joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000153c
Capabilities:
Read file on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
and qword [rbp + 0x6f], 0
lea rdx, [0x140002ab0]
lea rcx, [rbp + 7]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and dword [rsp + 0x50], 0
lea rax, [rbp + 7]
and qword [rsp + 0x48], 0
lea r9, [rbp + 0x17]
and qword [rbp + 0x2f], 0
lea r8, [rbp + 0x27]
mov dword [rsp + 0x40], 0x20
lea rcx, [rbp + 0x67]
mov dword [rsp + 0x38], 1
xorps xmm0, xmm0
and dword [rsp + 0x30], 0
mov edx, 0x10000000
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp + 0x27], 0x30
mov dword [rbp + 0x3f], 0x240
mov qword [rbp + 0x37], rax
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
and qword [rsp + 0x40], 0
lea rax, [rbp + 0x6f]
mov rcx, qword [rbp + 0x67]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rax, str.0000000000000
mov dword [rsp + 0x30], 0x32
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov rcx, qword [rbp + 0x67]
mov byte [0x140004051], 0
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0xb0
pop rbp
ret

Function at 0x140001620
Capabilities:
Write file on windows

Disassembly:
push rbp
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
and qword [rbp + 0xc0], 0
lea rdx, [0x140002dd0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and dword [rsp + 0x50], 0
lea rax, [rsp + 0x60]
and qword [rsp + 0x48], 0
lea r9, [rsp + 0x70]
and qword [rbp - 0x78], 0
lea r8, [rbp - 0x80]
mov qword [rbp - 0x70], rax
lea rcx, [rbp + 0xc0]
mov eax, 0x40
mov dword [rbp - 0x80], 0x30
mov dword [rsp + 0x40], eax
xorps xmm0, xmm0
mov dword [rsp + 0x38], 3
mov edx, 0x40000000
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp - 0x68], eax
movdqu xmmword [rbp - 0x60], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
js 0x140001748
cmp qword [rbp + 0xc0], 0
je 0x140001748
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x100
call fcn.1400028c0
lea r8, str.0000000000000
lea rdx, [0x140002e00]
lea rcx, [rbp - 0x50]
call sub.ntoskrnl.exe_sprintf_s
lea rcx, [rbp - 0x50]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400016fa
and qword [rsp + 0x40], 0
xor r9d, r9d
and qword [rsp + 0x38], 0
xor r8d, r8d
mov rcx, qword [rbp + 0xc0]
xor edx, edx
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0x1b0
pop rbp
ret
Function at 0x1400017e0
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov dword [rbp - 0x20], 0x220020
lea rax, [0x140002ba0]
mov qword [rbp + 0x10], rbx
mov qword [rbp - 0x18], rax
xor r9d, r9d
lea rax, [rbp + 0x10]
xor r8d, r8d
mov qword [r11 - 0x30], rax
lea edx, [rbx + 0x40]
mov rax, qword [sym.imp.ntoskrnl.exe_IoDriverObjectType]
mov qword [r11 - 0x38], rbx
mov byte [rsp + 0x28], bl
mov rcx, qword [rax]
mov qword [r11 - 0x48], rcx
lea rcx, [rbp - 0x20]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByName]
test eax, eax
js 0x1400018b6
mov eax, dword [0x1400070b0]
lea rcx, [0x1400050d0]
movaps xmm0, xmmword [rbp - 0x20]
mov edx, eax
inc eax
shl rdx, 5
add rdx, rcx
mov dword [0x1400070b0], eax
mov rax, qword [rbp + 0x10]
lea rcx, [0x1400011bc]
add rax, 0xe0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rdx + 0x10], rax
xchg qword [rax], rcx
movaps xmm0, xmmword [rbp - 0x10]
mov qword [rdx + 0x18], rcx
movdqu xmmword [rdx], xmm0
mov qword [0x140005098], rcx
lea rdx, [rbp - 0x10]
lea rcx, [0x140002b10]
mov qword [rbp - 0x18], rbx
mov dword [rbp - 0x20], ebx
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbp + 0x10]
mov edx, 0x74446973
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObjectWithTag]
jmp 0x1400018c9
mov r8d, eax
lea rdx, [rbp - 0x20]
lea rcx, [0x140002b30]
call sub.ntoskrnl.exe_DbgPrint
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x1400018d4
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
lea rdx, [0x140002bd0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r9, [rsp + 0x58]
mov edx, 1
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
xor ebp, ebp
mov ebx, eax
test eax, eax
jns 0x140001929
mov edx, eax
lea rcx, [0x140002bf0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
jmp 0x140001aa7
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_IoGetLowerDeviceObject]
test rax, rax
jne 0x14000194f
lea rcx, [0x140002c20]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x140001aa7
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_IoGetAttachedDevice]
mov rbx, rax
test rax, rax
jne 0x140001969
lea rcx, [0x140002c40]
jmp 0x140001940
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ObQueryNameString]
cmp eax, 0xc0000004
je 0x140001993
mov edx, eax
lea rcx, [0x140002c60]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400019f3
mov edx, dword [rsp + 0x50]
xor ecx, ecx
mov r8d, 0x544147
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
jne 0x1400019bb
lea rcx, [0x140002c80]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400019f3
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x50]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ObQueryNameString]
mov esi, eax
test eax, eax
jns 0x140001a05
mov edx, eax
lea rcx, [0x140002c60]
call sub.ntoskrnl.exe_DbgPrint
mov edx, 0x544147
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x140001969
jmp 0x140001aa7
cmp word [rdi], bp
jbe 0x140001a9a
mov rcx, qword [rdi + 8]
lea rdx, [0x140002ca0]
call sub.ntoskrnl.exe_wcsstr
test rax, rax
je 0x140001a8c
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x140001a8c
movups xmm0, xmmword [0x140002cc0]
movups xmmword [rcx], xmm0
movsd xmm0, qword [0x140002cd0]
movsd qword [rcx + 0x10], xmm0
movzx eax, word [0x140002cd8]
mov word [rcx + 0x18], ax
mov al, byte [0x140002cda]
mov byte [rcx + 0x1a], al
movups xmm0, xmmword [0x140002ce0]
movups xmmword [rcx + 0x1b], xmm0
movups xmm1, xmmword [0x140002cf0]
movups xmmword [rcx + 0x2b], xmm1
movsd xmm0, qword [0x140002d00]
movsd qword [rcx + 0x3b], xmm0
mov eax, dword [0x140002d08]
mov dword [rcx + 0x43], eax
mov al, byte [0x140002d0c]
mov byte [rcx + 0x47], al
mov edx, 0x544147
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, esi
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000243c
Capabilities:
Get system information on windows
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x150
xor ebp, ebp
lea r9, [rax + 0x18]
and dword [rax + 0x18], ebp
mov rsi, rdx
mov r14, rcx
xor r8d, r8d
xor edx, edx
lea edi, [rbp + 0xb]
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
je 0x14000248c
mov edx, eax
lea rcx, [0x140002e40]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
jmp 0x1400025ba
mov edx, dword [rsp + 0x180]
xor ecx, ecx
mov r8d, 0x6e556353
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
jne 0x1400024b9
mov edx, dword [rsp + 0x180]
lea rcx, [0x140002e80]
jmp 0x140002480
mov r8d, dword [rsp + 0x180]
xor r9d, r9d
mov rdx, rbx
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov edi, eax
test eax, eax
jns 0x1400024ea
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, edi
lea rcx, [0x140002ec0]
jmp 0x140002480
xor edi, edi
cmp dword [rbx], edi
jbe 0x1400025ac
mov eax, edi
lea rcx, [rsp + 0x20]
imul rax, rax, 0x128
mov edx, 2
add rax, 8
add rax, rbx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x14000250e
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
lea rcx, [rsp + 0x48]
call fcn.140002610
mov rcx, rax
mov rdx, r14
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x14000259c
inc edi
cmp edi, dword [rbx]
jb 0x1400024f4
jmp 0x1400025ac
mov rbp, qword [rsp + 0x30]
test rsi, rsi
je 0x1400025ac
mov ecx, dword [rsp + 0x38]
mov dword [rsi], ecx
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbp
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x1400025d4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r8, rcx
test edx, edx
jne 0x1400025de
xor eax, eax
ret
movzx eax, byte [rcx]
xor eax, 0x4f9ace2f
imul ecx, eax, 0x1000193
cmp edx, 1
jbe 0x14000260b
inc r8
dec edx
movzx eax, byte [r8]
inc r8
xor eax, ecx
imul ecx, eax, 0x1000193
sub rdx, 1
jne 0x1400025f6
mov eax, ecx
ret
Function at 0x1400026c8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov edi, r8d
mov ebx, ecx
mov edx, r8d
mov rcx, rsi
call fcn.1400025d4
xor ebx, eax
test edi, edi
je 0x140002721
mov r8d, edi
imul ebx, ebx, 0x41c64e6d
mov eax, 0x80808081
add ebx, 0x3039
mov ecx, ebx
shr ecx, 0x10
and ecx, 0x7fff
mul ecx
shr edx, 7
add dl, cl
xor byte [rsi], dl
inc rsi
sub r8, 1
jne 0x1400026f3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800047a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
mov r8, rcx
je 0x18000482b
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop dword [rax + rax]
lea edx, [rax + r9]
lea ecx, [rdx - 0x34]
xor byte [rax - 2], cl
lea rax, [rax + 0xe]
lea ecx, [rdx - 0x33]
xor byte [rax - 0xf], cl
lea ecx, [rdx - 0x32]
xor byte [rax - 0xe], cl
lea ecx, [rdx - 0x31]
xor byte [rax - 0xd], cl
lea ecx, [rdx - 0x30]
xor byte [rax - 0xc], cl
lea ecx, [rdx - 0x2f]
xor byte [rax - 0xb], cl
lea ecx, [rdx - 0x2e]
xor byte [rax - 0xa], cl
lea ecx, [rdx - 0x2d]
xor byte [rax - 9], cl
lea ecx, [rdx - 0x2c]
xor byte [rax - 8], cl
lea ecx, [rdx - 0x2b]
xor byte [rax - 7], cl
lea ecx, [rdx - 0x2a]
xor byte [rax - 6], cl
lea ecx, [rdx - 0x29]
xor byte [rax - 5], cl
lea ecx, [rdx - 0x28]
xor byte [rax - 4], cl
sub dl, 0x27
xor byte [rax - 3], dl
lea rcx, [r9 + rax]
cmp rcx, 0x46
jb 0x1800047c0
mov byte [r8 + 0x47], 0
mov rax, r8
ret

Function at 0x180004cf0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x180004d18
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x34]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x135
jb 0x180004d00
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x180016110
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x38]
sub rsp, 0x138
mov rax, qword [0x1801a0080]
xor rax, rsp
mov qword [rbp + 0x20], rax
movdqa xmm1, xmmword [0x1800e31f0]
xorps xmm0, xmm0
mov r15, qword [rbp + 0x90]
mov rsi, r9
mov r14, r8
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movdqa xmm0, xmmword [0x1800e3220]
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rsp + 0x20], xmm1
movups xmmword [rsp + 0x30], xmm1
movups xmmword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x50], xmm1
cmp rdx, 0x40
jbe 0x1800161a0
mov r9d, 0x40
lea r8, [rbp - 0x60]
call fcn.1800162f0
jmp 0x1800161af
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + rax + 0x20]
movdqu xmm2, xmmword [rbp + rax - 0x60]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rsp + rax + 0x60]
movdqu xmmword [rsp + rax + 0x20], xmm1
xorps xmm0, xmm2
movdqu xmmword [rsp + rax + 0x60], xmm0
add rax, 0x10
cmp rax, 0x40
jl 0x1800161c0
lea rbx, [rsi + 0x40]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movups xmm0, xmmword [rsp + 0x20]
mov r8, rsi
movups xmm1, xmmword [rsp + 0x30]
mov rdx, r14
mov rdi, rax
movups xmmword [rax], xmm0
lea rcx, [rax + 0x40]
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm1
call sub.VCRUNTIME140.dll_memcpy
mov esi, reloc.WLDAP32.dll_Ordinal_32
lea r8, [rbp - 0x20]
mov r9d, esi
mov rdx, rbx
mov rcx, rdi
call fcn.1800162f0
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, 0x60
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movups xmm0, xmmword [rsp + 0x60]
lea r8, [rbp]
movups xmm1, xmmword [rsp + 0x70]
mov r9d, esi
mov edx, 0x60
mov rcx, rax
movups xmmword [rax], xmm0
mov rbx, rax
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [rax + 0x50], xmm1
call fcn.1800162f0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rbp + 0x98]
lea rdx, [rbp]
cmp rbx, rsi
mov rcx, r15
cmova rbx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, rbx
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800c2340
add rsp, 0x138
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800162f0
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rbx
push rsi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x1801a0080]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rbx, rdx
mov qword [rbp - 0x55], 0x5be0cd19
xor edx, edx
mov dword [rbp - 0x71], 0x6a09e667
mov qword [rbp - 0x79], rdx
mov r14, r9
mov dword [rbp - 0x6d], 0xbb67ae85
mov r15, r8
mov dword [rbp - 0x69], 0x3c6ef372
mov rsi, rcx
mov dword [rbp - 0x65], 0xa54ff53a
mov dword [rbp - 0x61], 0x510e527f
mov dword [rbp - 0x5d], 0x9b05688c
mov dword [rbp - 0x59], 0x1f83d9ab
test ebx, ebx
je 0x1800163f3
mov qword [rsp + 0xc8], rdi
nop dword [rax]
test edx, edx
jne 0x180016399
cmp ebx, 0x40
jb 0x180016399
mov rdx, rsi
lea rcx, [rbp - 0x79]
call fcn.180016440
add qword [rbp - 0x79], 0x200
add rsi, 0x40
mov edx, dword [rbp - 0x51]
add ebx, 0xffffffc0
jmp 0x1800163e7
mov eax, edx
mov ecx, 0x40
sub ecx, edx
mov edi, ebx
cmp ebx, ecx
mov rdx, rsi
cmovae edi, ecx
lea rcx, [rbp - 0x4d]
add rcx, rax
mov r8d, edi
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [rbp - 0x51]
add rsi, rdi
add edx, edi
sub ebx, edi
mov dword [rbp - 0x51], edx
cmp edx, 0x40
jne 0x1800163e7
lea rdx, [rbp - 0x4d]
lea rcx, [rbp - 0x79]
call fcn.180016440
add qword [rbp - 0x79], 0x200
xor edx, edx
mov dword [rbp - 0x51], edx
test ebx, ebx
jne 0x180016370
mov rdi, qword [rsp + 0xc8]
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x79]
call fcn.180016b30
mov eax, reloc.WLDAP32.dll_Ordinal_32
lea rdx, [rbp - 9]
cmp r14, rax
mov rcx, r15
cmova r14, rax
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1800c2340
add rsp, 0xd0
pop r15
pop r14
pop rsi
pop rbx
pop rbp
ret
Function at 0x180016b30
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [rcx + 0x28]
cmp ecx, 0x40
jae 0x180016ce8
lea r8d, [rcx*8]
mov qword [rsp + 0x30], rsi
add qword [rbx], r8
mov byte [rcx + rbx + 0x2c], 0x80
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jbe 0x180016ba8
cmp eax, 0x40
jae 0x180016b92
nop dword [rax]
nop word [rax + rax]
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x40
jb 0x180016b80
lea rsi, [rbx + 0x2c]
mov rcx, rbx
mov rdx, rsi
call fcn.180016440
xor eax, eax
mov dword [rbx + 0x28], eax
jmp 0x180016bb0
lea rsi, [rbx + 0x2c]
jae 0x180016bc2
nop
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jb 0x180016bb0
movzx eax, byte [rbx + 7]
mov rdx, rsi
mov byte [rbx + 0x64], al
mov rcx, rbx
movzx eax, byte [rbx + 6]
mov byte [rbx + 0x65], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 0x66], al
movzx eax, byte [rbx + 4]
mov byte [rbx + 0x67], al
movzx eax, byte [rbx + 3]
mov byte [rbx + 0x68], al
movzx eax, byte [rbx + 2]
mov byte [rbx + 0x69], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 0x6a], al
movzx eax, byte [rbx]
mov byte [rbx + 0x6b], al
call fcn.180016440
movzx eax, byte [rbx + 0xb]
mov byte [rdi], al
movzx eax, byte [rbx + 0xa]
mov byte [rdi + 1], al
movzx eax, byte [rbx + 9]
mov byte [rdi + 2], al
movzx eax, byte [rbx + 8]
mov byte [rdi + 3], al
movzx eax, byte [rbx + 0xf]
mov byte [rdi + 4], al
movzx eax, byte [rbx + 0xe]
mov byte [rdi + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rdi + 6], al
movzx eax, byte [rbx + 0xc]
mov byte [rdi + 7], al
movzx eax, byte [rbx + 0x13]
mov byte [rdi + 8], al
movzx eax, byte [rbx + 0x12]
mov byte [rdi + 9], al
movzx eax, byte [rbx + 0x11]
mov byte [rdi + 0xa], al
movzx eax, byte [rbx + 0x10]
mov byte [rdi + 0xb], al
movzx eax, byte [rbx + 0x17]
mov byte [rdi + 0xc], al
movzx eax, byte [rbx + 0x16]
mov byte [rdi + 0xd], al
movzx eax, byte [rbx + 0x15]
mov byte [rdi + 0xe], al
movzx eax, byte [rbx + 0x14]
mov byte [rdi + 0xf], al
movzx eax, byte [rbx + 0x1b]
mov byte [rdi + 0x10], al
movzx eax, byte [rbx + 0x1a]
mov byte [rdi + 0x11], al
movzx eax, byte [rbx + 0x19]
mov byte [rdi + 0x12], al
movzx eax, byte [rbx + 0x18]
mov byte [rdi + 0x13], al
movzx eax, byte [rbx + 0x1f]
mov byte [rdi + 0x14], al
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 0x15], al
movzx eax, byte [rbx + 0x1d]
mov byte [rdi + 0x16], al
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 0x17], al
movzx eax, byte [rbx + 0x23]
mov byte [rdi + 0x18], al
movzx eax, byte [rbx + 0x22]
mov byte [rdi + 0x19], al
movzx eax, byte [rbx + 0x21]
mov byte [rdi + 0x1a], al
movzx eax, byte [rbx + 0x20]
mov byte [rdi + 0x1b], al
movzx eax, byte [rbx + 0x27]
mov byte [rdi + 0x1c], al
movzx eax, byte [rbx + 0x26]
mov byte [rdi + 0x1d], al
movzx eax, byte [rbx + 0x25]
mov byte [rdi + 0x1e], al
movzx eax, byte [rbx + 0x24]
mov rsi, qword [rsp + 0x30]
mov byte [rdi + 0x1f], al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18001bed0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1801a0080]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1801a0610]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x423d], 0
jne 0x18001bf38
cmp byte [rbx + 0x423e], 0
jne 0x18001bf38
movsx r9d, word [rbx + 0x5332]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.180022400
test sil, 1
je 0x18001c069
jmp 0x18001bfd1
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1800ccaec]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1800ccae0]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
or dword [rbx + 0x3f90], 1
mov qword [rbx + 0x3fa8], rax
movss dword [rbx + 0x3fa0], xmm0
mov dword [rbx + 0x3f94], 1
movss dword [rbx + 0x3fa4], xmm1
movss xmm0, dword [rbx + 0x38f4]
mov rax, qword [0x1801a0610]
mulss xmm0, dword [0x1800cca94]
or dword [rax + 0x3f90], 0x40
movss dword [rax + 0x3ff0], xmm0
movsx r9d, word [rbx + 0x5332]
call fcn.180022400
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x18001c021
lea r11, [0x1800c6e30]
cmp r9b, 0x23
jne 0x18001c004
cmp byte [r8], r9b
jne 0x18001c004
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18001bff1
not ecx
call fcn.180020af0
test rax, rax
je 0x18001c069
cmp byte [rax + 0x96], 0
je 0x18001c069
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5332]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x5332]
call fcn.180022400
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.180018d00
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800c2340
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1800209d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x1801a0610]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x180020a34
lea r10, [0x1800c6e30]
cmp r8b, 0x23
jne 0x180020a17
cmp byte [rdx], r8b
jne 0x180020a17
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x180020a04
mov eax, dword [r14 + 0x5390]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x180020a95
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x180020a5a
cmp edi, eax
jl 0x180020a74
mov r8d, 0x6f9
lea rdx, str.C:UsersuSerDesktopPas_External_V1.2.1Revoimguiimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [r14 + 0x5398]
cmp dword [rax + rbp + 8], ebx
je 0x180020ab2
mov eax, dword [r14 + 0x5390]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x180020a51
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x180020abf
cmp edi, dword [r14 + 0x5390]
jl 0x180020ad9
mov r8d, 0x6f9
lea rdx, str.C:UsersuSerDesktopPas_External_V1.2.1Revoimguiimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5398]
lea rax, [rax + rcx*8]
jmp 0x180020a97

Function at 0x180020b70
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x180020bc0
lea r11, [0x1800c6e30]
cmp r9b, 0x23
jne 0x180020ba3
cmp byte [r8], r9b
jne 0x180020ba3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180020b90
not ecx
jmp fcn.180020af0