joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800033d0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movzx r8d, byte [rdx]
movabs rcx, 0x100000001b3
mov r9, qword [0x1803dcc98]
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r10, rdx
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [0x1803dccc0]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [0x1803dcca8]
mov rcx, qword [rdx + 8]
cmp rcx, r9
je 0x180003485
mov rax, qword [r10]
mov r8, qword [rdx]
cmp rax, qword [rcx + 0x10]
je 0x180003487
cmp rcx, r8
je 0x180003485
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x180003474
jmp 0x180003487
xor ecx, ecx
test rcx, rcx
je 0x1800034e5
mov rax, qword [rdx]
cmp qword [rdx + 8], rcx
jne 0x1800034ad
cmp rax, rcx
jne 0x1800034a3
mov qword [rdx], r9
mov qword [rdx + 8], r9
jmp 0x1800034b8
mov r9, qword [rcx + 8]
mov qword [rdx + 8], r9
jmp 0x1800034b8
cmp rax, rcx
jne 0x1800034b8
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
dec qword [0x1803dcca0]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.18039e2a0
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x1800034f0
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
movzx edx, cl
mov r8, rcx
movabs rax, 0xcbf29ce484222325
xor rdx, rax
mov qword [r11 + 8], rcx
movabs rcx, 0x100000001b3
movzx eax, byte [r11 + 9]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xa]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xb]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xc]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xd]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xe]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xf]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [0x1803dccc0]
and rcx, rdx
shl rcx, 4
add rcx, qword [0x1803dcca8]
mov rax, qword [rcx + 8]
cmp rax, qword [0x1803dcc98]
je 0x1800035ad
mov rcx, qword [rcx]
cmp r8, qword [rax + 0x10]
je 0x1800035af
cmp rax, rcx
je 0x1800035ad
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
jne 0x180003597
test rax, rax
setne al
ret
xor eax, eax
test rax, rax
setne al
ret
Function at 0x1800038e0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x180003abd
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1803dcc98]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1803dcca8]
lea rdx, [rdi + rdi]
call fcn.180001990
mov rax, qword [0x1803dcc98]
lea r9, [rdi - 1]
mov qword [0x1803dccc0], r9
mov qword [0x1803dccc8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180003ab2
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1803dcca8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800039fb
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180003a73
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x180003a38
mov r10, qword [rdx]
cmp r10, rax
je 0x180003a32
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180003a73
cmp r9, rdx
je 0x180003a4f
nop dword [rax]
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x180003a87
cmp r9, rdx
jne 0x180003a40
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x180003aad
mov r9, qword [0x1803dccc0]
jmp 0x180003980
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180003a73
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1803766d0
int3
Function at 0x180003b40
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov byte [rbp - 0x40], dl
mov r14, rcx
xor edi, edi
lea rdx, [rcx + 0x10]
lea rcx, [rbp - 0x38]
call fcn.180003db0
lea r8, [rbp - 0x38]
mov rsi, qword [rbp - 0x38]
mov r13, qword [rbp - 0x20]
cmp r13, 0xf
cmova r8, rsi
movabs rbx, 0xcbf29ce484222325
mov r9, rbx
mov ecx, edi
movabs r10, 0x100000001b3
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x180003bc4
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, rdx
jb 0x180003bb0
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x10]
call fcn.1800048e0
mov r15, qword [rax + 8]
cmp r13, 0xf
jbe 0x180003c0c
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x180003c04
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003d6a
mov rcx, rsi
call fcn.18039e2a0
test r15, r15
jne 0x180003d46
lea rdx, [r14 + 0x10]
lea rcx, [rbp - 0x38]
call fcn.180003db0
nop
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x10]
call fcn.180004160
mov rcx, qword [rax]
mov qword [rcx + 0x30], r14
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x180003c72
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003c6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003d70
call fcn.18039e2a0
mov rax, qword [r14]
mov rcx, r14
call qword [rax]
cmp byte [r14 + 0x50], 0
jne 0x180003c8b
cmp byte [rbp - 0x40], 0
je 0x180003d46
lea rdx, [r14 + 0x10]
lea rcx, [rbp - 0x38]
call fcn.180003db0
nop
lea rcx, [rbp - 0x38]
mov rsi, qword [rbp - 0x20]
cmp rsi, 0xf
cmova rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x180003cd3
movabs r8, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdi + rcx]
xor rbx, rax
imul rbx, r8
inc rdi
cmp rdi, rdx
jb 0x180003cc0
mov r9, rbx
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x10]
call fcn.1800048e0
cmp qword [rax + 8], 0
je 0x180003d12
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x10]
call fcn.180003ed0
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x30]
cmp byte [rcx + 8], 0
jne 0x180003d0e
mov byte [rcx + 8], 1
mov rax, qword [rcx]
call qword [rax + 8]
mov rsi, qword [rbp - 0x20]
cmp rsi, 0xf
jbe 0x180003d46
lea rdx, [rsi + 1]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003d41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003d64
call fcn.18039e2a0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1803a53b0
int3
call fcn.1803a53b0
int3
call fcn.1803a53b0
int3
Function at 0x180005200
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov ecx, 0x58
call fcn.18039e2d4
mov rbx, rax
mov qword [rsp + 0x30], rax
lea rdi, vtable.Cheat.0
mov qword [rax], rdi
mov byte [rax + 8], 0
lea rcx, [rax + 0x10]
lea rdx, str.Proxy_Inject
call fcn.180003110
nop
lea rcx, [rbx + 0x30]
lea rdx, str.Injects_a_proxy_server_into_your_server_list.
call fcn.180003110
mov byte [rbx + 0x50], 1
lea rax, vtable.ProxyInject.0
mov qword [rbx], rax
xor edx, edx
mov rcx, rbx
call fcn.180003b40
mov ecx, 0x58
call fcn.18039e2d4
mov rbx, rax
mov qword [rsp + 0x30], rax
mov qword [rax], rdi
mov byte [rax + 8], 0
lea rcx, [rax + 0x10]
lea rdx, str.AC_Disable
call fcn.180003110
nop
lea rcx, [rbx + 0x30]
lea rdx, str.Stops_AC.
call fcn.180003110
mov byte [rbx + 0x50], 1
lea rax, vtable.AnticheatDisable.0
mov qword [rbx], rax
mov dl, 1
mov rcx, rbx
call fcn.180003b40
mov ecx, 0x58
call fcn.18039e2d4
mov rbx, rax
mov qword [rsp + 0x30], rax
mov qword [rax], rdi
mov byte [rax + 8], 0
lea rcx, [rax + 0x10]
lea rdx, str.Auto_Aim
call fcn.180003110
nop
lea rcx, [rbx + 0x30]
lea rdx, str.Automatically_aim_at_and_shoot_enemies.
call fcn.180003110
mov byte [rbx + 0x50], 1
lea rax, vtable.AutoAim.0
mov qword [rbx], rax
mov dl, 1
mov rcx, rbx
call fcn.180003b40
mov ecx, 0x58
call fcn.18039e2d4
mov rbx, rax
mov qword [rsp + 0x30], rax
mov qword [rax], rdi
mov byte [rax + 8], 0
lea rcx, [rax + 0x10]
lea rdx, str.Weapon_Modifications
call fcn.180003110
nop
lea rcx, [rbx + 0x30]
lea rdx, str.Gives_extra_options_for_modifying_certain_weapons.
call fcn.180003110
mov byte [rbx + 0x50], 1
lea rax, vtable.WeaponModifications.0
mov qword [rbx], rax
mov dl, 1
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180003b40
Function at 0x1800064b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x60]
xor r15d, r15d
mov rax, qword [rsp + 0x68]
mov r13, rdx
mov r10, qword [rsp + 0x78]
mov qword [r14], r8
mov qword [r10], rax
mov rax, qword [r14]
cmp rax, r9
je 0x180006675
mov r12, qword [rsp + 0x70]
lea r8d, [r15 + 1]
mov rsi, qword [r10]
mov r9d, 0x3ff
mov r11d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x180006675
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rax]
cmp r8w, dx
jae 0x18000654a
lea eax, [r11 + rcx]
cmp ax, r9w
ja 0x180006695
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x180006560
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x180006560
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x180006573
movzx r9d, al
mov r11d, r15d
mov ebx, r15d
jmp 0x1800065be
mov r9d, eax
cmp eax, 0x800
jae 0x18000658d
shr r9d, 6
mov r11d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x1800065be
cmp eax, 0x10000
jae 0x1800065a7
shr r9d, 0xc
mov r11d, 2
or r9b, 0xe0
mov ebx, r11d
jmp 0x1800065be
shr r9d, 0x12
mov r11d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdi, r12
sub rdi, rsi
mov ecx, r8d
cmp rdi, rcx
jl 0x180006675
test dx, dx
jne 0x180006609
mov rcx, qword [rsp + 0x40]
test byte [rcx + 0x14], 2
je 0x180006609
lea edx, [r8 + 3]
cmp rdi, rdx
jl 0x180006675
mov byte [rsi], 0xef
inc qword [r10]
mov rcx, qword [r10]
mov byte [rcx], 0xbb
inc qword [r10]
mov rcx, qword [r10]
mov byte [rcx], 0xbf
inc qword [r10]
add qword [r14], 2
test bpl, bpl
jne 0x180006618
cmp r11d, 3
jae 0x180006624
mov rcx, qword [r10]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r10]
mov r9, qword [r10]
test r8d, r8d
jle 0x180006650
lea ecx, [r11 + r11*2]
add ecx, ecx
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r10]
mov r9, qword [r10]
test r8d, r8d
jg 0x180006632
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rax, qword [r14]
cmp rax, qword [rsp + 0x58]
jne 0x1800064ff
mov rax, qword [rsp + 0x50]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x48]
mov eax, 2
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180006820
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [rcx + 0x18]
mov rdi, rcx
mov r8, qword [rcx + 0x10]
mov rdx, rcx
cmp rbx, 0xf
jbe 0x180006841
mov rdx, qword [rcx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180006873
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
xor r9, rax
imul r9, r10
cmp rcx, r8
jb 0x180006860
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180008680
cmp qword [rax + 8], 0
je 0x1800068a6
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180007c70
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, qword [0x180562a58]
mov rcx, rdi
cmp rbx, 0xf
jbe 0x1800068b9
mov rcx, qword [rdi]
mov edx, dword [rdi + 0x10]
call rax
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [0x180562a50]
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180007c70
mov rcx, qword [rax]
mov rax, rbx
mov qword [rcx + 0x30], rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180006c90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x180006e21
mov r15, qword [rsp + 0x60]
lea r8d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r9d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x180006e21
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r8w, dx
jae 0x180006d2b
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x180006e48
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x180006d42
mov eax, ecx
add cx, r11w
cmp cx, r9w
ja 0x180006d42
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x180006d55
movzx r9d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x180006da2
mov r9d, eax
cmp eax, 0x800
jae 0x180006d6f
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov r11d, r8d
jmp 0x180006da2
cmp eax, 0x10000
jae 0x180006d89
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov r11d, r10d
jmp 0x180006da2
shr r9d, 0x12
mov r10d, 3
movzx r11d, sil
or r9b, 0xf0
xor r11d, 1
add r11d, r11d
lea r8d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r8d
cmp rdx, rcx
jl 0x180006e21
add qword [r14], 2
test sil, sil
jne 0x180006dc3
cmp r10d, 3
jae 0x180006dcf
mov rcx, qword [rbx]
mov r8d, r11d
mov byte [rcx], r9b
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jle 0x180006dfe
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jg 0x180006de0
shr eax, 0xa
mov r8d, 1
test sil, sil
mov ecx, r8d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x180006cdf
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x180006e2f
Function at 0x180371b00
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1803dc080]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x18], 0xf
mov rbx, rcx
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x50], 4
jbe 0x180371b32
mov rbx, qword [rcx]
lea rax, [rsp + 0x50]
xor edi, edi
mov qword [rsp + 0x30], rax
lea rdx, str.SOFTWAREDECA_Live_Operations_GmbHRotMGExalt
lea rax, [rsp + 0x54]
mov r8, rbx
mov qword [rsp + 0x28], rax
mov rcx, 0xffffffff80000001
lea r9d, [rdi + 0x18]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x180371b75
mov eax, dword [rsp + 0x54]
jmp 0x180371c48
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov r9d, 0x400
mov qword [rsp + 0x20], rcx
mov r8d, eax
mov ecx, 0x1300
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rdx, qword [rsp + 0x40]
lea r8, str.Error
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, str.SOFTWAREDECA_Live_Operations_GmbHRotMGExalt
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
test eax, eax
je 0x180371c44
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x28], edi
mov r9d, 0x400
mov qword [rsp + 0x20], rdx
mov r8d, eax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rdx, qword [rsp + 0x40]
lea r8, str.Error
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18039e280
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x180372a90
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180372cb0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180372b97
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180372af4
mov rax, qword [0x1803dc008]
cmp qword [rsp + 0x20], rax
ja 0x180372af4
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180372ab6
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1803c3640
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180372b23
jmp 0x180372b97
cmp dword [rsp + 0x50], 0x10000
jne 0x180372b7a
cmp qword [rsp + 0x48], 0x10000
jb 0x180372b7a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180372b68
mov rax, qword [rsp + 0x28]
jmp 0x180372b99
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180372b92
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180372cb0
mov qword [rsp + 0x20], rax
jmp 0x180372ab6
xor eax, eax
add rsp, 0x68
ret

Function at 0x180372ba0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180372cf0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180372ca3
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180372bfb
mov rax, qword [0x1803dc008]
cmp qword [rsp + 0x20], rax
ja 0x180372bfb
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180372bbd
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1803c3640
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180372c2a
jmp 0x180372ca3
cmp dword [rsp + 0x50], 0x10000
jne 0x180372c81
cmp qword [rsp + 0x48], 0x10000
jb 0x180372c81
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180372c6f
mov rax, qword [rsp + 0x28]
jmp 0x180372ca5
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180372c9e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180372cf0
mov qword [rsp + 0x20], rax
jmp 0x180372bbd
xor eax, eax
add rsp, 0x68
ret
Function at 0x180372d40
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1803732d0
mov qword [rsp + 0x28], 0
cmp qword [0x1803dde38], 0
jne 0x180372d88
cmp qword [0x1803dde30], 0
je 0x180372d88
mov rax, qword [0x1803dde30]
mov qword [0x1803dde38], rax
cmp qword [0x1803dde38], 0
je 0x180372e2e
mov rax, qword [0x1803dde38]
cmp qword [rax + 0x10], 0
je 0x180372e2e
mov rax, qword [0x1803dde38]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180372e2e
mov rax, qword [0x1803dde38]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180372e2e
mov rax, qword [0x1803dde38]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180372df4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x180372dfb
xor eax, eax
jmp 0x180372fa9
mov rax, qword [0x1803dde38]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call fcn.1803c3640
mov rax, qword [rsp + 0x28]
jmp 0x180372fa9
mov rax, qword [0x1803dde30]
mov qword [0x1803dde38], rax
jmp 0x180372e50
mov rax, qword [0x1803dde38]
mov rax, qword [rax + 8]
mov qword [0x1803dde38], rax
cmp qword [0x1803dde38], 0
je 0x180372e9d
cmp qword [0x1803dde38], 0
je 0x180372e9b
mov rax, qword [0x1803dde38]
cmp qword [rax + 0x10], 0
je 0x180372e9b
mov rax, qword [0x1803dde38]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180372e9b
mov rax, qword [0x1803dde38]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180372e9b
jmp 0x180372dcc
jmp 0x180372e3e
mov rcx, qword [rsp + 0x60]
call fcn.180375150
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180372fb0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180372fa7
mov rax, qword [rsp + 0x48]
mov qword [0x1803dde38], rax
mov rax, qword [0x1803dde38]
mov dword [rax], 0x52727464
mov rax, qword [0x1803dde38]
mov qword [rax + 0x10], 0
mov rax, qword [0x1803dde38]
mov rcx, qword [0x1803dde30]
mov qword [rax + 8], rcx
mov rax, qword [0x1803dde38]
mov qword [0x1803dde30], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x1803dde38]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180372f58
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180372f92
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x180372f4e
mov rax, qword [0x1803dde38]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x180372dcc
xor eax, eax
add rsp, 0x58
ret
Function at 0x180393540
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x18037fb46
movzx eax, byte [rcx + rdx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x18037fb29
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x18037fb14