joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180037e64
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x18005e590
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x128]
lea rcx, [0x1800fd3a7]
call fcn.180037c84
lea rcx, [rbp + 0x100]
call fcn.180037d51
lea r9, [rbp + 4]
mov r8d, 0x40
mov edx, 4
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, 4
lea rdx, [rbp + 0x108]
mov rcx, qword [rbp + 0x100]
call fcn.180036e5b
lea r9, [rbp + 4]
mov r8d, dword [rbp + 4]
mov edx, 4
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp - 0x20]
lea rdx, [0x1800b4710]
call fcn.1800377a7
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x180037eb9
Capabilities:
Check for peb beingdebugged flag

Disassembly:
jmp 0x180066350
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1800fd3aa]
call fcn.180037c84
mov rax, qword gs:[0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov byte [rax + 2], 0
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x180068d10
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rcx, [0x1800fd3aa]
call fcn.180037c84
mov rax, qword [rbp + 0x120]
movzx eax, byte [rax + 0x18]
test eax, eax
je 0x180068d40
jmp 0x180068db7
lea rcx, str._n_n_n___________VVVVVVVVVVVVVVVVVVVVVCCCCCCCCCCCCCCCCCCCCCCCCCC_n_n
call fcn.180036de3
lea rax, str..H1EmuVoiceH1EmuVoice.exe
mov qword [rbp + 8], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 8]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rbp + 0x28], rax
cmp dword [rbp + 0x28], 0x20
jg 0x180068db7
lea rdx, [0x1800ae028]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180036302
mov edx, dword [rbp + 0x28]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x180036127]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x448360
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4484c7
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x448372
cmp edx, ecx
jne 0x4484b5
nop word [rax + rax]
test rsi, rsi
jne 0x4484b5
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x4483cf
nop
call fcn.0046e320
xorps xmm15, xmm15
mov r14, qword fs:[0]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00448280
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x4484b0
mov rdx, qword [0x01953938]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
nop dword [rax + rax]
cmp rdx, rsi
jbe 0x4484a5
mov rcx, qword [0x01953930]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x01956a70]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x01956a70], rax
nop
mov edx, 1
lea rsi, [0x01956a78]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1248]
shr rdx, 0x3d
test dl, dl
jne 0x448493
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1248], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x0071c072]
mov ebx, 0x28
nop
call fcn.00437ba0
mov rax, rsi
mov rcx, rdx
call fcn.0046cda0
call fcn.00436420
lea rax, [0x00719e78]
mov ebx, 0x23
call fcn.00437ba0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046ac80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00448360
Function at 0x458140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x4582b7
movzx edx, byte [rax]
test edx, edx
jne 0x458174
nop dword [rax]
test r8b, r8b
jne 0x458174
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x458187
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x458277
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x458265
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x458257
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x4581dd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x458220
mov eax, 1
cmp rax, rbx
ja 0x45820b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.0046ce60
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x45824f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x458213
mov rcx, r11
mov eax, r12d
jmp 0x4581e2
mov rcx, rbx
call fcn.0046cda0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0046cda0
mov eax, r8d
mov rcx, rbx
call fcn.0046ce60
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x4582ad
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x458270
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x45818d
mov eax, edx
mov rcx, rbx
call fcn.0046cda0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0046cda0
nop
int3
Function at 0x46e0a0
Capabilities:
Execute syscall

Disassembly:
mov edi, dword [rsp + 8]
mov eax, 0xe7
syscall
ret

Function at 0x46e140
Capabilities:
Execute syscall

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov edx, dword [rsp + 0x18]
mov eax, 1
syscall
mov dword [rsp + 0x20], eax
ret

Function at 0x46e160
Capabilities:
Execute syscall

Disassembly:
mov edi, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov edx, dword [rsp + 0x18]
mov eax, 0
syscall
mov dword [rsp + 0x20], eax
ret

Function at 0x46e180
Capabilities:
Execute syscall

Disassembly:
lea rdi, [rsp + 0x10]
mov esi, dword [rsp + 8]
mov eax, 0x125
syscall
mov dword [rsp + 0x18], eax
ret

Function at 0x46e1a0
Capabilities:
Execute syscall

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov edx, 0
mov eax, dword [rsp + 0x20]
mov ecx, 0xf4240
div ecx
mov qword [rsp], rax
mov eax, 0x3e8
mul edx
mov qword [rsp + 8], rax
mov rdi, rsp
mov esi, 0
mov eax, 0x23
syscall
add rsp, 0x10
pop rbp
ret

Function at 0x46e1e0
Capabilities:
Execute syscall

Disassembly:
mov eax, 0xba
syscall
mov dword [rsp + 8], eax
ret

Function at 0x46e200
Capabilities:
Execute syscall

Disassembly:
mov eax, 0x27
syscall
mov r12d, eax
mov eax, 0xba
syscall
mov esi, eax
mov edi, r12d
mov edx, dword [rsp + 8]
mov eax, 0xea
syscall
ret

Function at 0x46e240
Capabilities:
Execute syscall

Disassembly:
mov eax, 0x27
syscall
mov edi, eax
mov esi, dword [rsp + 8]
mov eax, 0x3e
syscall
ret

Function at 0x46e260
Capabilities:
Execute syscall

Disassembly:
mov eax, 0x27
syscall
mov qword [rsp + 8], rax
ret

Function at 0x46e280
Capabilities:
Execute syscall

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov eax, 0xea
syscall
ret

Function at 0x46e2a0
Capabilities:
Execute syscall

Disassembly:
mov edi, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov eax, 0xde
syscall
mov dword [rsp + 0x20], eax
ret

Function at 0x46e2c0
Capabilities:
Execute syscall

Disassembly:
mov edi, dword [rsp + 8]
mov esi, dword [rsp + 0xc]
mov rdx, qword [rsp + 0x10]
mov r10, qword [rsp + 0x18]
mov eax, 0xdf
syscall
mov dword [rsp + 0x20], eax
ret

Function at 0x46e2e0
Capabilities:
Execute syscall

Disassembly:
mov edi, dword [rsp + 8]
mov eax, 0xe2
syscall
mov dword [rsp + 0x10], eax
ret

Function at 0x46e300
Capabilities:
Execute syscall

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov eax, 0x1b
syscall
mov dword [rsp + 0x20], eax
ret

Function at 0x46e420
Capabilities:
Execute syscall

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov r10, qword [rsp + 0x20]
mov eax, 0xd
syscall
mov dword [rsp + 0x28], eax
ret

Function at 0x46e760
Capabilities:
Execute syscall

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov edx, dword [rsp + 0x18]
mov rax, 0x1c
syscall
mov dword [rsp + 0x20], eax
ret
Function at 0x46e780
Capabilities:
Execute syscall

Disassembly:
mov rdi, qword [rsp + 8]
mov esi, dword [rsp + 0x10]
mov edx, dword [rsp + 0x14]
mov r10, qword [rsp + 0x18]
mov r8, qword [rsp + 0x20]
mov r9d, dword [rsp + 0x28]
mov eax, 0xca
syscall
mov dword [rsp + 0x30], eax
ret

Function at 0x46e8e0
Capabilities:
Execute syscall

Disassembly:
mov eax, 0x18
syscall
ret

Function at 0x46e900
Capabilities:
Execute syscall

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov eax, 0xcc
syscall
mov dword [rsp + 0x20], eax
ret
Function at 0xeee0a0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xeee0ad
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xeee0bd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xeee0a5
lea eax, [rcx + 1]
jmp 0xeee0cb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xeee0de
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xeee0c4
sub eax, 3
jb 0xeee0fe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xeee14d
sar eax, 1
movsxd rbp, eax
jb 0xeee134
jmp 0xeee10c
add ebx, ebx
jne 0xeee10a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xeee134
inc ecx
add ebx, ebx
jne 0xeee11a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xeee134
call r11
adc ecx, ecx
add ebx, ebx
jne 0xeee12d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xeee11c
add ecx, 2
jmp 0xeee139
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00eee062
jmp 0xeee0ad
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x4aa600
mov dl, 0xaf
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xeee199
cmp rsi, rcx
jae 0xeee1a1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xeee180
cmp al, 0x8f
ja 0xeee180
cmp byte [rsi - 2], 0xf
je 0xeee186
sub al, 0xe8
cmp al, 1
ja 0xeee16a
cmp rsi, rcx
jae 0xeee1a1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xeee170
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xeee1a1
lodsb al, byte [rsi]
jmp 0xeee180
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xae2000]
mov eax, dword [rdi]
or eax, eax
je 0xeee1fe
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xaee000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xeee1ae
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xeee1f8
mov qword [rbx], rax
add rbx, 8
jmp 0xeee1ce
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xeee242
cmp al, 0xef
ja 0xeee22a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xeee20a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xeee219
mov eax, dword [rdi]
add rdi, 4
jmp 0xeee219
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xeee296
sub rsp, 0xffffffffffffff80
jmp 0x4691e0
Function at 0x140001040
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov edx, 0x47
lea rcx, [entry0]
mov al, byte [rcx + rdx]
xor al, 0x79
add al, 0x45
xor al, 0xe7
mov byte [rcx + rdx], al
inc rdx
cmp rdx, 0x2d9
jl 0x140001068
adc esp, dword [rbx - 0x26]
invalid
Function at 0x140002f80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140002fad
xor eax, eax
jmp 0x140003119
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002fe7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002fe7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140003119
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000310c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000302a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003055
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003111
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400030c4
sub eax, 1
je 0x1400030c4
cmp eax, 2
jne 0x14000310c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003111
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400030f2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000310c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140003111
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003e30
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140003780
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003853
cmp byte [rcx + 0x71], 0
je 0x140003853
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000384f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003814
sub eax, 1
je 0x140003818
cmp eax, 2
jne 0x14000384f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003e30
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003846
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000384f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400037fc
xor al, al
jmp 0x1400037fc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003e30
add rsp, 0x60
pop rbx
ret

Function at 0x1400049b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400049fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400049fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400049fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400049fa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400049fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400049fc
xor al, al
add rsp, 0x28
ret
Function at 0x18008e889
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1800ab9a0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1802555c0]
call fcn.1800910cf
mov qword [rbp + 8], 0
jmp 0x1800ab9de
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x1800aba34
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x1800ab9d3
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x18008f7b1
Capabilities:
Create thread

Disassembly:
jmp 0x1800ad2e0
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x1802568a1]
call fcn.1800910cf
cmp dword [rbp + 0xe8], 1
jne 0x1800ad347
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0xe0]
lea r8, [0x1800904f4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18008fa2c
Capabilities:
Terminate process

Disassembly:
jmp 0x1801a4c80
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1802568a1]
call fcn.1800910cf
mov cl, 1
call fcn.180091084
movzx eax, al
test eax, eax
je 0x1801a4cb7
lea rcx, str.__DEBUG___Il2Cpp_initialized_n
call fcn.18008f6a8
jmp 0x1801a4cd6
lea rcx, str.__DEBUG___Il2Cpp_initialize_failed__quitting...
call fcn.18008f6a8
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x1802428b0], rax
mov rdx, qword [0x1802428b0]
lea rcx, str.__DEBUG___Base_Address:_0x_llX_n
call fcn.18008f6a8
lea rcx, str.GameAssembly.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x1802428b8], rax
mov rdx, qword [0x1802428b8]
lea rcx, str.__DEBUG___GameAssembly_Base_Address:_0x_llX_n
call fcn.18008f6a8
lea rcx, str.UnityPlayer.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x1802428c0], rax
mov rdx, qword [0x1802428c0]
lea rcx, str.__DEBUG___UnityPlayer_Base_Address:_0x_llX_n
call fcn.18008f6a8
lea rcx, str.___________________________________________________________n
call fcn.18008f6a8
lea rcx, [0x1801c6918]
call fcn.18008f6a8
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18008facc
Capabilities:
Terminate process

Disassembly:
jmp 0x1801aa590
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x18008fed7
Capabilities:
Write file on windows

Disassembly:
jmp 0x1800d4850
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x180256174]
call fcn.1800910cf
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x180090062
Capabilities:
Read file on windows

Disassembly:
jmp 0x1800d47e0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x180256174]
call fcn.1800910cf
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18009007b
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1800d4e00
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x180256174]
call fcn.1800910cf
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x1801bc930]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x1800d4f45
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x1800d4e99
mov dword [rbp + 0x160], 1
jmp 0x1800d4ea3
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x1800d4f40
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x1800d4f1a
cmp qword [rbp + 0x198], 2
jb 0x1800d4f1a
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1800d4f1a
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1800d4f1a
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1800d4e64
jmp 0x1800d4fdf
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x1800d4fdf
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x1800d4fb6
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1800d4fb6
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1800d4fb6
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1800d4f45
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret