joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180010050
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x1800470b8]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov qword [rsp + 0x48], rcx
mov rbx, rcx
mov edi, dword [rdx]
test edi, edi
jne 0x18001008e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call fcn.180019630
xor edx, edx
lea rcx, [rbp + 0x190]
mov r8d, 0x208
call fcn.180019630
movdqa xmm0, xmmword [0x180040ba0]
lea rdx, str.SeDebugPrivilege
xor esi, esi
mov dword [rsp + 0x50], 0x104
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x54], 0x104
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x40], esi
lea r8d, [rsi + 0x10]
mov word [rsp + 0x60], si
movdqu xmmword [rsp + 0x70], xmm0
call fcn.180003d10
lea rcx, [rsp + 0x60]
call fcn.180010280
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180010142
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001013d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001026e
call fcn.180017cf8
mov r8d, edi
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x180010219
lea r8, [rsp + 0x48]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180010219
mov r9d, dword [rsp + 0x40]
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r8 + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1800101a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x180010219
mov ecx, dword [rsp + 0x40]
call fcn.18001c8f8
mov rdi, rax
test rax, rax
je 0x180010219
mov r9d, dword [rsp + 0x40]
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov r8, rdi
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x180010211
mov rdx, qword [rdi]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x54]
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x80]
lea rax, [rbp + 0x190]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
mov rcx, rdi
call fcn.18001f6bc
mov qword [rbx + 0x10], rsi
lea rax, [rbp - 0x80]
mov qword [rbx + 0x18], 7
mov r8, 0xffffffffffffffff
mov word [rbx], si
inc r8
cmp word [rax + r8*2], si
jne 0x180010233
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.180003d10
mov rax, rbx
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.180017e90
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4b0
pop rdi
pop rsi
pop rbp
ret
call fcn.18001c36c
int3
Function at 0x1800109b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rbx, r9
cmp qword [rdx + 0x18], 8
mov rdi, r8
mov qword [rsp + 0x60], rbp
jb 0x1800109d6
mov rdx, qword [rdx]
mov eax, dword [rsp + 0x88]
lea r8, [rsp + 0x60]
mov rcx, qword [rcx]
or eax, 0x2001b
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov qword [rsp + 0x38], r8
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x180010a23
xor al, al
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
cmp qword [rbx + 0x18], 8
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x68], rsi
jb 0x180010a36
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
jb 0x180010a40
mov rdi, qword [rdi]
mov r9d, dword [rsp + 0x80]
lea eax, [rax*2 + 2]
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rdi
mov qword [rsp + 0x20], rbx
mov sil, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
test eax, eax
movzx ebx, sil
cmovne ebx, ebp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x68]
movzx eax, bl
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x180010b30
Capabilities:
Check os version

Disassembly:
sub rsp, 0x278
mov rax, qword [0x1800470b8]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea rcx, [rsp + 0x144]
mov r8d, 0x118
call fcn.180019630
mov rax, qword gs:[0x58]
mov ecx, dword [0x180048370]
mov edx, 4
mov dword [rsp + 0x140], 0x11c
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x18004a018], eax
jg 0x180010c37
mov rax, qword [0x18004a020]
test rax, rax
je 0x180010c18
lea rcx, [rsp + 0x140]
call rax
test eax, eax
jne 0x180010c18
cmp dword [rsp + 0x144], 0xa
sete al
test al, al
jne 0x180010c18
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x110
call fcn.180019630
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180010c1d
mov eax, dword [rsp + 0x24]
cmp eax, 5
jne 0x180010c0c
cmp dword [rsp + 0x28], 1
jne 0x180010c1d
xor al, al
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180017e90
add rsp, 0x278
ret
cmp eax, 6
jne 0x180010c1d
cmp dword [rsp + 0x28], 1
jne 0x180010c1d
call fcn.180010ab0
mov al, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180017e90
add rsp, 0x278
ret
lea rcx, [0x18004a018]
call fcn.180018100
cmp dword [0x18004a018], 0xffffffff
jne 0x180010b90
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18004a018]
mov qword [0x18004a020], rax
call fcn.1800180a0
jmp 0x180010b90
Function at 0x180013460
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x3740]
mov eax, 0x3840
call fcn.180017e20
sub rsp, rax
mov rax, qword [0x1800470b8]
xor rax, rsp
mov qword [rbp + 0x3730], rax
xor r14d, r14d
mov esi, r14d
mov ebx, r14d
nop dword [rax]
nop dword [rax + rax]
mov r8d, ebx
lea rdx, str..PhysicalDrive_d
lea rcx, [rsp + 0x60]
call fcn.180013fc0
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rsp + 0x60]
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800136ac
xor edx, edx
mov dword [rsp + 0x40], r14d
mov r8d, 0x2710
mov qword [rsp + 0x4c], r14
lea rcx, [rbp + 0x1020]
mov dword [rsp + 0x48], r14d
call fcn.180019630
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x48]
lea rax, [rbp + 0x1020]
mov dword [rsp + 0x28], 0x2710
mov r9d, 0xc
mov qword [rsp + 0x20], rax
mov edx, 0x2d1400
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x18001369d
mov edx, dword [rbp + 0x102c]
mov byte [rbp + 0x840], r14b
test edx, edx
jle 0x180013585
lea r9, [rbp + 0x840]
xor r8d, r8d
lea rcx, [rbp + 0x1020]
call fcn.180013290
mov edx, dword [rbp + 0x1030]
mov byte [rbp + 0x450], r14b
test edx, edx
jle 0x1800135ac
lea r9, [rbp + 0x450]
xor r8d, r8d
lea rcx, [rbp + 0x1020]
call fcn.180013290
mov edx, dword [rbp + 0x1034]
mov byte [rbp + 0xc30], r14b
test edx, edx
jle 0x1800135d3
lea r9, [rbp + 0xc30]
xor r8d, r8d
lea rcx, [rbp + 0x1020]
call fcn.180013290
mov edx, dword [rbp + 0x1038]
xor al, al
mov byte [rbp + 0x60], al
test edx, edx
jle 0x1800135fc
lea r9, [rbp + 0x60]
mov r8d, 1
lea rcx, [rbp + 0x1020]
call fcn.180013290
movzx eax, byte [rbp + 0x60]
cmp byte [0x1800495f0], r14b
jne 0x180013650
movsx ecx, al
call fcn.180020d20
test eax, eax
jne 0x18001361e
movsx ecx, byte [rbp + 0x73]
call fcn.180020d20
test eax, eax
je 0x180013650
lea r8, [rbp + 0x60]
mov edx, 0x400
lea rcx, [0x1800495f0]
call fcn.18002108c
lea r8, [rbp + 0x450]
mov edx, 0x400
lea rcx, [0x180049c00]
call fcn.18002108c
mov esi, 1
xor edx, edx
lea rcx, [rbp + 0x1020]
mov r8d, 0x2710
call fcn.180019630
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rbp + 0x1020]
mov dword [rsp + 0x28], 0x2710
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x700a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x1800136a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, 0x10
jl 0x1800134b0
mov eax, esi
mov rcx, qword [rbp + 0x3730]
xor rcx, rsp
call fcn.180017e90
lea r11, [rsp + 0x3840]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180015740
Capabilities:
Connect to http server
Create http request
Get http content length
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2770]
mov eax, 0x2870
call fcn.180017e20
sub rsp, rax
mov rax, qword [0x1800470b8]
xor rax, rsp
mov qword [rbp + 0x2760], rax
mov r13, r9
mov qword [rsp + 0x50], r8
mov rbx, rdx
lea rcx, str.RookIE_1.0
xor r15d, r15d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x48], r15d
xor edx, edx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rsp + 0x38], r15
lea r8d, [r15 + 0x50]
mov dword [rsp + 0x30], r15d
lea rdx, [0x180040078]
mov dword [rsp + 0x28], 3
mov rcx, rax
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rdi, rax
call qword [sym.imp.WININET.dll_InternetConnectA]
test rdi, rdi
je 0x180015810
cmp qword [rbx + 0x18], 0x10
jb 0x1800157e3
mov rbx, qword [rbx]
mov qword [rsp + 0x28], r15
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x80000800
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov r14, rax
test rax, rax
jne 0x18001583c
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
mov rcx, qword [rbp + 0x2760]
xor rcx, rsp
call fcn.180017e90
mov rbx, qword [rsp + 0x28b0]
add rsp, 0x2870
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r9, [rsp + 0x44]
mov dword [rsp + 0x44], 8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r15
mov edx, 0x20000005
mov rcx, r14
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
mov esi, 0x2800
mov dword [rsp + 0x40], 1
mov ecx, esi
mov edi, r15d
call fcn.180017d00
mov rbx, rax
test rax, rax
je 0x180015810
mov r8d, esi
xor edx, edx
mov rcx, rax
call fcn.180019630
mov r8d, esi
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.180019630
cmp dword [rsp + 0x40], r15d
jbe 0x180015934
lea r9, [rsp + 0x40]
mov r8d, 0x27ff
lea rdx, [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [rsp + 0x40]
lea eax, [rdi + rcx]
cmp eax, esi
jbe 0x180015910
add esi, esi
mov r12, rbx
mov ecx, esi
mov r15d, esi
call fcn.180017d00
mov rbx, rax
test rax, rax
je 0x180015810
mov r8d, r15d
xor edx, edx
mov rcx, rax
call fcn.180019630
mov r8d, edi
mov rdx, r12
mov rcx, rbx
call fcn.1800191d0
mov rcx, r12
call fcn.180017cf8
mov ecx, dword [rsp + 0x40]
xor r15d, r15d
mov r8d, ecx
lea rdx, [rsp + 0x60]
mov ecx, edi
add rcx, rbx
call fcn.1800191d0
mov ecx, dword [rsp + 0x40]
add edi, ecx
mov dword [r13], edi
test ecx, ecx
jne 0x1800158a7
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x50]
mov al, 1
mov qword [rcx], rbx
mov dword [r13], edi
jmp 0x180015812
Function at 0x1807fc2d5
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp], 0xffffffffb18f1401
call fcn.180ae2769
int 0x31
xor dword [rbx], esp
xlatb
mov esp, 0x9cd21244
pushfq
test al, 0xec
xor byte [rax + rdx*4], cl
movabs al, byte [0xfbad751ebc2aa2b0]
jnp 0x1807fc334
or dword [rbp - 0x7f], ecx
mov ebp, 0x93b319b1
adc eax, 0x7efc8d7d
jl 0x1807fc2ee
retf
int 7
out 0x7f, al
mov bh, 0x34
int3

Function at 0x180accb60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp], 0x1626f20b
mov qword [rsp], rbx
mov ebx, 0x1b8e489d
sal bl, 6
push r11
dec bx
shr bx, 0x29
movzx r11d, bl
lea rbx, [0x180ac28c0]
mov r11d, 0x34a3350d
movzx r11d, byte [r11 + rdi - 0x34a3350d]
push 0xffffffffcf0a329f
xor r11d, r8d
and r11d, 0xff
push 0x75943b2c
mov r11d, dword [rbx + r11*4]
mov dword [rsp + 6], 0x3aa0f4b8
shr r8d, 8
neg dword [rsp + 0xa]
xor r8d, r11d
inc rdi
xor r8d, 0xab3a82a7
dec r9
lea rsp, [rsp + 0x10]
jne 0x180ac106c
pop r11
pop rbx
jmp 0x180ac1044

Function at 0x180ad576e
Capabilities:
Encode data using xor

Disassembly:
lea rdx, [0x180ad21a8]
mov r11d, 0x46b03b3d
dec r11d
neg r11b
movzx r11d, byte [r10 + r11 - 0x46b03bc4]
push 0xffffffffd9ac0598
xor r11d, ebx
and r11d, 0xff
mov r11d, dword [rdx + r11*4]
add byte [rsp + 3], 0x10
shr ebx, 8
xor ebx, r11d
inc r10
xor ebx, 0x36805a8d
dec rbp
lea rsp, [rsp + 8]
jne 0x180aba348
call fcn.180ab8269
mov rbp, qword [rbx]
add rbx, 8
movzx ecx, byte [r10]
jmp 0x180aadcf6
test rbp, rbp
lea rsp, [rsp + 0x10]
je 0x180aba392
jmp 0x180aba341

Function at 0x180ae043c
Capabilities:
Encode data using xor

Disassembly:
call fcn.180ad070f
mov rbp, qword [r8]
mov eax, 0xc2943e0e
mov ax, word [r8 + 8]
add r8, 0xa
push 0xffffffffb607e4af
push 0x2127dc1a
jmp 0x180acc2d1
jmp 0x180ab3651
lea rsp, [rsp + 0x10]
je 0x180ab36b2
mov eax, 0x5196ae9d
sal eax, 0x41
push r8
lea rax, [0x180ab82c8]
movzx r8d, byte [r11]
xor r8d, ebx
push 0x262e6da9
rol qword [rsp], 5
and r8d, 0xff
mov r8d, dword [rax + r8*4]
shr ebx, 8
xor ebx, r8d
inc byte [rsp + 7]
inc r11
xor ebx, 0x92b46bbc
dec r9
lea rsp, [rsp + 8]
jne 0x180ab366d
mov r8d, 0xcd3e381c
pop r8
jmp 0x180aa7ad2
mov word [rbp + riz], ax
call fcn.180ae2781
mov edi, 0x82350e0a
mov rdi, qword [rbx]
mov rbp, qword ss:[rdi]
push 0x3108b7ae
mov qword [rbx], rbp
lea rsp, [rsp + 8]
jmp fcn.180abe868
xor ebx, ebx
test r9, r9
jmp 0x180aac19e
Function at 0x180003e40
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180003e9d
lea rbx, [0x1800cee10]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180003e84
cmp r10, 2
jb 0x180003e84
cmp byte [r9], r8b
jne 0x180003e84
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180003e60
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180003edf
lea rbx, [0x1800cee10]
cmp r8b, 0x23
jne 0x180003ec3
cmp byte [r9], r8b
jne 0x180003ec3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180003eb0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1800040a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x1800040cf
mov r8d, 0x78f
lea rdx, str.C:UsersFastXDesktopSkylineEngine_____Panel_Designs_Customersgray_menu_for_ilzyffxgray_menu_for_ilzyffximgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x1800040db
mov qword [rdi], 0
lea rdx, [0x1800ce658]
mov rcx, rbx
call fcn.180003ef0
mov rbx, rax
test rax, rax
jne 0x1800040fd
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1800041d6
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800041d6
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1800041d6
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800041d6
cmp rsi, 0xffffffffffffffff
je 0x1800041d6
mov rax, qword [0x18016aa60]
test rax, rax
je 0x180004173
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x1800041d6
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x1800041c3
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x18016aa60]
test rax, rax
je 0x1800041b8
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800041df
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x1800041d1
mov qword [rdi], rsi
mov rax, rbp
jmp 0x1800041e1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180007950
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xe8], 0
mov rbx, rcx
movsxd rdi, edx
jg 0x180007987
mov r8d, 0x708
lea rdx, str.C:UsersFastXDesktopSkylineEngine_____Panel_Designs_Customersgray_menu_for_ilzyffxgray_menu_for_ilzyffximgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0xf0]
lea rdx, [0x1800cee10]
movsxd r8, dword [rbx + 0xe8]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [0x18016aa60]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x180007a06
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.18001df30
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180007a20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xe8], 0
mov rdi, rdx
mov rbx, rcx
jg 0x180007a53
mov r8d, 0x708
lea rdx, str.C:UsersFastXDesktopSkylineEngine_____Panel_Designs_Customersgray_menu_for_ilzyffxgray_menu_for_ilzyffximgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movss xmm0, dword [rbx + 0x108]
lea r10, [0x1800cee10]
movsxd rcx, dword [rbx + 0xe8]
mov rax, qword [rbx + 0xf0]
movss xmm2, dword [rdi]
movss xmm1, dword [rbx + 0x10c]
subss xmm2, xmm0
movss xmm3, dword [rdi + 4]
mov r9d, dword [rax + rcx*4 - 4]
subss xmm3, xmm1
movss xmm4, dword [rdi + 8]
not r9d
movzx ecx, r9b
subss xmm4, xmm0
movss xmm0, dword [rdi + 0xc]
shr r9d, 8
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp + 0x20], xmm2
movzx eax, byte [rsp + 0x20]
xor rcx, rax
movss dword [rsp + 0x24], xmm3
mov eax, r8d
movss dword [rsp + 0x28], xmm4
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 0x2c], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x24]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x28]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
mov rbx, qword [rsp + 0x40]
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x2c]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x30
pop rdi
ret
Function at 0x180016f30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x18016aa60]
mov edi, ecx
cmp byte [rbx + 0x4a5d], 0
jne 0x180016f82
cmp byte [rbx + 0x4a5e], 0
jne 0x180016f82
movsx r9d, word [rbx + 0x5b5a]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.180003d00
test dil, 1
je 0x1800170a8
jmp 0x18001700d
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1800d75b8]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1800d7598]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x47c0], rax
mov dword [rbx + 0x47ac], 1
movss dword [rbx + 0x47b8], xmm0
movss dword [rbx + 0x47bc], xmm1
movss xmm0, dword [rbx + 0x3900]
mulss xmm0, dword [0x1800d7504]
or dword [rbx + 0x47a8], 0x41
movss dword [rbx + 0x4808], xmm0
movsx r9d, word [rbx + 0x5b5a]
call fcn.180003d00
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x180017060
lea r11, [0x1800cee10]
nop dword [rax]
cmp r9b, 0x23
jne 0x180017043
cmp byte [r8], r9b
jne 0x180017043
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180017030
not ecx
call fcn.18000c1a0
test rax, rax
je 0x1800170a8
cmp byte [rax + 0xae], 0
je 0x1800170a8
mov byte [rax + 0xb5], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b5a]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x5b5a]
call fcn.180003d00
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.18000ec50
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret