joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004cd78
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rsi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x18004cda8
cvtsi2ss xmm0, rdx
jmp 0x18004cdbd
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.msvcrt.dll_ceilf
movss xmm1, dword [0x1800d8fe4]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18004cdeb
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18004cdeb
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18004ce19
cmp rbx, 0x200
jae 0x18004ce16
shl rbx, 3
cmp rbx, rcx
jae 0x18004ce19
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
ja 0x18004cf87
lea rax, [rbx - 1]
mov edi, 1
mov rbx, qword [rsi + 8]
or rax, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18000da00
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18004cf4b
mov rcx, qword [rcx]
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx edx, byte [r9 + rax + 0x10]
movabs r10, 0x100000001b3
xor r8, rdx
inc r9
imul r8, r10
cmp r9, 8
jb 0x18004ce91
mov r11, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x18]
and r11, r8
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x18004ced0
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x18004cf3f
mov r10, qword [rdi + r11*8 + 8]
mov rdx, qword [rax + 0x10]
cmp rdx, qword [r10 + 0x10]
jne 0x18004cf14
mov r10, qword [r10]
cmp r10, rax
je 0x18004cec9
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18004cec9
mov r10, qword [r10 + 8]
cmp rdx, qword [r10 + 0x10]
je 0x18004cf61
cmp qword [rdi + r11*8], r10
jne 0x18004cf0a
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18004ce81
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18004cf3f
lea rcx, str.invalid_hash_bucket_count
call fcn.180092434
int3

Function at 0x18004d290
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.10.virtual_32

Function at 0x18004d434
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.7.virtual_16
Function at 0x18004d494
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004d4ac
Capabilities:
Delete file

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004d4d0
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x50
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004d4e8
Capabilities:
Delete file

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004d554
Capabilities:
Write file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004d578
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004d59c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004d5c0
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x40
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004d5fc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.10.virtual_32

Function at 0x18004d68c
Capabilities:
Read file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.10.virtual_24

Function at 0x18004d7a0
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004d7dc
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x38
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004d7f4
Capabilities:
Delete file

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004d80c
Capabilities:
Delete file

Disassembly:
sub rcx, 0x38
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004d848
Capabilities:
Write file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004d884
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004d8a8
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004d8cc
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004d8f0
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x48
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004d98c
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.10.virtual_24

Function at 0x18004dadc
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004db18
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x40
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004db30
Capabilities:
Delete file

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004db54
Capabilities:
Delete file

Disassembly:
sub rcx, 0x40
jmp method.IMySteamRemoteStorage.6.virtual_24
Function at 0x18004db9c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004dbd8
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004dbfc
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004dc38
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x50
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004dddc
Capabilities:
Read file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004de3c
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004de48
Capabilities:
Delete file

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004de6c
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x48
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004de84
Capabilities:
Delete file

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004deb4
Capabilities:
Delete file

Disassembly:
sub rcx, 0x48
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004df14
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004df38
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004df5c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x38
jmp method.IMySteamRemoteStorage.7.virtual_0
Function at 0x1800524bc
Capabilities:
Check if file exists
Create directory

Disassembly:
push rbx
sub rsp, 0x240
lea rdx, [rsp + 0x130]
sub rdx, rcx
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x1800524d0
mov edx, 0x5c
lea rcx, [rsp + 0x130]
call qword [sym.imp.msvcrt.dll_strrchr]
mov edx, 0x2f
lea rcx, [rsp + 0x130]
mov rbx, rax
call qword [sym.imp.msvcrt.dll_strrchr]
cmp rax, rbx
cmova rbx, rax
test rbx, rbx
je 0x1800525a2
lea rdx, [0x1800cc010]
mov byte [rbx + 1], 0
lea rcx, [rsp + 0x130]
call qword [sym.imp.msvcrt.dll_strtok]
mov byte [rsp + 0x20], 0
jmp 0x18005259a
lea rcx, [rsp + 0x20]
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x18005253d
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x180052547
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x180052571
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [rsp + 0x20]
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x180052579
movzx eax, word [0x1800cc014]
lea rdx, [0x1800cc018]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_strtok]
mov r8, rax
test rax, rax
jne 0x180052535
add rsp, 0x240
pop rbx
ret
Function at 0x180054a98
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_0

Function at 0x180054df8
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x18
jmp method.IMySteamApps.2.virtual_56

Function at 0x180054f30
Capabilities:
Get common file path

Disassembly:
sub rcx, 0x10
jmp method.IMySteamApps.3.virtual_144

Function at 0x180054f9c
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_16

Function at 0x180055110
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_8

Function at 0x180055350
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_0

Function at 0x180055638
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x20
jmp method.IMySteamApps.2.virtual_56

Function at 0x180055740
Capabilities:
Get common file path

Disassembly:
sub rcx, 0x18
jmp method.IMySteamApps.3.virtual_144

Function at 0x1800558cc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_8

Function at 0x180055b78
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.3.virtual_192

Function at 0x180055c38
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.3.virtual_184

Function at 0x180055ce0
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamApps.2.virtual_56

Function at 0x180055dd0
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x28
jmp method.IMySteamApps.2.virtual_56

Function at 0x180055e0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.virtual_0

Function at 0x180056310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.virtual_32

Function at 0x18005643c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamApps.2.virtual_56

Function at 0x18005655c
Capabilities:
Get common file path

Disassembly:
sub rcx, 8
jmp method.IMySteamApps.3.virtual_144

Function at 0x1800565b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_16
Function at 0x180059544
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, rdx
mov rsi, rcx
mov ecx, 0x20
call fcn.180093e94
mov r8, qword [rbx]
mov qword [rax], r8
mov r8, qword [0x1801b6238]
mov qword [rax + 8], r8
movups xmm0, xmmword [rdi]
movdqu xmmword [rax + 0x10], xmm0
mov qword [rsp + 0x50], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1800595f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x1800595c6
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call fcn.180092888
int3
Function at 0x18005a594
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov r14, rdx
mov rdi, rcx
call fcn.18005c908
nop
lea rsi, [rdi + 0xc0]
mov rcx, rsi
call fcn.18007eec0
nop
lea rax, vtable.GlRender.0
mov qword [rdi], rax
lea rax, vtable.GlRender.1.0
mov qword [rsi], rax
lea rbx, [rdi + 0x168]
mov qword [rbp + 0x48], rbx
and dword [rbp + 0x40], 0
mov eax, dword [rbp + 0x40]
mov dword [rbx], eax
and qword [rbx + 8], 0
and qword [rbx + 0x10], 0
mov ecx, 0x60
call fcn.180093e94
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x18]
and qword [rcx], 0
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
mov qword [rbx + 0x30], 7
mov qword [rbx + 0x38], 8
mov dword [rbx], 0x3f800000
mov r8, qword [rbx + 8]
mov edx, 0x10
call fcn.18000da00
nop
mov byte [rbp - 0x18], 0x7b
mov byte [rbp - 0x17], 0x6b
mov byte [rbp - 0x16], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x15], 0x57
mov byte [rbp - 0x14], 0x7b
mov byte [rbp - 0x13], 0x65
mov byte [rbp - 0x12], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x11], 0x46
mov byte [rbp - 0x10], 0x79
mov byte [rbp - 0xf], 0x6a
mov byte [rbp - 0xe], 0x6a
mov byte [rbp - 0xd], 0x69
mov byte [rbp - 0xc], 0x76
mov byte [rbp - 0xb], 0x77
mov byte [rbp - 0xa], 0
mov al, byte [rbp - 0x18]
xor edx, edx
mov al, byte [rbp + rdx - 0x18]
sub al, 4
mov byte [rbp + rdx - 0x18], al
inc rdx
cmp rdx, 0xe
jb 0x18005a681
lea rdx, [rbp - 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18005a6ce
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005a458]
mov rdx, rax
mov rcx, rsi
call fcn.18007a810
mov qword [0x1801b6248], rdi
mov byte [rdi + 8], 1
mov rax, rdi
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18005beb0
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rdx, qword [0x1801b5a50]
mov rdi, rcx
mov r8d, dword [rdx + 0xe8]
sub r8d, 1
je 0x18005c061
cmp r8d, 1
jne 0x18005c07f
mov byte [rbp - 0x30], 0x51
xor ebx, ebx
mov byte [rbp - 0x2f], 0x76
mov ecx, ebx
mov byte [rbp - 0x2e], 0x80
mov byte [rbp - 0x2d], 0x7d
mov byte [rbp - 0x2c], WSASetLastError
mov byte [rbp - 0x2b], 0x81
mov byte [rbp - 0x2a], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x29], 0x75
mov byte [rbp - 0x28], 0x5a
mov byte [rbp - 0x27], WSACleanup
mov byte [rbp - 0x26], 0x80
mov byte [rbp - 0x25], 0x80
mov byte [rbp - 0x24], WSASetLastError
mov byte [rbp - 0x23], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x22], WSACleanup
mov byte [rbp - 0x21], 0x4e
mov byte [rbp - 0x20], bl
mov al, byte [rbp - 0x30]
mov al, byte [rbp + rcx - 0x30]
sub al, 0xd
mov byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x10
jb 0x18005bf31
mov byte [rbp + 0x18], 0x59
mov rcx, rbx
mov byte [rbp + 0x19], 0x77
mov byte [rbp + 0x1a], 0x69
mov byte [rbp + 0x1b], 0x76
mov byte [rbp + 0x1c], 0x37
mov byte [rbp + 0x1d], 0x36
mov byte [rbp + 0x1e], bl
mov al, byte [rbp + 0x18]
mov al, byte [rbp + rcx + 0x18]
sub al, 4
mov byte [rbp + rcx + 0x18], al
inc rcx
cmp rcx, 6
jb 0x18005bf65
lea r8, [rbp - 0x30]
mov rcx, rdi
lea rdx, [rbp + 0x18]
call fcn.18007f73c
mov rdx, rax
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005ba6c]
mov rcx, rdi
call fcn.18007a810
mov byte [rbp - 0x1f], 0x51
mov rcx, rbx
mov byte [rbp - 0x1e], 0x76
mov byte [rbp - 0x1d], 0x80
mov byte [rbp - 0x1c], 0x7d
mov byte [rbp - 0x1b], WSASetLastError
mov byte [rbp - 0x1a], 0x81
mov byte [rbp - 0x19], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x18], 0x75
mov byte [rbp - 0x17], 0x5a
mov byte [rbp - 0x16], WSACleanup
mov byte [rbp - 0x15], 0x80
mov byte [rbp - 0x14], 0x80
mov byte [rbp - 0x13], WSASetLastError
mov byte [rbp - 0x12], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x11], WSACleanup
mov byte [rbp - 0x10], 0x64
mov byte [rbp - 0xf], bl
mov al, byte [rbp - 0x1f]
mov al, byte [rbp + rcx - 0x1f]
sub al, 0xd
mov byte [rbp + rcx - 0x1f], al
inc rcx
cmp rcx, 0x10
jb 0x18005bfee
mov byte [rbp + 0x20], 0x5e
mov byte [rbp + 0x21], 0x7c
mov byte [rbp + 0x22], WSASetLastError
mov byte [rbp + 0x23], 0x7b
mov byte [rbp + 0x24], 0x3c
mov byte [rbp + 0x25], 0x3b
mov byte [rbp + 0x26], bl
mov al, byte [rbp + 0x20]
mov al, byte [rbp + rbx + 0x20]
sub al, 9
mov byte [rbp + rbx + 0x20], al
inc rbx
cmp rbx, 6
jb 0x18005c01f
lea r8, [rbp - 0x1f]
mov rcx, rdi
lea rdx, [rbp + 0x20]
call fcn.18007f73c
mov rdx, rax
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005ba6c]
mov rcx, rdi
call fcn.18007a810
jmp 0x18005c07f
xor r9d, r9d
lea rdx, [0x18005b604]
xor r8d, r8d
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x1801b67a8], rax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1800616ac
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
cmp byte [rcx + 9], 0
mov r15, r8
mov rdi, rcx
jne 0x180061867
cmp qword [rcx + 0x178], 0
je 0x180061867
and qword [rbp + 0x30], 0
lea r8, [rbp + 0x30]
call fcn.18006222c
and qword [rbp - 0x38], 0
xor eax, eax
mov dword [rbp - 0x44], eax
mov qword [rbp + 0x48], rax
mov dword [rbp - 0x28], eax
mov qword [rbp - 0x18], rax
mov rax, qword [rdi + 0x170]
mov qword [rbp - 0x60], rax
mov rax, qword [rdi + 0x180]
mov qword [rbp - 0x58], rax
mov rax, qword [rdi + 0x178]
mov qword [rbp - 0x50], rax
mov eax, dword [rdi + 0x190]
mov dword [rbp - 0x48], eax
mov rax, qword [rdi + 0x188]
mov qword [rbp - 0x30], rax
mov eax, 2
mov dword [rbp - 0x24], eax
mov dword [rbp - 0x20], eax
lea rax, [sym.steam_api64.dll_SteamAPI_ISteamApps_RequestPublisherOwnedAppData]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x30]
and qword [rbp + 0x30], 0
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x1c], 1
lea rdx, [rbp + 0x30]
lea rcx, [0x18005e764]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbp + 0x30]
test rax, rax
je 0x180061762
mov qword [rdi + 0x168], rax
call fcn.180021994
mov rcx, qword [rdi + 0x168]
call fcn.18001eb98
mov rsi, qword [0x1801b5c60]
mov r14, qword [rdi + 0x1b0]
test rsi, rsi
je 0x1800617ad
inc dword [rsi + 0xf4]
mov ecx, 0xe8
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rbp + 0x30], rax
mov rbx, rax
test rax, rax
je 0x1800617de
xor edx, edx
mov r8d, 0xe8
mov rcx, rax
call fcn.180095c90
mov qword [rbx + 0x60], 0x100
jmp 0x1800617e0
xor ebx, ebx
or dword [rsi + 0xc], 8
lea rax, str.imgui_impl_vulkan
movaps xmm0, xmmword [rbp - 0x60]
movaps xmm1, xmmword [rbp - 0x50]
mov qword [rsi + 0x90], rax
mov rax, qword [rbp + 0x48]
mov qword [rsi + 0xa0], rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x58], r14
movaps xmm0, xmmword [rbp - 0x40]
movups xmmword [rbx + 0x10], xmm1
mov dword [rbx + 0x88], eax
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rbx + 0x20], xmm0
movaps xmm0, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x30], xmm1
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx + 0x40], xmm0
movsd qword [rbx + 0x50], xmm1
call fcn.18001dea0
mov rcx, rdi
call fcn.18005d054
mov rax, qword [r15 + 0x30]
mov ecx, dword [rax]
lea rax, [rcx + rcx*2]
mov rcx, qword [rdi + 0x1b8]
add rax, rax
mov rcx, qword [rcx + rax*8 + 8]
call fcn.18001d5b0
mov byte [rdi + 9], 1
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180063b54
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [0x1801b5c68]
mov rbx, rcx
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9d, dword [rbx + 0xc]
movabs rdx, 0xcbf29ce484222325
mov dword [rsp + 0x40], r9d
xor r8d, r8d
movzx eax, byte [rsp + r8 + 0x40]
movabs rcx, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, rcx
cmp r8, 4
jb 0x180063b93
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x20]
and rax, rdx
add rax, rax
mov rdi, qword [rcx + rax*8 + 8]
cmp rdi, qword [rbp + 0x10]
je 0x180063be3
mov rcx, qword [rcx + rax*8]
jmp 0x180063bdb
cmp rdi, rcx
je 0x180063be3
mov rdi, qword [rdi + 8]
cmp r9d, dword [rdi + 0x10]
jne 0x180063bd2
jmp 0x180063be5
xor edi, edi
test rdi, rdi
je 0x180063c6f
cmp rdi, qword [rbp + 0x10]
je 0x180063c6f
mov rdx, qword [rdi + 0x20]
mov rsi, qword [rdi + 0x18]
jmp 0x180063c07
cmp qword [rsi], rbx
je 0x180063c0c
add rsi, 8
cmp rsi, rdx
jne 0x180063bfe
cmp rsi, rdx
je 0x180063c4e
lea rax, [rsi + 8]
jmp 0x180063c2a
mov rcx, qword [rax]
cmp rcx, rbx
je 0x180063c26
mov qword [rsi], rcx
add rsi, 8
add rax, 8
cmp rax, rdx
jne 0x180063c17
cmp rsi, rdx
je 0x180063c4e
mov rbx, qword [rdi + 0x20]
mov rcx, rsi
sub rbx, rdx
mov r8, rbx
call sub.msvcrt.dll_memmove
lea rax, [rbx + rsi]
mov qword [rdi + 0x20], rax
mov rax, qword [rdi + 0x20]
sub rax, qword [rdi + 0x18]
test rax, 0xfffffffffffffff8
jne 0x180063c6f
lea rcx, [rbp + 8]
mov r8, rdi
lea rdx, [rsp + 0x40]
call fcn.18004311c
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x18006b1f4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x30]
mov byte [rax], 0
jmp fcn.180042ca4
Function at 0x18006cf94
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, rdx
mov r14, rcx
xor edi, edi
xor ebx, ebx
xor esi, esi
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
jne 0x18006d035
cmp esi, edi
jne 0x18006cfe9
lea r15d, [rdi + 0x3e8]
mov edx, edi
mov r8d, r15d
mov rcx, rbx
call fcn.18006b49c
test rax, rax
je 0x18006d071
mov rbx, rax
mov edi, r15d
call qword [sym.imp.msvcrt.dll__errno]
movsxd rcx, esi
mov r9, r14
add rcx, rbx
mov edx, 1
and dword [rax], 0
mov eax, edi
sub eax, esi
movsxd r8, eax
call qword [sym.imp.msvcrt.dll_fread]
mov rcx, r14
mov r15, rax
call qword [sym.imp.msvcrt.dll_ferror]
test eax, eax
jne 0x18006d07a
mov rcx, r14
add esi, r15d
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
je 0x18006cfc2
cmp esi, edi
jne 0x18006d0b8
lea r8d, [rdi + 1]
mov edx, edi
mov rcx, rbx
call fcn.18006b49c
test rax, rax
jne 0x18006d0b5
lea r8, [0x1801b1848]
mov edx, 0xc8
mov rcx, rbp
call fcn.180043f7c
test rbx, rbx
je 0x18006d06d
mov rax, qword [fcn.180098378]
mov rcx, rbx
call rax
xor eax, eax
jmp 0x18006d0e1
lea r8, [0x1801b1870]
jmp 0x18006d04f
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0
je 0x18006d095
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.msvcrt.dll_strerror]
jmp 0x18006d09c
lea rax, str.Error_reading_file
mov r9, rax
lea r8, [0x1801b0e38]
mov edx, 0xc8
mov rcx, rbp
call fcn.180043f7c
jmp 0x18006d05c
mov rbx, rax
movsxd rax, esi
mov rdx, rbp
mov rcx, rbx
mov byte [rax + rbx], 0
call fcn.18006c874
mov rdi, rax
test rbx, rbx
je 0x18006d0de
mov rdx, qword [fcn.180098378]
mov rcx, rbx
call rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret