joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180046f30
Capabilities:
Encode data using xor

Disassembly:
movsx r8d, byte [0x1802a7099]
lea rax, [0x1802a70b0]
xor edx, edx
movd xmm2, r8d
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add edx, 0x40
lea rax, [rax + 0x40]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm1, xmmword [rax - 0x40]
pxor xmm1, xmm2
movdqu xmmword [rax - 0x40], xmm1
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x30], xmm0
movdqu xmm0, xmmword [rax - 0x20]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x20], xmm0
cmp edx, 0xb900
jb 0x180046f60
movsxd rcx, edx
lea rax, [0x1802a70a0]
cmp rcx, 0xb92c
jae 0x180046fd1
add rcx, rax
nop dword [rax]
xor byte [rcx], r8b
lea rcx, [rcx + 1]
inc edx
cmp edx, 0xb92c
jb 0x180046fc0
ret

Function at 0x180046fe0
Capabilities:
Encode data using xor

Disassembly:
movsx r8d, byte [0x1802a709a]
lea rax, [0x1802b29e0]
xor edx, edx
movd xmm2, r8d
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add edx, 0x40
lea rax, [rax + 0x40]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm1, xmmword [rax - 0x40]
pxor xmm1, xmm2
movdqu xmmword [rax - 0x40], xmm1
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x30], xmm0
movdqu xmm0, xmmword [rax - 0x20]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x20], xmm0
cmp edx, 0x21940
jb 0x180047010
movsxd rcx, edx
lea rax, str.nx8_5__
cmp rcx, 0x21960
jae 0x180047081
add rcx, rax
nop dword [rax]
xor byte [rcx], r8b
lea rcx, [rcx + 1]
inc edx
cmp edx, 0x21960
jb 0x180047070
ret
Function at 0x180047090
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
lea rdx, str.recreate..._n
lea rcx, [0x1802ecc10]
call fcn.180044770
lea rcx, [0x1802ecc10]
call fcn.180081550
movabs rcx, 0x47e2423e7c8b8294
call fcn.180044cb0
test rax, rax
jne 0x1800470cb
xor ecx, ecx
jmp 0x1800470ea
mov rax, qword [rax + 0x415680]
test rax, rax
jne 0x1800470db
xor ecx, ecx
jmp 0x1800470ea
mov rcx, qword [rax]
test rcx, rcx
je 0x1800470ea
mov rcx, qword [rcx + 0x178]
mov rax, qword [0x1802ea778]
mov qword [rax + 0x38], rcx
mov rax, qword [0x1802ea778]
cmp qword [rax + 0x28], 0
lea r8, [rax + 0x28]
jne 0x18004712e
mov rax, qword [rcx]
lea rdx, [0x18029cd30]
call qword [rax + 0x38]
mov rax, qword [0x1802ea778]
cmp qword [rax + 0x28], 0
jne 0x18004712e
lea rdx, str._g_globals__device_n
jmp 0x1800471d8
cmp qword [rax + 0x30], 0
lea rdx, [rax + 0x30]
jne 0x18004715d
mov rcx, qword [rax + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x140]
mov rax, qword [0x1802ea778]
cmp qword [rax + 0x30], 0
jne 0x18004715d
lea rdx, str._g_globals__device_ctx_n
jmp 0x1800471d8
call fcn.180046090
test al, al
jne 0x180047185
lea rdx, str.failed_to_recreate_render_target_n
lea rcx, [0x1802ecc10]
call fcn.180044770
lea rcx, [0x1802ecc10]
call fcn.180081550
lea rdx, str.create_ok__n
lea rcx, [0x1802ecc10]
call fcn.180044770
lea rcx, [0x1802ecc10]
call fcn.180081550
call fcn.18000e720
test al, al
jne 0x1800471cc
lea rdx, str.failed_to_recreate_dev_objs_n
lea rcx, [0x1802ecc10]
call fcn.180044770
lea rcx, [0x1802ecc10]
call fcn.180081550
call fcn.18001f860
lea rdx, str.create2_ok__n
lea rcx, [0x1802ecc10]
call fcn.180044770
lea rcx, [0x1802ecc10]
add rsp, 0x28
jmp fcn.180081550

Function at 0x180048210
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1802ea6a8]
test rcx, rcx
je 0x180048250
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rdx, str.rtv_released__n
mov qword [0x1802ea6a8], 0
lea rcx, [0x1802ecc10]
call fcn.180044770
lea rcx, [0x1802ecc10]
call fcn.180081550
call fcn.18001f8f0
call fcn.18000ec50
mov rax, qword [0x1802ea778]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x180048277
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [0x1802ea778]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x18004828d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [0x1802ea778]
mov qword [rax + 0x30], 0
lea rdx, str.dx11_invalidate_device_objects__n
mov rax, qword [0x1802ea778]
lea rcx, [0x1802ecc10]
mov qword [rax + 0x28], 0
call fcn.180044770
lea rcx, [0x1802ecc10]
add rsp, 0x28
jmp fcn.180081550
Function at 0x180053a90
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1802eab30]
test rax, rax
jne 0x180053ab7
add rsp, 0xa0
pop rbp
ret
mov r9, qword [rax + 0x190]
xor r10d, r10d
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x68], r15
mov dword [rbp + 0x6f], r10d
mov qword [rbp + 0x7f], r9
test r9, r9
je 0x180053c97
mov r9, qword [rax + 0x198]
movabs r11, 0xcbf29ce484222325
mov rcx, qword [rbp + 0x7f]
mov qword [rbp - 0x21], r9
nop word [rax + rax]
mov r9, qword [r9]
mov qword [rbp - 0x29], r9
test r9, r9
je 0x180053c78
movzx eax, word [0x1800850d8]
lea r8, [rbp - 0x19]
movsd xmm0, qword [str._QG_RJ]
movzx ecx, byte [0x1800850da]
movsd qword [rbp - 0x19], xmm0
xor cl, 0x3d
xor byte [rbp - 0x18], 0x34
xor byte [rbp - 0x17], 0x35
xor byte [rbp - 0x16], 0x36
xor byte [rbp - 0x15], 0x37
xor byte [rbp - 0x14], 0x38
xor byte [rbp - 0x13], 0x39
xor byte [rbp - 0x12], 0x3a
mov word [rbp - 0x11], ax
xor al, 0x3b
xor byte [rbp - 0x10], 0x3c
mov byte [rbp - 0x11], al
lea rax, [r9 + 8]
sub r8, rax
mov byte [rbp - 0x19], 0x73
mov byte [rbp - 0xf], cl
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180053ba3
inc rax
test ecx, ecx
jne 0x180053b90
test edx, edx
je 0x180053c74
mov rax, qword [r9 + 0x5b8]
xor esi, esi
mov qword [rbp + 0x77], rax
test rax, rax
je 0x180053c74
mov r12d, dword [r9 + 0x58c]
nop dword [rax + rax]
xor ebx, ebx
test r12, r12
je 0x180053c60
mov r15d, dword [r9 + 0x598]
lea rdi, [rax + 0x20]
cmp rbx, r15
je 0x180053c58
mov r14, qword [rdi]
test r14, r14
je 0x180053c45
mov r9, qword [r14 + 8]
movzx r8d, byte [r9]
test r8b, r8b
jne 0x180053c05
mov rax, r11
jmp 0x180053c3f
lea edx, [r8 - 0x41]
cmp dl, 0x19
lea eax, [r8 + 0x20]
movzx ecx, al
movabs rax, 0x100000001b3
cmova ecx, r8d
movsx rdx, cl
lea rcx, [r9 + 1]
xor rdx, r11
imul rdx, rax
call fcn.18003db10
movabs r11, 0xcbf29ce484222325
cmp rax, qword [rbp + 0x67]
je 0x180053c9a
inc esi
cmp esi, r15d
jae 0x180053c58
inc rbx
add rdi, 0x18
cmp rbx, r12
jb 0x180053be6
mov rax, qword [rbp + 0x77]
mov r9, qword [rbp - 0x29]
mov rax, qword [rax]
mov qword [rbp + 0x77], rax
test rax, rax
jne 0x180053bd0
mov r10d, dword [rbp + 0x6f]
mov rcx, qword [rbp + 0x7f]
mov r9, qword [rbp - 0x21]
inc r10d
add r9, 8
movsxd rax, r10d
mov dword [rbp + 0x6f], r10d
mov qword [rbp - 0x21], r9
cmp rax, rcx
jb 0x180053b20
xor r14d, r14d
mov r15, qword [rsp + 0x68]
mov rax, r14
mov r14, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
add rsp, 0xa0
pop rbp
ret
Function at 0x1800554d0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rdi, r8
mov rax, rdx
test rdx, rdx
je 0x18005566d
movabs rdx, 0x3c25ca970f0f0178
mov rcx, rax
call fcn.180045020
test rax, rax
je 0x18005566d
cmp byte [rax], 0x4c
jne 0x18005566d
cmp byte [rax + 1], 0x8b
jne 0x18005566d
movsxd rbx, dword [rax + 3]
add rbx, 7
add rbx, rax
je 0x18005566d
xorps xmm0, xmm0
lea rax, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0x30
mov rdx, rbx
movups xmmword [rsp + 0x30], xmm0
lea rcx, [r8 - 1]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call fcn.180074300
test eax, eax
jne 0x18005564e
mov eax, dword [rsp + 0x54]
test al, 1
jne 0x18005564e
bt eax, 8
jb 0x18005564e
mov eax, dword [rsp + 0x50]
cmp eax, 0x10000
je 0x18005564e
cmp eax, 0x2000
je 0x18005564e
mov rcx, qword [rsp + 0x30]
cmp rbx, rcx
jbe 0x18005564e
add rcx, qword [rsp + 0x48]
cmp rbx, rcx
ja 0x18005564e
mov rbx, qword [rbx]
test rbx, rbx
je 0x18005566d
movabs rsi, 0xcbf29ce484222325
movabs rbp, 0x100000001b3
nop
mov r9, qword [rbx + 8]
movzx r8d, byte [r9]
test r8b, r8b
jne 0x1800555f2
mov rax, rsi
jmp 0x180055618
lea edx, [r8 - 0x41]
cmp dl, 0x19
lea eax, [r8 + 0x20]
movzx ecx, al
cmova ecx, r8d
movsx rdx, cl
lea rcx, [r9 + 1]
xor rdx, rsi
imul rdx, rbp
call fcn.18003db10
cmp rdi, rax
je 0x180055628
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1800555e0
jmp 0x18005566d
mov rcx, qword [rbx]
test rcx, rcx
je 0x18005566d
cmp byte [rcx], 0x48
jne 0x18005566d
cmp byte [rcx + 1], 0x8d
jne 0x18005566d
cmp byte [rcx + 2], 5
jne 0x18005566d
movsxd rax, dword [rcx + 3]
add rax, 7
add rax, rcx
jmp 0x18005566f
lea rdx, str.not_readable
lea rcx, [0x1802ecc10]
call fcn.180044770
lea rcx, [0x1802ecc10]
call fcn.180081b50
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180056450
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
push rbp
push rsi
sub rsp, 0x98
mov rsi, r8
mov rbp, rdx
test rdx, rdx
je 0x1800566d3
test r8, r8
je 0x1800566d3
mov qword [r11 + 8], rbx
mov rbx, qword [0x1802eacb0]
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
test rbx, rbx
jne 0x180056643
mov rdi, qword [rcx + 0x88]
lea rdx, [r11 + 0x10]
mov rax, qword [0x1802ec1c8]
xor r14d, r14d
mov qword [r11 - 0x78], rax
xor r9d, r9d
mov qword [r11 + 0x10], r14
xor r8d, r8d
mov rax, qword [rdi]
mov qword [r11 - 0x80], r14
mov rcx, qword [rax + 0x60]
xor eax, eax
mov qword [r11 - 0x68], rax
lea rax, [r11 - 0x78]
mov qword [r11 - 0x70], rcx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.180082560
mov rdx, qword [rsp + 0xb8]
mov r12d, 0xffffffff
movabs r15, 0x5f0720d54e5f164
cmp rdx, r12
je 0x1800565ef
movabs r13, 0xcbf29ce484222325
mov rax, qword [0x1802ec1c8]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
mov rax, qword [rdi]
mov qword [rsp + 0x28], r14
mov rcx, qword [rax + 0x128]
xor eax, eax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rcx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.180082560
mov rbx, rax
mov r9, qword [rax]
movzx eax, byte [r9]
test al, al
je 0x180056595
lea ecx, [rax + 0x20]
movzx edx, cl
lea r8d, [rax - 0x41]
cmp r8b, 0x19
lea rcx, [r9 + 1]
cmova edx, eax
movabs rax, 0x100000001b3
movsx rdx, dl
xor rdx, r13
imul rdx, rax
call fcn.18003db10
cmp rax, r15
je 0x180056685
mov rax, qword [0x1802ec1c8]
lea rdx, [rsp + 0xb8]
mov r8, qword [rsp + 0xb8]
xor r9d, r9d
mov qword [rsp + 0x60], rax
mov rax, qword [rdi]
mov qword [rsp + 0x28], r14
mov rcx, qword [rax + 0x68]
xor eax, eax
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rcx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.180082560
mov rdx, qword [rsp + 0xb8]
cmp rdx, r12
jne 0x180056510
mov r8, r15
lea rdx, str.cvar_couldnt_find__llx._n
lea rcx, [0x1802ecc10]
call fcn.180044770
lea rcx, [0x1802ecc10]
call fcn.180081b50
mov qword [0x1802eacb0], r14
lea rdx, str.failed_to_find_mp_teammates_are_enemies
lea rcx, [0x1802ecc10]
call fcn.180044770
lea rcx, [0x1802ecc10]
call fcn.180081b50
mov rbx, qword [0x1802eacb0]
test rbx, rbx
je 0x1800566bb
cmp byte [rbx + 0x40], 0
je 0x1800566bb
mov al, 1
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xb0]
mov r15, qword [rsp + 0x80]
add rsp, 0x98
pop rsi
pop rbp
ret
mov r9, rbx
lea rdx, str.cvar_found__llx_at_____p_n
mov r8, r15
lea rcx, [0x1802ecc10]
call fcn.180044770
lea rcx, [0x1802ecc10]
call fcn.180081b50
mov qword [0x1802eacb0], rbx
test rbx, rbx
jne 0x180056643
jmp 0x180056618
call fcn.180054140
mov ebx, dword [rax + rbp]
call fcn.180054140
cmp ebx, dword [rax + rsi]
setne al
jmp 0x18005664b
xor al, al
add rsp, 0x98
pop rsi
pop rbp
ret
Function at 0x18005e680
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1802ec1c8]
xor r14d, r14d
mov qword [r11 - 0x48], rax
mov rdi, rdx
mov rax, qword [rcx]
lea rdx, [r11 + 8]
mov qword [r11 + 8], r14
xor r9d, r9d
mov qword [r11 - 0x50], r14
mov rbx, rcx
mov r8, qword [rax + 0x60]
xor eax, eax
mov qword [r11 - 0x38], rax
lea rax, [r11 - 0x48]
mov qword [r11 - 0x40], r8
xor r8d, r8d
mov qword [r11 - 0x58], rax
call fcn.180082560
mov rdx, qword [rsp + 0x80]
mov r15d, 0xffffffff
cmp rdx, r15
je 0x18005e7ec
movabs rbp, 0xcbf29ce484222325
movabs r12, 0x100000001b3
nop word [rax + rax]
mov rax, qword [0x1802ec1c8]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov rax, qword [rbx]
mov qword [rsp + 0x28], r14
mov rcx, qword [rax + 0x128]
xor eax, eax
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rcx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.180082560
mov rsi, rax
mov r9, qword [rax]
movzx r8d, byte [r9]
test r8b, r8b
jne 0x18005e763
mov rax, rbp
jmp 0x18005e789
lea edx, [r8 - 0x41]
cmp dl, 0x19
lea eax, [r8 + 0x20]
movzx ecx, al
cmova ecx, r8d
movsx rdx, cl
lea rcx, [r9 + 1]
xor rdx, rbp
imul rdx, r12
call fcn.18003db10
cmp rdi, rax
je 0x18005e829
mov rax, qword [0x1802ec1c8]
lea rdx, [rsp + 0x80]
mov r8, qword [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], r14
mov rcx, qword [rax + 0x68]
xor eax, eax
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rcx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.180082560
mov rdx, qword [rsp + 0x80]
cmp rdx, r15
jne 0x18005e710
mov r8, rdi
lea rdx, str.cvar_couldnt_find__llx._n
lea rcx, [0x1802ecc10]
call fcn.180044770
lea rcx, [0x1802ecc10]
call fcn.180081b50
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov r9, rsi
lea rdx, str.cvar_found__llx_at_____p_n
mov r8, rdi
lea rcx, [0x1802ecc10]
call fcn.180044770
lea rcx, [0x1802ecc10]
call fcn.180081b50
mov rax, rsi
jmp 0x18005e810
Function at 0x18006e700
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rbp
push r14
sub rsp, 0x20
mov r10, rcx
movzx r9d, r8b
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
xor ebp, ebp
movzx eax, byte [rsp + 0x51]
mov r14, rdx
imul r9, rcx
xor r9, rax
movzx eax, byte [rsp + 0x52]
imul r9, rcx
xor r9, rax
movzx eax, byte [rsp + 0x53]
imul r9, rcx
xor r9, rax
mov rax, qword [r10 + 0x70]
imul r9, rcx
mov rcx, qword [r10 + 0x88]
and rcx, r9
shl rcx, 4
add rax, rcx
mov rcx, qword [r10 + 0x60]
mov rbx, qword [rax + 8]
cmp rbx, rcx
je 0x18006e794
mov rax, qword [rax]
cmp r8d, dword [rbx + 0x10]
je 0x18006e797
cmp rbx, rax
je 0x18006e794
mov rbx, qword [rbx + 8]
cmp r8d, dword [rbx + 0x10]
jne 0x18006e783
jmp 0x18006e797
mov rbx, rbp
test rbx, rbx
cmove rbx, rcx
cmp rbx, rcx
je 0x18006e8ac
mov qword [rsp + 0x40], rsi
mov qword [rdx], rbp
mov qword [rdx + 8], rbp
mov qword [rdx + 0x10], rbp
mov rsi, qword [rbx + 0x20]
sub rsi, qword [rbx + 0x18]
sar rsi, 4
mov qword [rsp + 0x48], rdi
test rsi, rsi
je 0x18006e891
movabs rax, 0xfffffffffffffff
cmp rsi, rax
ja 0x18006e8c2
shl rsi, 4
cmp rsi, 0x1000
jb 0x18006e81a
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x18006e8c8
call fcn.180042b80
test rax, rax
je 0x18006e8bc
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18006e82f
test rsi, rsi
je 0x18006e82c
mov rcx, rsi
call fcn.180042b80
mov rdi, rax
jmp 0x18006e82f
mov rdi, rbp
mov qword [r14], rdi
lea rax, [rsi + rdi]
mov qword [r14 + 8], rdi
mov qword [r14 + 0x10], rax
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
cmp rcx, rdx
je 0x18006e87f
nop dword [rax + rax]
mov qword [rdi], rbp
mov qword [rdi + 8], rbp
mov rax, qword [rcx + 8]
test rax, rax
je 0x18006e864
lock inc dword [rax + 8]
mov rax, qword [rcx]
mov qword [rdi], rax
mov rax, qword [rcx + 8]
add rcx, 0x10
mov qword [rdi + 8], rax
add rdi, 0x10
cmp rcx, rdx
jne 0x18006e850
mov r8, r14
mov rdx, rdi
mov rcx, rdi
call fcn.18002eec0
mov qword [r14 + 8], rdi
mov rsi, qword [rsp + 0x40]
mov rax, r14
mov rdi, qword [rsp + 0x48]
mov byte [r14 + 0x18], 1
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov byte [rdx + 0x18], bpl
mov rax, r14
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
call fcn.180040750
int3
call fcn.18002dd90
int3
call fcn.18000ae70
int3
Function at 0x18006e8d0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov rsi, rcx
mov edx, 1
xor eax, eax
mov r9d, edx
lock cmpxchg byte [rcx + 0x69], dl
je 0x18006e930
mov ecx, 0x10000
nop
test r9d, r9d
je 0x18006e90f
mov eax, r9d
pause
sub rax, rdx
jne 0x18006e908
lea eax, [r9 + r9]
cmp eax, ecx
mov r9d, eax
cmova r9d, ecx
xor eax, eax
lock cmpxchg byte [rsi + 0x69], dl
jne 0x18006e900
nop word [rax + rax]
movabs rcx, 0x100000001b3
movzx edx, r8b
movabs rax, 0xcbf29ce484222325
xor edi, edi
xor rdx, rax
movzx eax, byte [rsp + 0x51]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x52]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x53]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x54]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x55]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x56]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x57]
imul rdx, rcx
xor rdx, rax
mov rax, qword [rsi + 0x40]
imul rdx, rcx
mov rcx, qword [rsi + 0x58]
and rcx, rdx
shl rcx, 4
add rax, rcx
mov rcx, qword [rsi + 0x30]
mov rbx, qword [rax + 8]
cmp rbx, rcx
je 0x18006e9e1
mov rax, qword [rax]
cmp r8, qword [rbx + 0x10]
je 0x18006e9e4
nop dword [rax]
cmp rbx, rax
je 0x18006e9e1
mov rbx, qword [rbx + 8]
cmp r8, qword [rbx + 0x10]
jne 0x18006e9d0
jmp 0x18006e9e4
mov rbx, rdi
test rbx, rbx
mov qword [r14], rdi
mov qword [r14 + 8], rdi
cmove rbx, rcx
mov qword [r14 + 0x10], rdi
cmp rbx, rcx
jne 0x18006ea10
mov byte [rsi + 0x69], dil
mov rax, r14
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rcx, qword [rbx + 0x20]
sub rcx, qword [rbx + 0x18]
mov qword [rsp + 0x40], rbp
movabs rbp, 0x2aaaaaaaaaaaaaab
mov rax, rbp
mov qword [rsp + 0x48], r15
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x18006eaec
movabs rax, 0xaaaaaaaaaaaaaaa
cmp rdx, rax
ja 0x18006eb11
lea rax, [rdx + rdx*2]
lea r15, [rax*8]
cmp r15, 0x1000
jb 0x18006ea97
lea rcx, [r15 + 0x27]
cmp rcx, r15
jbe 0x18006eb17
call fcn.180042b80
test rax, rax
je 0x18006eb0b
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18006eaa7
test r15, r15
je 0x18006eaa7
mov rcx, r15
call fcn.180042b80
mov rdi, rax
mov qword [r14], rdi
lea rcx, [r15 + rdi]
mov qword [r14 + 8], rdi
mov qword [r14 + 0x10], rcx
mov rcx, rdi
mov rdx, qword [rbx + 0x18]
mov rbx, qword [rbx + 0x20]
sub rbx, rdx
mov r8, rbx
call fcn.180043210
mov rax, rbp
imul rbx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rax, [rdx + rdx*2]
lea rcx, [rdi + rax*8]
mov qword [r14 + 8], rcx
mov rbp, qword [rsp + 0x40]
mov rax, r14
mov r15, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x58]
mov byte [rsi + 0x69], 0
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
call fcn.180040750
int3
call fcn.18002dd90
int3
call fcn.18000ae70
int3
Function at 0x1800706c0
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x180070711
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1800706fe
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18007071f
mov rcx, r8
call fcn.180042b90
xor eax, eax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
lea rcx, [rbx + 8]
add rsp, 0x20
pop rbx
jmp 0x180070730
call fcn.180040750
int3
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rsi, rcx
mov rax, qword [rbx + 8]
mov qword [rax], 0
mov rbx, qword [rbx]
test rbx, rbx
je 0x180070786
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rcx, [rbx + 0x18]
call fcn.1800708e0
mov edx, 0x30
mov rcx, rbx
call fcn.180042b90
mov rbx, rdi
test rdi, rdi
jne 0x180070760
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsi]
mov edx, 0x30
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.180042b90

Function at 0x180070730
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x180070711
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1800706fe
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18007071f
mov rcx, r8
call fcn.180042b90
xor eax, eax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
lea rcx, [rbx + 8]
add rsp, 0x20
pop rbx
jmp 0x180070730
call fcn.180040750
int3
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rsi, rcx
mov rax, qword [rbx + 8]
mov qword [rax], 0
mov rbx, qword [rbx]
test rbx, rbx
je 0x180070786
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rcx, [rbx + 0x18]
call fcn.1800708e0
mov edx, 0x30
mov rcx, rbx
call fcn.180042b90
mov rbx, rdi
test rdi, rdi
jne 0x180070760
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsi]
mov edx, 0x30
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.180042b90

Function at 0x180070960
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
sub rsp, 0x28
movabs rax, 0xaaaaaaaaaaaaaaa
cmp rdx, rax
ja 0x1800709c7
lea rax, [rdx + rdx*2]
lea rcx, [rax*8]
cmp rcx, 0x1000
jb 0x1800709b2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800709c7
mov rcx, rax
call fcn.180042b80
mov rcx, rax
test rax, rax
je 0x1800709cd
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
add rsp, 0x28
ret
test rcx, rcx
je 0x1800709c0
add rsp, 0x28
jmp fcn.180042b80
xor eax, eax
add rsp, 0x28
ret
call fcn.18000ae70
int3
call fcn.180040750
int3
Function at 0x1800725f0
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
xor edx, edx
lea rcx, [0x1802eab00]
call fcn.180056e50
mov rcx, qword [0x1802ebcf0]
test rcx, rcx
je 0x180072623
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [0x1802ebcf0], 0
lea rdx, str.unhooked__n
lea rcx, [0x1802ecc10]
call fcn.180044770
lea rcx, [0x1802ecc10]
add rsp, 0x28
jmp fcn.180081550