joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004f6ec
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
xor r15d, r15d
lea r12, [0x140000000]
movzx eax, byte [r15 + r12 + 0x66f10]
mov edi, eax
mov r8d, eax
shr edi, 5
mov r11d, eax
shr r8d, 6
mov ebp, edi
lea edx, [rax + rax]
shr r11d, 7
xor edx, eax
and ebp, 4
mov r10d, edi
mov r9d, r8d
and edi, 1
and r10d, 2
imul ecx, edi, 0x1b000000
and r8d, 1
lea ebx, [rdx + rdx]
and r9d, 2
lea edx, [rdx*4]
xor ebx, eax
xor edx, eax
shl ebx, 0x19
shl edx, 8
mov esi, eax
xor rbx, rcx
mov r14d, eax
imul ecx, r10d, 0x1b000000
xor rbx, rcx
imul ecx, r8d, 0x1b000000
xor rbx, rcx
imul ecx, r9d, 0x1b000000
xor rbx, rcx
imul ecx, ebp, 0x1b000000
xor rbx, rcx
imul ecx, r11d, 0x1b000000
xor rbx, rcx
imul ecx, edi, 0x11b00
xor rdx, rcx
imul ecx, r10d, 0x11b00
xor rdx, rcx
imul ecx, r8d, 0x11b00
xor rdx, rcx
imul ecx, r9d, 0x11b00
xor rdx, rcx
imul ecx, ebp, 0x11b00
xor rdx, rcx
imul ecx, edi, 0x11b0000
or rbx, rdx
lea edx, [rax*8]
xor edx, eax
lea eax, [rax*4]
shl edx, 0x10
xor eax, r14d
xor rdx, rcx
imul ecx, r10d, 0x11b0000
xor rdx, rcx
imul ecx, ebp, 0x11b0000
xor rdx, rcx
imul ecx, edi, 0x11b
or rbx, rdx
lea edx, [rax + rax]
xor rdx, rcx
imul ecx, r10d, 0x11b
xor rdx, rcx
imul ecx, ebp, 0x11b
xor rdx, rcx
imul ecx, r11d, 0x11b
xor rdx, rcx
xor rdx, rsi
or rdx, rbx
shl rdx, 0x20
or rdx, rbx
or rdx, rsi
mov qword [r12 + r15*8 + 0x816e0], rdx
inc r15
cmp r15, 0x100
jl 0x14004f70f
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov byte [0x140081ee1], 1
pop r15
pop r14
pop r12
ret

Function at 0x14004f878
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
lea rbx, [0x140000000]
movzx r9d, byte [r11 + rbx + 0x66e10]
mov edx, r9d
shr edx, 7
imul r10d, edx, 0x1b000000
lea r8d, [r9 + r9]
imul ecx, edx, 0x11b
mov eax, r8d
shl eax, 0x18
xor r10, rax
mov eax, r9d
shl eax, 8
or eax, r9d
shl eax, 8
or r10, rax
mov eax, r8d
xor rcx, rax
xor rcx, r9
or rcx, r10
shl rcx, 0x20
or rcx, r10
mov qword [rbx + r11*8 + 0x80ed0], rcx
inc r11
cmp r11, 0x100
jl 0x14004f887
and qword [0x1400816d8], 0
and qword [0x1400816d0], 0
mov rbx, qword [rsp + 8]
mov byte [0x140081ee0], 1
ret
Function at 0x140051328
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x14007b180]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x140081fe0]
mov rax, qword gs:[0x58]
mov edx, 0x130
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x140081ef0], ecx
jg 0x14005140a
mov eax, ebx
cmp rbx, rax
jne 0x1400513cc
xor ecx, ecx
test rbx, rbx
setne cl
xor eax, eax
test ebx, ebx
setne al
cmp ecx, eax
jne 0x1400513cc
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [0x140081ee8]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x14005144d
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400590d0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x20]
call fcn.140009550
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140051058
lea rdx, [0x140077a98]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [0x140081ef0]
call fcn.140059934
cmp dword [0x140081ef0], 0xffffffff
jne 0x140051374
lea rcx, [0x140081ee8]
call fcn.140050f6c
lea rcx, [0x14005d04c]
call fcn.1400593bc
nop
lea rcx, [0x140081ef0]
call fcn.1400598c8
jmp 0x140051374
mov ecx, eax
call fcn.140051490
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [0x140065998]
lea rcx, [rsp + 0x20]
call fcn.140009550
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140051058
lea rdx, [0x140077a98]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x140052894
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 8
jb 0x140052907
mov rbp, r8
shr rbp, 3
imul rax, rbp, 0xfffffffffffffff8
add rdi, rax
mov r8d, 8
lea rcx, [rsp + 0x58]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 8
lea rcx, [rsp + 0x50]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x50]
add rsi, 8
xor rax, qword [rsp + 0x58]
add rbx, 8
or r14, rax
sub rbp, 1
jne 0x1400528c6
mov rcx, r14
shr rcx, 0x20
or ecx, r14d
mov edx, ecx
mov eax, ecx
shr edx, 8
or edx, ecx
shr eax, 0x10
and edx, 0xff00
or edx, eax
movzx eax, cl
shr edx, 8
or edx, eax
test rdi, rdi
je 0x140052949
sub rsi, rbx
movzx ecx, byte [rsi + rbx]
movzx eax, byte [rbx]
inc rbx
xor ecx, eax
or edx, ecx
sub rdi, 1
jne 0x140052935
mov rbx, qword [rsp + 0x40]
test edx, edx
mov rbp, qword [rsp + 0x48]
sete al
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140052964
Capabilities:
Encode data using xor

Disassembly:
test r9, r9
je 0x140052a2a
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, r9
mov r15d, 4
mov rdi, r8
mov rsi, rdx
mov r14, rcx
cmp rbx, r15
jb 0x1400529f5
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r15
lea rcx, [rsp + 0x20]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r15
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x68]
lea rdx, [rsp + 0x24]
xor eax, dword [rsp + 0x20]
mov r8, r15
mov rcx, r14
mov dword [rsp + 0x24], eax
call sub.VCRUNTIME140.dll_memcpy
add r14, r15
add rsi, r15
add rdi, r15
sub rbp, 1
jne 0x1400529aa
test rbx, rbx
je 0x140052a12
sub rsi, rdi
sub r14, rdi
mov al, byte [rsi + rdi]
xor al, byte [rdi]
mov byte [r14 + rdi], al
inc rdi
sub rbx, 1
jne 0x140052a00
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140052a2c
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x140052ad9
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, r8
mov r14d, 4
mov rsi, rdx
mov rdi, rcx
cmp rbx, r14
jb 0x140052ab1
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r14
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r14
lea rcx, [rsp + 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x60]
lea rdx, [rsp + 0x20]
xor eax, dword [rsp + 0x68]
mov r8, r14
mov rcx, rdi
mov dword [rsp + 0x20], eax
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
add rsi, r14
sub rbp, 1
jne 0x140052a69
test rbx, rbx
je 0x140052ac7
sub rsi, rdi
mov al, byte [rsi + rdi]
xor byte [rdi], al
inc rdi
sub rbx, 1
jne 0x140052ab9
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140058a1c
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rcx]
mov r9d, 4
shl edx, 2
mov r8, rcx
movdqu xmm0, xmmword [rcx + rdx*4]
movdqu xmmword [rcx], xmm0
movdqu xmmword [rcx + rdx*4], xmm1
add edx, 0xfffffffc
cmp edx, r9d
jbe 0x140058a6b
aesimc xmm0, xmmword [r8 + rdx*4]
mov ecx, r9d
add r9d, 4
aesimc xmm1, xmmword [r8 + rcx*4]
movdqu xmmword [r8 + rcx*4], xmm0
movdqu xmmword [r8 + rdx*4], xmm1
add edx, 0xfffffffc
cmp r9d, edx
jb 0x140058a42
mov eax, r9d
aesimc xmm0, xmmword [r8 + rax*4]
movdqu xmmword [r8 + rax*4], xmm0
ret

Function at 0x14005a048
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005a092
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005a092
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005a092
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005a092
cmp dword [rcx + 0x84], 0xe
jbe 0x14005a092
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005a094
xor al, al
add rsp, 0x28
ret
Function at 0x14056b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14056b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14056b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14056b06f
add dl, dl
jne 0x14056b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14056b0f6
xor eax, eax
add dl, dl
jne 0x14056b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14056b1ad
add dl, dl
jne 0x14056b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14056b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14056b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14056b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14056b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14056b07e
mov eax, 1
add dl, dl
jne 0x14056b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14056b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14056b0fb
sub eax, ebx
mov ebx, 1
jne 0x14056b14c
mov ecx, 1
add dl, dl
jne 0x14056b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14056b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14056b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14056b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14056b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14056b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14056b15d
cmp eax, 0x7d00
jae 0x14056b19b
cmp eax, 0x500
jb 0x14056b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14056b07e
cmp eax, 0x7f
ja 0x14056b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14056b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14056b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14056b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x18001e06c
Capabilities:
Encode data using xor

Disassembly:
test dl, 3
je 0x18001e079
sub edx, 1
test dl, 3
jne 0x18001e071
test edx, edx
je 0x18001e09a
mov eax, 0
mov r9d, 0
cdqe
xor dword [rcx + rax], r8d
add r9d, 4
mov eax, r9d
cmp r9d, edx
jb 0x18001e088
ret
Function at 0x180043c3e
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x10
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x180043c57
test esi, esi
je 0x180043c76
call fcn.180043bee
cmp eax, esi
jne 0x180043c57
mov rax, qword [rbx + 0x30]
jmp 0x180043c7a
mov rax, qword [rbx + 0x30]
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x180002730
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18000278d
lea rbx, [0x18003e700]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180002774
cmp r10, 2
jb 0x180002774
cmp byte [r9], r8b
jne 0x180002774
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180002750
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1800027cf
lea rbx, [0x18003e700]
cmp r8b, 0x23
jne 0x1800027b3
cmp byte [r9], r8b
jne 0x1800027b3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1800027a0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180002a40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x180002a6f
mov r8d, 0x599
lea rdx, str.C:UsersFarDownloadspso_full_cheatImGui_DirectX_11_Kiero_Hook_masterImGui_DirectX_11_Kiero_Hookimguiimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x180002a7b
mov qword [rdi], 0
lea rdx, [0x180045180]
mov rcx, rbx
call fcn.1800027e0
mov rbx, rax
test rax, rax
jne 0x180002a9d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x180002b74
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180002b74
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x180002b74
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180002b74
cmp rsi, 0xffffffffffffffff
je 0x180002b74
mov rax, qword [0x18004fb38]
test rax, rax
je 0x180002b11
inc dword [rax + 0x3bc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x180002b74
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x180002b61
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x18004fb38]
test rax, rax
je 0x180002b56
dec dword [rax + 0x3bc]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180002b7d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x180002b6f
mov qword [rdi], rsi
mov rax, rbp
jmp 0x180002b7f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180004cc0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xc0], 0
mov rbx, rcx
mov edi, edx
jg 0x180004cf6
mov r8d, 0x502
lea rdx, str.C:UsersFarDownloadspso_full_cheatImGui_DirectX_11_Kiero_Hook_masterImGui_DirectX_11_Kiero_Hookimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd r8, dword [rbx + 0xc0]
mov rax, qword [rbx + 0xc8]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x18003e700]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x18004fb38]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1a60], edx
jne 0x180004d70
mov dword [rax + 0x1a64], edx
cmp dword [rax + 0x1a9c], edx
jne 0x180004d7f
mov byte [rax + 0x1aa0], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x180007a20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
cmp byte [rcx], 0
mov rbx, rcx
jne 0x180007a3b
cmp byte [rcx + 0x2ef4], 0
je 0x180007a55
mov r8d, 0xed0
lea rdx, str.C:UsersFarDownloadspso_full_cheatImGui_DirectX_11_Kiero_Hook_masterImGui_DirectX_11_Kiero_Hookimguiimgui.cpp
lea rcx, str._g.Initialized___g.SettingsLoaded
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
lea r8, [0x1800437d9]
mov dword [rsp + 0x2c], eax
lea r11, [0x18003e700]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, str.Window
mov edx, r10d
mov qword [rsp + 0x20], rax
mov r9b, 0x57
cmp r9b, 0x23
jne 0x180007a99
cmp byte [r8], r9b
jne 0x180007a99
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x180007a86
mov ecx, dword [rbx + 0x2f14]
lea rax, [0x180015550]
mov edi, dword [rbx + 0x2f10]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x1800155d0]
mov qword [rsp + 0x38], rax
lea rax, [0x1800156b0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x180007b9f
inc edi
test ecx, ecx
je 0x180007b05
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x180007b0a
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x180007b9f
mov rax, qword [0x18004fb38]
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
test rax, rax
je 0x180007b33
inc dword [rax + 0x3bc]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, qword [rbx + 0x2f18]
mov rbp, rax
test rsi, rsi
je 0x180007b88
movsxd rcx, dword [rbx + 0x2f10]
mov rdx, rsi
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [0x18004fb38]
test rax, rax
je 0x180007b7f
dec dword [rax + 0x3bc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x2f18], rbp
mov rbp, qword [rsp + 0x60]
mov dword [rbx + 0x2f14], edi
movsxd rax, dword [rbx + 0x2f10]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2f18]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2f10]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1800092a0
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x1800092f0
lea r11, [0x18003e700]
nop dword [rax]
cmp r9b, 0x23
jne 0x1800092d3
cmp byte [r8], r9b
jne 0x1800092d3
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1800092c0
mov rcx, qword [0x18004fb38]
not eax
movsxd rdx, dword [rcx + 0x1a00]
mov r9, qword [rcx + 0x1a08]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x180009351
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x180009349
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18000934c
mov rdx, r8
test rdx, rdx
jne 0x180009320
cmp r9, r10
je 0x180009360
cmp dword [r9], eax
jne 0x180009360
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x18000f0b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x18004fb38]
mov rsi, rcx
mov rbx, qword [rax + 0x1a18]
add rbx, 0xc0
cmp dword [rbx], 0
jg 0x18000f0fb
mov r8d, 0x502
lea rdx, str.C:UsersFarDownloadspso_full_cheatImGui_DirectX_11_Kiero_Hook_masterImGui_DirectX_11_Kiero_Hookimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rdx, dword [rbx]
lea r8, [0x18003e700]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, sil
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x34]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x35]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x36]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x37]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x18000f1da
lea ecx, [rdx + 1]
test r8d, r8d
je 0x18000f1c6
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x18000f1cb
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.1800166b0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov rsi, qword [rsp + 0x40]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18000f200
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x18004fb38]
mov esi, ecx
mov rbx, qword [rax + 0x1a18]
add rbx, 0xc0
cmp dword [rbx], 0
jg 0x18000f249
mov r8d, 0x502
lea rdx, str.C:UsersFarDownloadspso_full_cheatImGui_DirectX_11_Kiero_Hook_masterImGui_DirectX_11_Kiero_Hookimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rdx, dword [rbx]
lea r8, [0x18003e700]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, sil
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x18000f2dc
lea ecx, [rdx + 1]
test r8d, r8d
je 0x18000f2c8
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x18000f2cd
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.1800166b0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov rsi, qword [rsp + 0x40]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180014b50
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x18004fb38]
cmp byte [rbx + 0x2f30], 0
je 0x180014c3c
cmp qword [rbx + 0x2f38], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x2f40]
je 0x180014c24
mov r9d, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test r9d, r9d
jns 0x180014bcb
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1800164e0
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov dword [rdi], ebp
mov rcx, rdi
mov r8, rsi
call fcn.1800030a0
mov eax, dword [rdi]
lea rcx, [0x18004fb30]
mov r9, qword [rbx + 0x2f38]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rbx + 0x2f48]
cmove edx, ebp
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.1800030a0
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret