joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004dde8
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004de00
Capabilities:
Delete file

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004de24
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x50
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004de3c
Capabilities:
Delete file

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004dea8
Capabilities:
Write file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004decc
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004def0
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004df14
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x40
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004df50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.10.virtual_32

Function at 0x18004dfe0
Capabilities:
Read file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.10.virtual_24

Function at 0x18004e0f4
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004e130
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x38
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004e148
Capabilities:
Delete file

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004e160
Capabilities:
Delete file

Disassembly:
sub rcx, 0x38
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004e19c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004e1d8
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004e1fc
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004e220
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004e244
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x48
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004e2e0
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.10.virtual_24

Function at 0x18004e430
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004e46c
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x40
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004e484
Capabilities:
Delete file

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004e4a8
Capabilities:
Delete file

Disassembly:
sub rcx, 0x40
jmp method.IMySteamRemoteStorage.6.virtual_24
Function at 0x18004e4f0
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x10
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004e52c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004e550
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x30
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004e58c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x50
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004e730
Capabilities:
Read file on windows

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004e790
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004e79c
Capabilities:
Delete file

Disassembly:
sub rcx, 8
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004e7c0
Capabilities:
Read file on windows

Disassembly:
sub rcx, 0x48
jmp method.IMySteamRemoteStorage.7.virtual_16

Function at 0x18004e7d8
Capabilities:
Delete file

Disassembly:
sub rcx, 0x28
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004e808
Capabilities:
Delete file

Disassembly:
sub rcx, 0x48
jmp method.IMySteamRemoteStorage.6.virtual_24

Function at 0x18004e868
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x18
jmp method.IMySteamRemoteStorage.7.virtual_0

Function at 0x18004e88c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x20
jmp method.IMySteamRemoteStorage.2.virtual_56

Function at 0x18004e8b0
Capabilities:
Write file on windows

Disassembly:
sub rcx, 0x38
jmp method.IMySteamRemoteStorage.7.virtual_0
Function at 0x180052f30
Capabilities:
Check if file exists
Create directory

Disassembly:
push rbx
sub rsp, 0x240
lea rdx, [rsp + 0x130]
sub rdx, rcx
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x180052f44
mov edx, 0x5c
lea rcx, [rsp + 0x130]
call qword [sym.imp.msvcrt.dll_strrchr]
mov edx, 0x2f
lea rcx, [rsp + 0x130]
mov rbx, rax
call qword [sym.imp.msvcrt.dll_strrchr]
cmp rax, rbx
cmova rbx, rax
test rbx, rbx
je 0x180053016
lea rdx, [0x1800cd204]
mov byte [rbx + 1], 0
lea rcx, [rsp + 0x130]
call qword [sym.imp.msvcrt.dll_strtok]
mov byte [rsp + 0x20], 0
jmp 0x18005300e
lea rcx, [rsp + 0x20]
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x180052fb1
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x180052fbb
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x180052fe5
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [rsp + 0x20]
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x180052fed
movzx eax, word [0x1800cd208]
lea rdx, [0x1800cd20c]
mov word [rcx], ax
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_strtok]
mov r8, rax
test rax, rax
jne 0x180052fa9
add rsp, 0x240
pop rbx
ret
Function at 0x180055738
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_0

Function at 0x180055c18
Capabilities:
Get common file path

Disassembly:
sub rcx, 0x10
jmp method.IMySteamApps.3.virtual_144

Function at 0x180055c84
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_16

Function at 0x180055df8
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_8

Function at 0x180056050
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_0

Function at 0x1800564a0
Capabilities:
Get common file path

Disassembly:
sub rcx, 0x18
jmp method.IMySteamApps.3.virtual_144

Function at 0x180056638
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_8

Function at 0x1800568fc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.3.virtual_192

Function at 0x1800569c8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.3.virtual_184

Function at 0x180056b9c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.virtual_0

Function at 0x1800570d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.virtual_32

Function at 0x180057334
Capabilities:
Get common file path

Disassembly:
sub rcx, 8
jmp method.IMySteamApps.3.virtual_144

Function at 0x180057388
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_16
Function at 0x18005a3e8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, rdx
mov rsi, rcx
mov ecx, 0x20
call fcn.180095ca0
mov r8, qword [rbx]
mov qword [rax], r8
mov r8, qword [0x1801b9388]
mov qword [rax + 8], r8
movups xmm0, xmmword [rdi]
movdqu xmmword [rax + 0x10], xmm0
mov qword [rsp + 0x50], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x18005a494]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x18005a46a
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call fcn.18009465c
int3
Function at 0x18005b474
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
call fcn.18005d7c4
nop
lea rsi, [rdi + 0xc0]
mov rcx, rsi
call fcn.180080c1c
nop
lea rax, vtable.GlRender.0
mov qword [rdi], rax
lea rax, vtable.GlRender.1.0
mov qword [rsi], rax
lea rbx, [rdi + 0x168]
mov qword [rbp + 0x48], rbx
and dword [rbp + 0x40], 0
mov eax, dword [rbp + 0x40]
mov dword [rbx], eax
and qword [rbx + 8], 0
and qword [rbx + 0x10], 0
mov ecx, 0x60
call fcn.180095ca0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x18]
and qword [rcx], 0
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
mov qword [rbx + 0x30], 7
mov qword [rbx + 0x38], 8
mov dword [rbx], 0x3f800000
mov r8, qword [rbx + 8]
mov edx, 0x10
call fcn.18000d9ec
nop
mov byte [rbp - 0x10], 0x7c
mov byte [rbp - 0xf], 0x6c
mov byte [rbp - 0xe], WSACleanup
mov byte [rbp - 0xd], 0x58
mov byte [rbp - 0xc], 0x7c
mov byte [rbp - 0xb], 0x66
mov byte [rbp - 0xa], 0x75
mov byte [rbp - 9], 0x47
mov byte [rbp - 8], 0x7a
mov byte [rbp - 7], 0x6b
mov byte [rbp - 6], 0x6b
mov byte [rbp - 5], 0x6a
mov byte [rbp - 4], 0x77
mov byte [rbp - 3], 0x78
mov byte [rbp - 2], 0
mov al, byte [rbp - 0x10]
xor edx, edx
mov al, byte [rbp + rdx - 0x10]
sub al, 5
mov byte [rbp + rdx - 0x10], al
inc rdx
cmp rdx, 0xe
jb 0x18005b561
lea rdx, [rbp - 0x10]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18005b5ae
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005b338]
mov rdx, rax
mov rcx, rsi
call fcn.18007c138
mov qword [0x1801b9398], rdi
mov byte [rdi + 8], 1
mov rax, rdi
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18005cd80
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdx, qword [0x1801b8ba0]
mov rdi, rcx
mov r8d, dword [rdx + 0x128]
sub r8d, 1
je 0x18005cf31
cmp r8d, 1
jne 0x18005cf4f
mov byte [rbp - 0x20], 0x48
xor ebx, ebx
mov byte [rbp - 0x1f], WSASetLastError
mov ecx, ebx
mov byte [rbp - 0x1e], 0x77
mov byte [rbp - 0x1d], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1c], 0x65
mov byte [rbp - 0x1b], 0x78
mov byte [rbp - 0x1a], 0x67
mov byte [rbp - 0x19], 0x6c
mov byte [rbp - 0x18], 0x51
mov byte [rbp - 0x17], 0x69
mov byte [rbp - 0x16], 0x77
mov byte [rbp - 0x15], 0x77
mov byte [rbp - 0x14], 0x65
mov byte [rbp - 0x13], 0x6b
mov byte [rbp - 0x12], 0x69
mov byte [rbp - 0x11], 0x45
mov byte [rbp - 0x10], bl
mov al, byte [rbp - 0x20]
mov al, byte [rbp + rcx - 0x20]
sub al, 4
mov byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x10
jb 0x18005ce01
mov byte [rbp + 0x18], 0x60
mov rcx, rbx
mov byte [rbp + 0x19], 0x7e
mov byte [rbp + 0x1a], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp + 0x1b], 0x7d
mov byte [rbp + 0x1c], 0x3e
mov byte [rbp + 0x1d], 0x3d
mov byte [rbp + 0x1e], bl
mov al, byte [rbp + 0x18]
mov al, byte [rbp + rcx + 0x18]
sub al, 0xb
mov byte [rbp + rcx + 0x18], al
inc rcx
cmp rcx, 6
jb 0x18005ce35
lea r8, [rbp - 0x20]
mov rcx, rdi
lea rdx, [rbp + 0x18]
call fcn.180081490
mov rdx, rax
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005c93c]
mov rcx, rdi
call fcn.18007c138
mov byte [rbp - 0x20], 0x47
mov rcx, rbx
mov byte [rbp - 0x1f], 0x6c
mov byte [rbp - 0x1e], 0x76
mov byte [rbp - 0x1d], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x1c], 0x64
mov byte [rbp - 0x1b], 0x77
mov byte [rbp - 0x1a], 0x66
mov byte [rbp - 0x19], 0x6b
mov byte [rbp - 0x18], 0x50
mov byte [rbp - 0x17], 0x68
mov byte [rbp - 0x16], 0x76
mov byte [rbp - 0x15], 0x76
mov byte [rbp - 0x14], 0x64
mov byte [rbp - 0x13], 0x6a
mov byte [rbp - 0x12], 0x68
mov byte [rbp - 0x11], 0x5a
mov byte [rbp - 0x10], bl
mov al, byte [rbp - 0x20]
mov al, byte [rbp + rcx - 0x20]
sub al, 3
mov byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x10
jb 0x18005cebe
mov byte [rbp + 0x18], 0x5c
mov byte [rbp + 0x19], 0x7a
mov byte [rbp + 0x1a], 0x6c
mov byte [rbp + 0x1b], 0x79
mov byte [rbp + 0x1c], 0x3a
mov byte [rbp + 0x1d], 0x39
mov byte [rbp + 0x1e], bl
mov al, byte [rbp + 0x18]
mov al, byte [rbp + rbx + 0x18]
sub al, 7
mov byte [rbp + rbx + 0x18], al
inc rbx
cmp rbx, 6
jb 0x18005ceef
lea r8, [rbp - 0x20]
mov rcx, rdi
lea rdx, [rbp + 0x18]
call fcn.180081490
mov rdx, rax
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005c93c]
mov rcx, rdi
call fcn.18007c138
jmp 0x18005cf4f
xor r9d, r9d
lea rdx, [0x18005c4d4]
xor r8d, r8d
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x1801b9900], rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x180062548
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
cmp byte [rcx + 9], 0
mov r15, r8
mov rdi, rcx
jne 0x180062703
cmp qword [rcx + 0x178], 0
je 0x180062703
and qword [rbp + 0x30], 0
lea r8, [rbp + 0x30]
call fcn.1800630c8
and qword [rbp - 0x38], 0
xor eax, eax
mov dword [rbp - 0x44], eax
mov qword [rbp + 0x48], rax
mov dword [rbp - 0x28], eax
mov qword [rbp - 0x18], rax
mov rax, qword [rdi + 0x170]
mov qword [rbp - 0x60], rax
mov rax, qword [rdi + 0x180]
mov qword [rbp - 0x58], rax
mov rax, qword [rdi + 0x178]
mov qword [rbp - 0x50], rax
mov eax, dword [rdi + 0x190]
mov dword [rbp - 0x48], eax
mov rax, qword [rdi + 0x188]
mov qword [rbp - 0x30], rax
mov eax, 2
mov dword [rbp - 0x24], eax
mov dword [rbp - 0x20], eax
lea rax, [sym.steam_api64.dll_SteamAPI_ISteamApps_RequestPublisherOwnedAppData]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x30]
and qword [rbp + 0x30], 0
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x1c], 1
lea rdx, [rbp + 0x30]
lea rcx, [0x18005f614]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbp + 0x30]
test rax, rax
je 0x1800625fe
mov qword [rdi + 0x168], rax
call fcn.180022120
mov rcx, qword [rdi + 0x168]
call fcn.18001f34c
mov rsi, qword [0x1801b8db0]
mov r14, qword [rdi + 0x1b0]
test rsi, rsi
je 0x180062649
inc dword [rsi + 0xf4]
mov ecx, 0xe8
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rbp + 0x30], rax
mov rbx, rax
test rax, rax
je 0x18006267a
xor edx, edx
mov r8d, 0xe8
mov rcx, rax
call fcn.180097bb0
mov qword [rbx + 0x60], 0x100
jmp 0x18006267c
xor ebx, ebx
or dword [rsi + 0xc], 8
lea rax, str.imgui_impl_vulkan
movaps xmm0, xmmword [rbp - 0x60]
movaps xmm1, xmmword [rbp - 0x50]
mov qword [rsi + 0x90], rax
mov rax, qword [rbp + 0x48]
mov qword [rsi + 0xa0], rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x58], r14
movaps xmm0, xmmword [rbp - 0x40]
movups xmmword [rbx + 0x10], xmm1
mov dword [rbx + 0x88], eax
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rbx + 0x20], xmm0
movaps xmm0, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x30], xmm1
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx + 0x40], xmm0
movsd qword [rbx + 0x50], xmm1
call fcn.18001e654
mov rcx, rdi
call fcn.18005dee8
mov rax, qword [r15 + 0x30]
mov ecx, dword [rax]
lea rax, [rcx + rcx*2]
mov rcx, qword [rdi + 0x1b8]
add rax, rax
mov rcx, qword [rcx + rax*8 + 8]
call fcn.18001dd64
mov byte [rdi + 9], 1
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18006480c
Capabilities:
Get common file path
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov byte [rbp - 0x10], 0x5e
xor ecx, ecx
mov byte [rbp - 0xf], 0x7f
mov byte [rbp - 0xe], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0xd], 0x6c
mov byte [rbp - 0xc], 0x78
mov byte [rbp - 0xb], 0x5b
mov byte [rbp - 0xa], 0x6c
mov byte [rbp - 9], 0x7f
mov byte [rbp - 8], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 7], 0
mov al, byte [rbp - 0x10]
mov al, byte [rbp + rcx - 0x10]
sub al, 0xb
mov byte [rbp + rcx - 0x10], al
inc rcx
cmp rcx, 9
jb 0x180064842
mov r8d, 0x104
lea rdx, [0x1801bd2e0]
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x180064882
lea rdx, [0x1801bd2e0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rax, [0x1801bd2e0]
add rsp, 0x30
pop rbp
ret

Function at 0x180064a80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [0x1801b8db8]
mov rbx, rcx
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9d, dword [rbx + 0xc]
movabs rdx, 0xcbf29ce484222325
mov dword [rsp + 0x40], r9d
xor r8d, r8d
movzx eax, byte [rsp + r8 + 0x40]
movabs rcx, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, rcx
cmp r8, 4
jb 0x180064abf
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x20]
and rax, rdx
add rax, rax
mov rdi, qword [rcx + rax*8 + 8]
cmp rdi, qword [rbp + 0x10]
je 0x180064b0f
mov rcx, qword [rcx + rax*8]
jmp 0x180064b07
cmp rdi, rcx
je 0x180064b0f
mov rdi, qword [rdi + 8]
cmp r9d, dword [rdi + 0x10]
jne 0x180064afe
jmp 0x180064b11
xor edi, edi
test rdi, rdi
je 0x180064b9b
cmp rdi, qword [rbp + 0x10]
je 0x180064b9b
mov rdx, qword [rdi + 0x20]
mov rsi, qword [rdi + 0x18]
jmp 0x180064b33
cmp qword [rsi], rbx
je 0x180064b38
add rsi, 8
cmp rsi, rdx
jne 0x180064b2a
cmp rsi, rdx
je 0x180064b7a
lea rax, [rsi + 8]
jmp 0x180064b56
mov rcx, qword [rax]
cmp rcx, rbx
je 0x180064b52
mov qword [rsi], rcx
add rsi, 8
add rax, 8
cmp rax, rdx
jne 0x180064b43
cmp rsi, rdx
je 0x180064b7a
mov rbx, qword [rdi + 0x20]
mov rcx, rsi
sub rbx, rdx
mov r8, rbx
call sub.msvcrt.dll_memmove
lea rax, [rbx + rsi]
mov qword [rdi + 0x20], rax
mov rax, qword [rdi + 0x20]
sub rax, qword [rdi + 0x18]
test rax, 0xfffffffffffffff8
jne 0x180064b9b
lea rcx, [rbp + 8]
mov r8, rdi
lea rdx, [rsp + 0x40]
call fcn.180043a08
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x18006c20c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x30]
mov byte [rax], 0
jmp fcn.1800435ac
Function at 0x18006e1bc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, rdx
mov r14, rcx
xor edi, edi
xor ebx, ebx
xor esi, esi
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
jne 0x18006e25d
cmp esi, edi
jne 0x18006e211
lea r15d, [rdi + 0x3e8]
mov edx, edi
mov r8d, r15d
mov rcx, rbx
call fcn.18006c6c0
test rax, rax
je 0x18006e299
mov rbx, rax
mov edi, r15d
call qword [sym.imp.msvcrt.dll__errno]
movsxd rcx, esi
mov r9, r14
add rcx, rbx
mov edx, 1
and dword [rax], 0
mov eax, edi
sub eax, esi
movsxd r8, eax
call qword [sym.imp.msvcrt.dll_fread]
mov rcx, r14
mov r15, rax
call qword [sym.imp.msvcrt.dll_ferror]
test eax, eax
jne 0x18006e2a2
mov rcx, r14
add esi, r15d
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
je 0x18006e1ea
cmp esi, edi
jne 0x18006e2e0
lea r8d, [rdi + 1]
mov edx, edi
mov rcx, rbx
call fcn.18006c6c0
test rax, rax
jne 0x18006e2dd
lea r8, [0x1801b48d8]
mov edx, 0xc8
mov rcx, rbp
call fcn.180044844
test rbx, rbx
je 0x18006e295
mov rax, qword [fcn.18009a288]
mov rcx, rbx
call rax
xor eax, eax
jmp 0x18006e309
lea r8, [0x1801b4900]
jmp 0x18006e277
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0
je 0x18006e2bd
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.msvcrt.dll_strerror]
jmp 0x18006e2c4
lea rax, str.Error_reading_file
mov r9, rax
lea r8, [0x1801b46e4]
mov edx, 0xc8
mov rcx, rbp
call fcn.180044844
jmp 0x18006e284
mov rbx, rax
movsxd rax, esi
mov rdx, rbp
mov rcx, rbx
mov byte [rax + rbx], 0
call fcn.18006da94
mov rdi, rax
test rbx, rbx
je 0x18006e306
mov rdx, qword [fcn.18009a288]
mov rcx, rbx
call rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x18006f588
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov rdi, qword [0x1801b9578]
mov rsi, rdx
mov rbx, qword [rdi + 8]
test rbx, rbx
jne 0x18006f605
mov r9d, 0x4f4e4554
lea r8, [0x180117130]
mov edx, 0x2728e
mov ecx, dword [r8]
mov eax, ecx
xor eax, r9d
mov r9d, ecx
mov dword [r8], eax
lea r8, [r8 + 4]
sub rdx, 1
jne 0x18006f5c1
mov edx, 0x4e078
mov ecx, 1
call qword [sym.imp.msvcrt.dll_calloc]
mov rbx, rax
test rax, rax
je 0x18006f621
and dword [rax + 0x70], 0
mov rcx, rax
call fcn.180074378
test eax, eax
je 0x18006f618
mov qword [rdi + 8], rbx
mov rdx, rsi
mov rcx, rbx
call fcn.180075da8
test eax, eax
je 0x18006f628
xor al, al
jmp 0x18006f680
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
and qword [rdi + 8], 0
jmp 0x18006f614
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x40]
call fcn.180076584
mov rdi, rax
test eax, eax
jle 0x18006f67e
lea rdx, [0x1800ce3c8]
lea rcx, [0x1801b9dc0]
call qword [sym.imp.msvcrt.dll_fopen]
mov rcx, qword [rsp + 0x40]
mov r8d, 1
mov r9, rax
movsxd rdx, edi
mov rbx, rax
call fcn.1800a34f0
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_fclose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_free]
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18006f690
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
lea rbx, [0x1800ceeb0]
mov r9d, ecx
not r9d
cmp r8, 4
jb 0x18006f6e2
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
xor r11d, r11d
movzx ecx, byte [rdx + r11]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc r11
xor r9d, dword [rbx + rax*4]
cmp r11, 4
jl 0x18006f6b9
add rdx, 4
sub r10, 1
jne 0x18006f6b6
test r8, r8
je 0x18006f704
movzx ecx, byte [rdx]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc rdx
xor r9d, dword [rbx + rax*4]
sub r8, 1
jne 0x18006f6e7
mov rbx, qword [rsp + 8]
not r9d
mov eax, r9d
ret
Function at 0x1800788bc
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
and qword [rcx + 8], 0
lea rax, vtable.MemoryAllocator.0
mov rbx, r8
mov qword [rcx], rax
and rbx, 0xfffffffffffff000
mov rsi, rdx
test r8, r8
mov rdi, rcx
cmove rbx, r8
add rbx, 0x1000
mov r9d, 0x40
mov rcx, rbx
mov r8d, 0x3000
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rdi + 8], rax
test rax, rax
je 0x1800788f1
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret