joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802423d0
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rcx + 8]
jmp 0x1802423d0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor ebp, ebp
mov byte [rcx + 0x30], 1
mov rsi, 0xffffffffffffffff
mov r10d, ebp
mov r9, rsi
mov rbx, rdx
mov r14, rcx
nop dword [rax + rax]
inc r9
cmp byte [rdx + r9], bpl
jne 0x180242400
add r9, rbx
cmp rbx, r9
je 0x180242456
mov r11, rbx
nop dword [rax]
nop dword [rax + rax]
movzx r8d, byte [r11]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r11
movsx eax, cl
add eax, r10d
imul r10d, eax, 0x401
mov eax, r10d
shr eax, 6
xor r10d, eax
cmp r11, r9
jne 0x180242420
mov rcx, qword [0x1803cd030]
lea edi, [r10 + r10*8]
call fcn.18025f340
mov r8, qword [0x1803cd030]
mov eax, edi
shr eax, 0xb
xor eax, edi
imul edx, eax, 0x8001
mov ecx, dword [r8 + 8]
mov rax, qword [r8 + 0x10]
mov dword [rax + rcx*8], edx
inc dword [r8 + 8]
mov rdx, qword [0x1803cd030]
mov ecx, dword [rdx + 8]
mov rax, qword [rdx + 0x10]
mov dword [rax + rcx*8], 0x57de404e
inc dword [rdx + 8]
mov rdx, qword [0x1803cd030]
mov ecx, dword [rdx + 8]
mov rax, qword [rdx + 0x10]
mov dword [rax + rcx*8], 1
inc dword [rdx + 8]
movabs rdx, 0xc27009422fcca88d
mov rcx, qword [0x1803cd030]
call fcn.18025f4a0
mov rax, qword [0x1803cd030]
xorps xmm0, xmm0
mov r8, rsi
mov rcx, qword [rax]
mov edi, dword [rcx]
mov dword [r14 + 0x34], edi
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
inc r8
cmp byte [rbx + r8], bpl
jne 0x1802424f4
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1800bdea0
mov rcx, qword [0x18041b098]
lea rdx, [rsp + 0x30]
call fcn.18012e1b0
mov r9d, eax
nop
inc rsi
cmp byte [rbx + rsi], bpl
jne 0x180242520
add rsi, rbx
cmp rbx, rsi
je 0x180242563
movzx r8d, byte [rbx]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc rbx
movsx eax, cl
add eax, ebp
imul ebp, eax, 0x401
mov eax, ebp
shr eax, 6
xor ebp, eax
cmp rbx, rsi
jne 0x180242531
lea eax, [rbp*8]
mov dword [rsp + 0x28], 1
add eax, ebp
mov dword [rsp + 0x20], edi
mov ecx, eax
mov edx, 0x57de404e
shr ecx, 0xb
xor ecx, eax
imul r8d, ecx, 0x8001
mov rcx, qword [0x18041b098]
call fcn.18012f6e0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
mov byte [r14 + 0x30], 0
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1802482b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x50]
mov rcx, qword [0x18041b098]
call fcn.18012e7b0
nop
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1802482f5
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.18013f3b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r10, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae r10, qword [rsp + 0x30]
xor r9d, r9d
mov r11, qword [rsp + 0x40]
add r11, r10
cmp r10, r11
je 0x180248396
nop word [rax + rax]
movzx r8d, byte [r10]
lea edx, [r8 - 0x41]
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
inc r10
cmp r10, r11
jne 0x180248360
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
mov r8d, 1
mov edx, edi
call fcn.180204b50
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1802483f5
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1802483f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1802483f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18026980c
movdqa xmm0, xmmword [0x18029c040]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x180248449
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180248443
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180248443
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18026980c
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x18024847f
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18024847a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1802484b0
mov rcx, r8
call fcn.18026980c
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180269d00
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x18025c700
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r11, [0x1802a14c8]
xor r9d, r9d
lea r10, str.freemode
nop word [rax + rax]
movzx r8d, byte [r10]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r10
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
cmp r10, r11
jne 0x18025c720
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
call fcn.1800e4110
test al, al
je 0x18025c78c
movsxd rax, dword [rbx + 8]
lea rcx, [rsp + 0x38]
add rax, 0x1cc508
mov qword [rsp + 0x38], rax
call fcn.180165410
mov byte [rax], 1
add rsp, 0x20
pop rbx
ret
Function at 0x18025f090
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov r11, rdx
movzx eax, byte [r8 + 1]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
imul r9, rcx
xor r9, rax
imul r9, rcx
and rdx, r9
mov r9, qword [r10 + 8]
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, r9
je 0x18025f14e
mov rcx, qword [r8]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x18025f150
cmp rax, rdx
je 0x18025f14e
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x18025f131
test rax, rax
cmove rax, r9
mov qword [r11], rax
mov rax, r11
ret
xor eax, eax
test rax, rax
cmove rax, r9
mov qword [r11], rax
mov rax, r11
ret

Function at 0x18025f350
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
lea rsi, [0x1802df250]
xor r14d, r14d
lea rbp, [rcx + 0x410]
lea r15, str.Failed_to_find_scrCommand_0x:X
mov rax, qword [section..data]
mov rdi, qword [rsi + 8]
movzx edx, dil
mov rcx, qword [rax]
mov r8, qword [rcx + rdx*8]
test r8, r8
je 0x18025f450
nop
lea ebx, [r8 + 0x48]
mov r11d, r14d
xor ebx, dword [r8 + 0x4c]
xor ebx, dword [r8 + 0x48]
jbe 0x18025f415
nop dword [rax]
nop word [rax + rax]
mov eax, r11d
mov qword [rsp + 0x58], r14
shl eax, 4
lea r9, [rsp + 0x58]
mov ecx, eax
mov dl, 2
add rax, 0x54
add rax, r8
sub r9, rax
mov r10d, dword [rcx + r8 + 0x5c]
xor r10, rax
nop word [rax + rax]
mov ecx, r10d
xor ecx, dword [rax]
mov dword [r9 + rax], ecx
lea rax, [rax + 4]
add dl, 0xff
jne 0x18025f3f0
cmp qword [rsp + 0x58], rdi
je 0x18025f493
inc r11d
cmp r11d, ebx
jb 0x18025f3c0
mov rdx, r8
mov qword [rsp + 0x58], r14
xor rdx, qword [r8 + 8]
lea r9, [rsp + 0x58]
sub r9, r8
mov cl, 2
nop dword [rax + rax]
mov eax, edx
xor eax, dword [r8]
mov dword [r9 + r8], eax
lea r8, [r8 + 4]
add cl, 0xff
jne 0x18025f430
mov r8, qword [rsp + 0x58]
test r8, r8
jne 0x18025f3a0
mov rcx, r14
mov qword [rsp + 0x58], rcx
lea r9, [rsp + 0x58]
mov rcx, rbp
lea rdx, [rsp + 0x20]
mov r8, rsi
call fcn.18025ee00
add rsi, 0x10
cmp rsi, r15
jne 0x18025f380
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov eax, r11d
mov rcx, qword [r8 + rax*8 + 0x10]
jmp 0x18025f453
Function at 0x180260ee0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.180261090
mov r9, qword [rbx]
mov rdi, rax
shl rdi, 0x20
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x180260f51
lea r8, [r9 + 8]
nop
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x180260f10
mov ecx, dword [r9]
jmp 0x180261034
cmp ecx, 0x4e0
jb 0x180261034
lea r10, [r9 + 0x9c4]
mov ebx, 0xe3
mov r11d, dword [r10]
nop dword [rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x180260f70
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x180260fc0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov rbx, qword [rsp + 0x30]
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
or rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x180261090
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1802610f1
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1802610b0
mov ecx, dword [r9]
jmp 0x1802611d8
cmp ecx, 0x4e0
jb 0x1802611d8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x180261110
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x180261160
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
add rsp, 8
ret
Function at 0x180261220
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov ebp, r9d
mov r15, r8
mov r14, rdx
mov rsi, rcx
call fcn.180261090
mov rdi, rax
add ebp, 0xffffffff
je 0x1802613fa
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r12
xor r12d, r12d
nop word [rax + rax]
mov r9, qword [rsi]
shl rdi, 0x20
mov ecx, dword [r9]
cmp ecx, 0x270
jne 0x1802612c4
lea rax, [r9 + 8]
mov r10d, ecx
nop dword [rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r10, 1
jne 0x180261280
mov ecx, dword [r9]
jmp 0x1802613a3
cmp ecx, 0x4e0
jb 0x1802613a3
lea r10, [r9 + 0x9c4]
mov r11d, 0xe3
mov ebx, dword [r10]
mov eax, ebx
mov ebx, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, ebx
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub r11, 1
jne 0x1802612e0
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov ebx, dword [r10]
nop word [rax + rax]
mov eax, ebx
mov ebx, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, ebx
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub r11, 1
jne 0x180261330
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
mov ecx, r12d
mov dword [r9], r12d
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r9], eax
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
xor rdx, rax
mov rcx, rdx
shr rcx, 0x12
xor rcx, rdx
or rdi, rcx
add ebp, 0xffffffff
jne 0x180261260
mov r12, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rax, r15
mul rdi
mov qword [r14], rax
mov rax, r14
mov qword [r14 + 8], rdx
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180267050
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x28
ret
Function at 0x180268cac
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180268d30
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180316550]
cmp byte [rcx + rax], 0
je 0x180268d30
dec r8
sub rdx, 1
jne 0x180268d16
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x180274f20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov edx, dword [rcx]
mov r9d, 0x138
mov r10, rcx
xorps xmm1, xmm1
cmp edx, r9d
jne 0x180274f92
lea r8, [rcx + 0x10]
movabs r11, 0xb5026f5aa96619e9
nop word [rax + rax]
mov edx, dword [r8 - 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x180274f50
mov edx, dword [r10]
jmp 0x180275093
cmp edx, 0x270
jb 0x180275093
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [rcx + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
mov rdx, qword [rbx + 8]
lea r8, [rbx + 8]
xor rdx, rax
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx + 0x4e0]
xor rcx, rdx
mov qword [rbx - 0x9c0], rcx
lea rbx, [r8]
sub rdi, 1
jne 0x180274fc0
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov rax, qword [rbx]
nop
mov rdx, rax
lea r8, [rbx + 8]
xor rdx, qword [r8]
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx - 0xea0]
xor rcx, rdx
mov qword [rbx - 0x9c0], rcx
lea rbx, [r8]
sub rdi, 1
jne 0x180275010
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 8]
mov rdi, qword [rsp]
btr edx, 0x1f
xor rdx, qword [r10 + 0x1380]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
xor edx, edx
mov qword [r10 + 0x9c0], rcx
mov dword [r10], edx
mov eax, edx
xorps xmm0, xmm0
mov rcx, qword [r10 + rax*8 + 8]
lea eax, [rdx + 1]
mov dword [r10], eax
movabs rdx, 0x38eb3ffff6d3
mov rax, rcx
shr rax, 0x1d
and rax, qword [r10 + 0x1388]
xor rcx, rax
mov rax, rcx
and rax, rdx
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rdx, rcx
shr rdx, 0x2b
xor rdx, rcx
js 0x1802750ee
cvtsi2sd xmm0, rdx
jmp 0x180275103
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
subsd xmm0, xmm1
addsd xmm0, xmm1
mulsd xmm0, qword [0x180375138]
add rsp, 8
ret
Function at 0x1802766b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0xa0
mov rbx, rdx
mov rbp, rcx
lea rdx, [0x1803761f0]
mov ecx, 0xb0
mov rdi, r9
mov r14d, r8d
call fcn.18027ffa0
mov rsi, rax
test rax, rax
je 0x1802768a1
lea rcx, [rax + 1]
xor edx, edx
mov r8d, 0xaf
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsi + 8]
mov byte [rsi], 1
mov edx, 2
call sub.MSVCP140.dll__Mtx_init_in_situ
lea rcx, [rsi + 0x58]
call sub.MSVCP140.dll__Cnd_init_in_situ
mov qword [0x1804458a8], rsi
xorps xmm0, xmm0
movups xmmword [rsi + 0xa0], xmm0
test r14d, r14d
je 0x180276758
test rdi, rdi
je 0x18027674e
cmp byte [rdi], 0
je 0x18027674e
mov rdx, rdi
mov rcx, rbp
call fcn.180276f20
jmp 0x180276758
xor edx, edx
mov rcx, rbp
call fcn.180276e80
call sub.KERNEL32.dll_GetCurrentProcessId
lea rcx, [0x180420310]
mov dword [0x180441698], eax
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x1802768d7
test rbx, rbx
je 0x180276797
movups xmm0, xmmword [rbx]
movups xmmword [0x180441420], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x180441430], xmm1
movups xmm0, xmmword [rbx + 0x20]
jmp 0x1802767b7
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [0x180441420], xmm0
movups xmmword [0x180441430], xmm0
movups xmmword [0x180441440], xmm0
lea rcx, [0x180420310]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [0x180441450], xmm0
movups xmmword [0x180441460], xmm0
movups xmmword [0x180441470], xmm0
call sub.MSVCP140.dll__Mtx_unlock
cmp qword [0x1804213c8], 0
jne 0x1802768aa
mov rcx, rbp
call fcn.18027be50
mov qword [0x1804213c8], rax
lea rcx, [0x180274d80]
mov qword [rax + 0x10], rcx
lea rcx, [0x180274d90]
mov rax, qword [0x1804213c8]
mov qword [rax + 0x18], rcx
mov eax, 1
mov rdi, qword [0x1804458a8]
mov ecx, 8
xchg byte [rdi], al
call fcn.1802697d0
xor ebx, ebx
test rax, rax
je 0x180276855
mov qword [rax], rdi
jmp 0x180276858
mov rax, rbx
lea rcx, [rsp + 0x38]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x180274de0]
xor ecx, ecx
mov dword [rsp + 0x20], ebx
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1802768c8
cmp dword [rdi + 0xa8], ebx
jne 0x18027689a
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rdi + 0xa0], xmm1
jmp 0x1802768aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xor ebx, ebx
mov qword [0x1804458a8], rbx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov ecx, 6
mov dword [rsp + 0x38], ebx
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
int3
Function at 0x180276f20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xae0
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rbx, rdx
mov dword [rsp + 0x28], 0x20
lea rax, [rsp + 0x80]
mov r8, rcx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x20
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareValveSteam
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180276fd3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_opening_Steam_key_n
jmp 0x18027709a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.SteamExe
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x30], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x180277088
mov ecx, dword [rsp + 0x30]
cmp ecx, 1
jb 0x180277088
shr ecx, 1
je 0x180277046
lea rax, [rsp + 0xc0]
lea edx, [rbx + 0x5c]
cmp word [rax], 0x2f
jne 0x18027703c
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x180277033
lea rax, [rsp + 0x40]
mov edx, 0x800
lea r9, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r8, str.__s__steam:__rungameid__s
lea rcx, [rsp + 0x2d0]
call fcn.180276db0
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x80]
call fcn.180276a50
jmp 0x1802770a2
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_reading_SteamExe_key_n
mov rcx, rax
call fcn.1802770c0
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.180269d00
add rsp, 0xae0
pop rbx
ret