joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004ccac
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rsi, rdx
movabs r8, 0xcbf29ce484222325
mov r10, rcx
xor r9d, r9d
movzx eax, byte [rbx + r9 + 0x10]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 8
jb 0x18004ccd1
mov rcx, qword [r10 + 0x30]
mov rdx, qword [r10 + 0x18]
and rcx, r8
add rcx, rcx
cmp qword [rdx + rcx*8 + 8], rbx
jne 0x18004cd21
cmp qword [rdx + rcx*8], rbx
jne 0x18004cd16
mov rax, qword [r10 + 8]
mov qword [rdx + rcx*8], rax
jmp 0x18004cd1a
mov rax, qword [rbx + 8]
mov qword [rdx + rcx*8 + 8], rax
jmp 0x18004cd2e
cmp qword [rdx + rcx*8], rbx
jne 0x18004cd2e
mov rax, qword [rbx]
mov qword [rdx + rcx*8], rax
mov rdi, qword [rbx]
dec qword [r10 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
mov rdx, qword [rbx + 0x30]
cmp rdx, 0xf
jbe 0x18004cd7b
mov rcx, qword [rbx + 0x18]
inc rdx
cmp rdx, 0x1000
jb 0x18004cd76
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18004cdaf
mov rcx, r8
call fcn.1800947c4
and qword [rbx + 0x28], 0
mov edx, 0x38
mov rcx, rbx
mov qword [rbx + 0x30], 0xf
mov byte [rbx + 0x18], 0
call fcn.1800947c4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.180098ad0
int3
Function at 0x18004d048
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rsi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x18004d078
cvtsi2ss xmm0, rdx
jmp 0x18004d08d
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.msvcrt.dll_ceilf
movss xmm1, dword [0x1800d9194]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18004d0bb
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18004d0bb
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18004d0e9
cmp rbx, 0x200
jae 0x18004d0e6
shl rbx, 3
cmp rbx, rcx
jae 0x18004d0e9
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
ja 0x18004d257
lea rax, [rbx - 1]
mov edi, 1
mov rbx, qword [rsi + 8]
or rax, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18000da88
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18004d21b
mov rcx, qword [rcx]
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx edx, byte [rax + r9 + 0x10]
movabs r10, 0x100000001b3
xor r8, rdx
inc r9
imul r8, r10
cmp r9, 8
jb 0x18004d161
mov r11, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x18]
and r11, r8
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x18004d1a0
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x18004d20f
mov r10, qword [rdi + r11*8 + 8]
mov rdx, qword [rax + 0x10]
cmp rdx, qword [r10 + 0x10]
jne 0x18004d1e4
mov r10, qword [r10]
cmp r10, rax
je 0x18004d199
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18004d199
mov r10, qword [r10 + 8]
cmp rdx, qword [r10 + 0x10]
je 0x18004d231
cmp qword [rdi + r11*8], r10
jne 0x18004d1da
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18004d151
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18004d20f
lea rcx, [0x1800ce110]
call fcn.180092d50
int3

Function at 0x18004d574
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.10.virtual_32

Function at 0x18004d718
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.7.virtual_16
Function at 0x18004d778
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004d790
Capabilities:
Delete file

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004d7b4
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x50
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004d7cc
Capabilities:
Delete file

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004d838
Capabilities:
Write file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004d85c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004d880
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004d8a4
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x40
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004d8e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.10.virtual_32

Function at 0x18004d970
Capabilities:
Read file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.10.virtual_24

Function at 0x18004da84
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004dac0
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x38
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004dad8
Capabilities:
Delete file

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004daf0
Capabilities:
Delete file

Disassembly:
sub rcx, 0x38
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004db2c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004db68
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004db8c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004dbb0
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004dbd4
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x48
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004dc70
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.10.virtual_24

Function at 0x18004ddc0
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004ddfc
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x40
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004de14
Capabilities:
Delete file

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004de38
Capabilities:
Delete file

Disassembly:
sub rcx, 0x40
jmp method.IMySteamRemoteStorage.6.virtual_24
Function at 0x18004de80
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004debc
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004dee0
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004df1c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x50
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004e0c0
Capabilities:
Read file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004e120
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004e12c
Capabilities:
Delete file

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004e150
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x48
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004e168
Capabilities:
Delete file

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004e198
Capabilities:
Delete file

Disassembly:
sub rcx, 0x48
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004e1f8
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004e21c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004e240
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x38
jmp method.IMySteamRemoteStorage.7.virtual_0
Function at 0x180052764
Capabilities:
Check if file exists
Create directory

Disassembly:
push rbx
sub rsp, 0x240
lea rdx, [rsp + 0x130]
sub rdx, rcx
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x180052778
mov edx, 0x5c
lea rcx, [rsp + 0x130]
call qword [sym.imp.msvcrt.dll_strrchr]
mov edx, 0x2f
lea rcx, [rsp + 0x130]
mov rbx, rax
call qword [sym.imp.msvcrt.dll_strrchr]
cmp rax, rbx
cmova rbx, rax
test rbx, rbx
je 0x18005284a
lea rdx, [0x1800cc07c]
mov byte [rbx + 1], 0
lea rcx, [rsp + 0x130]
call qword [sym.imp.msvcrt.dll_strtok]
mov byte [rsp + 0x20], 0
jmp 0x180052842
lea rcx, [rsp + 0x20]
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x1800527e5
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x1800527ef
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x180052819
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [rsp + 0x20]
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x180052821
movzx eax, word [0x1800cc074]
lea rdx, [0x1800cc078]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_strtok]
mov r8, rax
test rax, rax
jne 0x1800527dd
add rsp, 0x240
pop rbx
ret
Function at 0x180054ec4
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_0

Function at 0x180055260
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x18
jmp method.IMySteamApps.2.virtual_56

Function at 0x1800553a4
Capabilities:
Get common file path

Disassembly:
sub rcx, 0x10
jmp method.IMySteamApps.3.virtual_144

Function at 0x180055410
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_16

Function at 0x180055590
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_8

Function at 0x1800557e8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_0

Function at 0x180055af4
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x20
jmp method.IMySteamApps.2.virtual_56

Function at 0x180055c20
Capabilities:
Get common file path

Disassembly:
sub rcx, 0x18
jmp method.IMySteamApps.3.virtual_144

Function at 0x180055db8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_8

Function at 0x180056070
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.3.virtual_192

Function at 0x180056130
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.3.virtual_184

Function at 0x1800561d8
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamApps.2.virtual_56

Function at 0x1800562c8
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x28
jmp method.IMySteamApps.2.virtual_56

Function at 0x180056304
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.virtual_0

Function at 0x18005682c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.virtual_32

Function at 0x180056964
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamApps.2.virtual_56

Function at 0x180056a90
Capabilities:
Get common file path

Disassembly:
sub rcx, 8
jmp method.IMySteamApps.3.virtual_144

Function at 0x180056ae4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_16
Function at 0x180059a90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, rdx
mov rsi, rcx
mov ecx, 0x20
call fcn.1800947cc
mov r8, qword [rbx]
mov qword [rax], r8
mov r8, qword [0x1801b6258]
mov qword [rax + 8], r8
movups xmm0, xmmword [rdi]
movdqu xmmword [rax + 0x10], xmm0
mov qword [rsp + 0x50], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x180059b3c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x180059b12
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call fcn.1800931a4
int3
Function at 0x18005aae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov r14, rdx
mov rdi, rcx
call fcn.18005ce70
nop
lea rsi, [rdi + 0xc0]
mov rcx, rsi
call fcn.18007f7e4
nop
lea rax, vtable.GlRender.0
mov qword [rdi], rax
lea rax, vtable.GlRender.1.0
mov qword [rsi], rax
lea rbx, [rdi + 0x168]
mov qword [rbp + 0x48], rbx
and dword [rbp + 0x40], 0
mov eax, dword [rbp + 0x40]
mov dword [rbx], eax
and qword [rbx + 8], 0
and qword [rbx + 0x10], 0
mov ecx, 0x60
call fcn.1800947cc
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x18]
and qword [rcx], 0
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
mov qword [rbx + 0x30], 7
mov qword [rbx + 0x38], 8
mov dword [rbx], 0x3f800000
mov r8, qword [rbx + 8]
mov edx, 0x10
call fcn.18000da88
nop
mov byte [rbp - 0x18], 0x80
mov byte [rbp - 0x17], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x16], 0x75
mov byte [rbp - 0x15], 0x5c
mov byte [rbp - 0x14], 0x80
mov byte [rbp - 0x13], 0x6a
mov byte [rbp - 0x12], 0x79
mov byte [rbp - 0x11], 0x4b
mov byte [rbp - 0x10], 0x7e
mov byte [rbp - 0xf], WSASetLastError
mov byte [rbp - 0xe], WSASetLastError
mov byte [rbp - 0xd], WSASetLastError
mov byte [rbp - 0xc], 0x7b
mov byte [rbp - 0xb], 0x7c
mov byte [rbp - 0xa], 0
mov al, byte [rbp - 0x18]
xor edx, edx
mov al, byte [rbp + rdx - 0x18]
sub al, 9
mov byte [rbp + rdx - 0x18], al
inc rdx
cmp rdx, 0xe
jb 0x18005abcd
lea rdx, [rbp - 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18005ac1a
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005a9a4]
mov rdx, rax
mov rcx, rsi
call fcn.18007b13c
mov qword [0x1801b6268], rdi
mov byte [rdi + 8], 1
mov rax, rdi
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18005c3fc
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rdx, qword [0x1801b5a70]
mov rdi, rcx
mov r8d, dword [rdx + 0x128]
sub r8d, 1
je 0x18005c5ad
cmp r8d, 1
jne 0x18005c5cb
mov byte [rbp - 0x30], 0x4f
xor ebx, ebx
mov byte [rbp - 0x2f], reloc.WS2_32.dll_WSACleanup
mov ecx, ebx
mov byte [rbp - 0x2e], 0x7e
mov byte [rbp - 0x2d], 0x7b
mov byte [rbp - 0x2c], 0x6c
mov byte [rbp - 0x2b], 0x7f
mov byte [rbp - 0x2a], WSASetLastError
mov byte [rbp - 0x29], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x28], 0x58
mov byte [rbp - 0x27], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x26], 0x7e
mov byte [rbp - 0x25], 0x7e
mov byte [rbp - 0x24], 0x6c
mov byte [rbp - 0x23], WSACleanup
mov byte [rbp - 0x22], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x21], 0x4c
mov byte [rbp - 0x20], bl
mov al, byte [rbp - 0x30]
mov al, byte [rbp + rcx - 0x30]
sub al, 0xb
mov byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x10
jb 0x18005c47d
mov byte [rbp + 0x18], 0x5e
mov rcx, rbx
mov byte [rbp + 0x19], 0x7c
mov byte [rbp + 0x1a], WSASetLastError
mov byte [rbp + 0x1b], 0x7b
mov byte [rbp + 0x1c], 0x3c
mov byte [rbp + 0x1d], 0x3b
mov byte [rbp + 0x1e], bl
mov al, byte [rbp + 0x18]
mov al, byte [rbp + rcx + 0x18]
sub al, 9
mov byte [rbp + rcx + 0x18], al
inc rcx
cmp rcx, 6
jb 0x18005c4b1
lea r8, [rbp - 0x30]
mov rcx, rdi
lea rdx, [rbp + 0x18]
call fcn.180080060
mov rdx, rax
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005bfb8]
mov rcx, rdi
call fcn.18007b13c
mov byte [rbp - 0x1f], 0x45
mov rcx, rbx
mov byte [rbp - 0x1e], 0x6a
mov byte [rbp - 0x1d], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1c], WSACleanup
mov byte [rbp - 0x1b], 0x62
mov byte [rbp - 0x1a], 0x75
mov byte [rbp - 0x19], 0x64
mov byte [rbp - 0x18], 0x69
mov byte [rbp - 0x17], 0x4e
mov byte [rbp - 0x16], 0x66
mov byte [rbp - 0x15], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x14], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x13], 0x62
mov byte [rbp - 0x12], 0x68
mov byte [rbp - 0x11], 0x66
mov byte [rbp - 0x10], 0x58
mov byte [rbp - 0xf], bl
mov al, byte [rbp - 0x1f]
mov al, byte [rbp + rcx - 0x1f]
dec al
mov byte [rbp + rcx - 0x1f], al
inc rcx
cmp rcx, 0x10
jb 0x18005c53a
mov byte [rbp + 0x20], 0x5e
mov byte [rbp + 0x21], 0x7c
mov byte [rbp + 0x22], WSASetLastError
mov byte [rbp + 0x23], 0x7b
mov byte [rbp + 0x24], 0x3c
mov byte [rbp + 0x25], 0x3b
mov byte [rbp + 0x26], bl
mov al, byte [rbp + 0x20]
mov al, byte [rbp + rbx + 0x20]
sub al, 9
mov byte [rbp + rbx + 0x20], al
inc rbx
cmp rbx, 6
jb 0x18005c56b
lea r8, [rbp - 0x1f]
mov rcx, rdi
lea rdx, [rbp + 0x20]
call fcn.180080060
mov rdx, rax
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005bfb8]
mov rcx, rdi
call fcn.18007b13c
jmp 0x18005c5cb
xor r9d, r9d
lea rdx, [0x18005bb50]
xor r8d, r8d
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x1801b67c8], rax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180061c10
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
cmp byte [rcx + 9], 0
mov r15, r8
mov rdi, rcx
jne 0x180061dcb
cmp qword [rcx + 0x178], 0
je 0x180061dcb
and qword [rbp + 0x30], 0
lea r8, [rbp + 0x30]
call fcn.180062790
and qword [rbp - 0x38], 0
xor eax, eax
mov dword [rbp - 0x44], eax
mov qword [rbp + 0x48], rax
mov dword [rbp - 0x28], eax
mov qword [rbp - 0x18], rax
mov rax, qword [rdi + 0x170]
mov qword [rbp - 0x60], rax
mov rax, qword [rdi + 0x180]
mov qword [rbp - 0x58], rax
mov rax, qword [rdi + 0x178]
mov qword [rbp - 0x50], rax
mov eax, dword [rdi + 0x190]
mov dword [rbp - 0x48], eax
mov rax, qword [rdi + 0x188]
mov qword [rbp - 0x30], rax
mov eax, 2
mov dword [rbp - 0x24], eax
mov dword [rbp - 0x20], eax
lea rax, [sym.steam_api64.dll_SteamAPI_ISteamApps_RequestPublisherOwnedAppData]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x30]
and qword [rbp + 0x30], 0
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x1c], 1
lea rdx, [rbp + 0x30]
lea rcx, [0x18005ecd0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbp + 0x30]
test rax, rax
je 0x180061cc6
mov qword [rdi + 0x168], rax
call fcn.1800219f8
mov rcx, qword [rdi + 0x168]
call fcn.18001ec00
mov rsi, qword [0x1801b5c80]
mov r14, qword [rdi + 0x1b0]
test rsi, rsi
je 0x180061d11
inc dword [rsi + 0xf4]
mov ecx, 0xe8
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rbp + 0x30], rax
mov rbx, rax
test rax, rax
je 0x180061d42
xor edx, edx
mov r8d, 0xe8
mov rcx, rax
call fcn.1800965d0
mov qword [rbx + 0x60], 0x100
jmp 0x180061d44
xor ebx, ebx
or dword [rsi + 0xc], 8
lea rax, str.imgui_impl_vulkan
movaps xmm0, xmmword [rbp - 0x60]
movaps xmm1, xmmword [rbp - 0x50]
mov qword [rsi + 0x90], rax
mov rax, qword [rbp + 0x48]
mov qword [rsi + 0xa0], rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x58], r14
movaps xmm0, xmmword [rbp - 0x40]
movups xmmword [rbx + 0x10], xmm1
mov dword [rbx + 0x88], eax
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rbx + 0x20], xmm0
movaps xmm0, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x30], xmm1
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx + 0x40], xmm0
movsd qword [rbx + 0x50], xmm1
call fcn.18001df08
mov rcx, rdi
call fcn.18005d5bc
mov rax, qword [r15 + 0x30]
mov ecx, dword [rax]
lea rax, [rcx + rcx*2]
mov rcx, qword [rdi + 0x1b8]
add rax, rax
mov rcx, qword [rcx + rax*8 + 8]
call fcn.18001d618
mov byte [rdi + 9], 1
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800640b8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [0x1801b5c88]
mov rbx, rcx
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9d, dword [rbx + 0xc]
movabs rdx, 0xcbf29ce484222325
mov dword [rsp + 0x40], r9d
xor r8d, r8d
movzx eax, byte [rsp + r8 + 0x40]
movabs rcx, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, rcx
cmp r8, 4
jb 0x1800640f7
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x20]
and rax, rdx
add rax, rax
mov rdi, qword [rcx + rax*8 + 8]
cmp rdi, qword [rbp + 0x10]
je 0x180064147
mov rcx, qword [rcx + rax*8]
jmp 0x18006413f
cmp rdi, rcx
je 0x180064147
mov rdi, qword [rdi + 8]
cmp r9d, dword [rdi + 0x10]
jne 0x180064136
jmp 0x180064149
xor edi, edi
test rdi, rdi
je 0x1800641d3
cmp rdi, qword [rbp + 0x10]
je 0x1800641d3
mov rdx, qword [rdi + 0x20]
mov rsi, qword [rdi + 0x18]
jmp 0x18006416b
cmp qword [rsi], rbx
je 0x180064170
add rsi, 8
cmp rsi, rdx
jne 0x180064162
cmp rsi, rdx
je 0x1800641b2
lea rax, [rsi + 8]
jmp 0x18006418e
mov rcx, qword [rax]
cmp rcx, rbx
je 0x18006418a
mov qword [rsi], rcx
add rsi, 8
add rax, 8
cmp rax, rdx
jne 0x18006417b
cmp rsi, rdx
je 0x1800641b2
mov rbx, qword [rdi + 0x20]
mov rcx, rsi
sub rbx, rdx
mov r8, rbx
call sub.msvcrt.dll_memmove
lea rax, [rbx + rsi]
mov qword [rdi + 0x20], rax
mov rax, qword [rdi + 0x20]
sub rax, qword [rdi + 0x18]
test rax, 0xfffffffffffffff8
jne 0x1800641d3
lea rcx, [rbp + 8]
mov r8, rdi
lea rdx, [rsp + 0x40]
call fcn.18004316c
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x18006b758
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x30]
mov byte [rax], 0
jmp fcn.180042c58