8]
movzx ecx, r8b
subss xmm0, xmm2
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x21]
movss dword [rsp + 0x24], xmm1
movss xmm1, dword [rdi + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x22]
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x2c], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x23]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x24]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x25]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x26]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x27]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x28]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x29]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2a]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2b]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2c]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
mov rbx, qword [rsp + 0x40]
xor rcx, rax
movzx eax, byte [rsp + 0x2d]
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2e]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0x2f]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x30
pop rdi
ret
Function at 0x180018330
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1800ab040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1800ac5d8]
mov edi, ecx
cmp byte [rbx + 0x4d35], 0
jne 0x180018391
cmp byte [rbx + 0x4d36], 0
jne 0x180018391
movsx r9d, word [rbx + 0x5ea0]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.180003870
test dil, 2
je 0x1800184bf
jmp 0x18001841a
movss xmm1, dword [rbx + 0x39c4]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x18009bea8]
xor eax, eax
mulss xmm1, dword [0x18009be98]
addss xmm0, dword [rbx + 0xf8]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0xfc]
mov qword [rbx + 0x4a28], rax
mov dword [rbx + 0x4a14], 1
movss dword [rbx + 0x4a20], xmm0
movss dword [rbx + 0x4a24], xmm1
movss xmm0, dword [rbx + 0x3a20]
mulss xmm0, dword [0x18009bde4]
or dword [rbx + 0x4a10], 0x41
movss dword [rbx + 0x4a70], xmm0
movsx r9d, word [rbx + 0x5ea0]
call fcn.180003870
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x180018470
lea r11, [0x18008e150]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x180018453
cmp byte [r8], r9b
jne 0x180018453
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180018440
not ecx
call fcn.18000b840
test rax, rax
je 0x1800184bf
cmp byte [rax + 0xbe], 0
je 0x1800184bf
mov byte [rax + 0xc3], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xc6], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xe4], 1
mov edx, 0x10
inc word [rbx + 0x5ea0]
movsx r9d, word [rbx + 0x5ea0]
call fcn.180003870
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.18000ea10
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180081b60
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x18001ecd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5ff8], 0
lea rbx, [rcx + 0x6000]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x18001ed77
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x18001ed2a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1800217d0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.180004550
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5ff8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x6008]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1800ac5d0]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x18001ed7f
mov rcx, rbx
call fcn.180004550
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret