joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140eb6558
Capabilities:
Encode data using xor

Disassembly:
call fcn.140eb08f5
call fcn.140886e18
lea rbx, [r15 + 0x62c83ef1]
sete r15b
and r15d, 0x2c91d22
test r15d, 0x73e21203
sets r15b
sub r15d, 0x24365032
and bx, 0x7ca9
xor bx, 0x438c
not ebx
and rbx, 0x1d234fdf
test bh, bl
jg 0x140eba576
enter 0x6264, 0x75
invalid
mov rbx, qword [rsp + 0x18]
movzx r15d, r15w
cmp r15w, 0x4412
jge 0x140e84360
not r15
mov r15d, 0x4985d13
and r15d, 0x227b3be2
bswap r15
neg r15b
jl 0x14085547b
call fcn.140ec78f3

Function at 0x140eba629
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x70], 0x4f0d40d5
jo 0x140ea8c75
add qword [rsp + 0x40], 0x1c09651e
mov qword [rsp + 0x70], 0x69256ac4
xor qword [rsp + 0x40], 0xdae650e
xor dword [rsp + 0x40], 0x504a3e00
setge cl
not cl

Function at 0x140eba6b2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movabs rcx, 0x18a750e07b81ec9
not r12
add r12b, 0xbd
push r11
or rcx, r12
sub r12d, ecx
setle r12b
bswap rcx
mov r12, qword [rsp + 0x10]
mov r11, rcx
movabs r11, 0x581322e8154c2e27
not cl
neg r11w
not cx
call fcn.140ea84c0
sub dword [rdi], edx
xchg esi, eax
pop rsp
idiv byte [rdi]
loop 0x140836edb
invalid
push 0x5b
sub esp, dword [rdx]
movabs byte [0x6338ec59b69cc7f2], al
outsd dx, dword [rsi]
ret
jge 0x140836e68
xor cl, r11b
xor r11d, r11d
lea r11, [rcx*4 + 0x399e0406]
mov rcx, qword [rsp + 0x18]
not r11w
jno 0x140d5880e
invalid
or r12w, 0x5cd6
add r12b, r12b
sub r12d, 0x2613300d
ret
call fcn.140826697
jb 0x14083e16f
jb 0x140865c9c
add qword [rsp + 0x20], 0xffffffffbf7d9950
push qword [rsp + 0x58]
popfq
lea rsp, [rsp + 0x60]
call fcn.14109b8b8
or dword [rbx + 0x1a], edi
xor bpl, byte [r8 - 0x13df21e1]
stosb byte [rdi], al
cli
push rsi
lea edx, [rcx - 0x4d1e13d]
xchg dword [rbx], eax
pop rdi
movabs eax, dword [0xa7ca1eb7c90e77fb]
fimul dword [0xdd8b0a0a]
jrcxz 0x140eba70d
invalid
invalid

Function at 0x140ebd8bb
Capabilities:
Check for software breakpoints

Disassembly:
jl 0x140eccf42
add cl, bl
mov dword [rsp + 0x68], 0x2ea54f93
jle 0x14088df82
invalid

Function at 0x140eccf16
Capabilities:
Check for software breakpoints

Disassembly:
lea r11, [r8*8 + 0x3880655b]
add word [rsp + 0x58], 0x355d
setne byte [rsp + 0x58]
cmp byte [rsi - 0x7f], ah
and al, 0x58
pop rbp
xor eax, 0x2444950f
pop rax
and al, 0x58
mov bl, 0xa8
or r8w, r11w
mov cx, 0x8ab
setbe cl
add r11, 0x62710f99
setl r11b
mov r11, qword [rsp + 0x68]
cmovno bx, word [rsp + 0x5b]
neg rcx
jbe 0x140f8f6b8
jle 0x140eccf8b
jp 0x140eccf1d
and bl, byte [rbx - 0x16437432]
and bl, cl
jne 0x140eccf27
sbb edx, ebx
push rbx
ja 0x140eccf6c
popfq
lahf
out 0x82, eax
cmp al, 0xe9
xchg ebx, eax
or al, byte [rdi - 0x7e1e0704]
invalid
invalid
sub esp, 0xffffffcf
loope fcn.140eccf16
cmp al, 0xcc
push rbp
mov dword es:[rbx + rbp - 0x3c88ce1c], edi
retf
Function at 0x140ed2dfd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sete r11b
jae 0x140881396
test r11w, 0x2b51
je 0x140fa7df1
mov r11, qword [rsp + 0x18]
neg r14d
mov r14d, 0x70751623
setl r11b
add r14, r14
not r11b
xor r11, 0x48a8557f
add r11w, r14w
not r11w
sub r11b, 0x61
not r11w
setl r14b
cmp r11w, 0x2fc0
lea r11, [r11 + 0x7d1d171a]
not r11b
not r11w
jbe 0x140e98a8b
js 0x140ed2eaf
invalid
cmp dl, byte [rbp + 0x5e]
test cl, ch
cmp al, cl
pop rsi
xchg edi, eax
rcl byte [rdx]
invalid
scasd eax, dword [rdi]
cmp byte [0x1b9211a22], cl
push rsi
jae 0x140ed2ea2
invalid

Function at 0x140eda2da
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not r15w
call fcn.1408da30c
jb 0x1408d4ace
jbe 0x140843c14

Function at 0x140f8d727
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r13
mov ebp, 0x35134f1f
call fcn.14086d4cb
not di
movabs r12, 0x62142a9a4af46d56
movabs r11, 0x3a162a531466187
movsx r12d, r8w
pop r10
cmovo r14w, word [rsp + 0x31]
movsx r14, r12w
pop rdi
lea r11, [r8 + r14*2 + 0x65ea10a1]
call fcn.1408e0c6a

Function at 0x140f95e76
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r11
jge 0x140ebcb27
mov rcx, qword [rsp + 0x38]
or r8d, ecx
movzx r8d, word [rsp + 0x1c]
push rsi
movabs rbx, 0x396d54e51d821a11
push rcx
jne 0x1408a36e3

Function at 0x140f97034
Capabilities:
Encode data using xor

Disassembly:
mov r11, qword [rsp + 0x28]
mov qword [rsp + 0x28], 0x7d7ae649
movabs r13, 0x4294390c386860ba
movsxd rdi, edi
not di
push rcx
push rbx
movabs rbx, 0x1f9b3009712005e4
or rbx, qword [rsp + 0x18]
not r13b
sub qword [rsp + 0x18], 0x703d7675
ja 0x140fa4afd
lea r10, [rsi + r10*8 + 0x26fd5a32]
bswap esi
movsxd rsi, r11d
setl dl
neg r11b
add r10w, 0x7ed
test edx, edx
jae 0x140f96c4b
bswap ebx
mov rcx, qword [rsp + 0x18]
sub dword [rsp + 0x18], 0x63805450
not bx
add qword [rsp + 0x10], 0xffffffffffff7b17
push r10
not r13
push r14
mov r14, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x18]
and r14w, word [rsp + 0x2e]
mov r10, rdi
cmova r14d, r13d
mov rbx, qword [rsp + 0x10]
mov r10, qword [rsp + 8]
mov r14, qword [rsp]
lea rsp, [rsp + 0x20]
ret 8
Function at 0x140f9d54a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r10, qword [rsp + 0x48]
jae 0x1408db1d7
invalid

Function at 0x140fa8ec7
Capabilities:
Encode data using xor

Disassembly:
test ebp, 0x730959eb
setns cl
bswap rcx
or ebp, ecx
mov word [rsp + 0x28], bp
xor word [rsp + 0x28], 0x64ba
not rcx
mov rbp, qword [rsp + 0x18]
cmp byte [rsp + 0x28], 0xf4
setge byte [rsp + 0x28]
movzx ecx, cl
jb 0x140ea1a10
call fcn.140ec63b3
jno 0x140e812ee

Function at 0x140fa9557
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg dword [rsp + 0x70]
sub byte [rsp + 0x78], 0x85
test byte [rsp + 0x40], 0x7a
not r15w
jbe 0x14083ab2b
xor eax, 0x51e8fffb
test al, 0xfd
call qword [rdi - 0x6232a261]
call fcn.140861e63
xchg edi, eax
lahf
pop rbp
int 0x9d
clc
xor al, 0xb0
adc al, 0xc2
cmc
pop rsi
mov dl, 0x34
scasd eax, dword [rdi]
jp 0x14088760a
mov bh, 0x14
js 0x140887675
retfq
sbb r10, qword [r11 + 0x7c]
retf
or dx, word [rsp + 0x38]
xor edx, r14d
sub rcx, 0x48462ad9
mov rdx, qword [rsp + 0xa8]
movsx r14, byte [rsp + 0x40]
xor word [rsp + 0x80], 0x57b4
xor qword [rsp + 0x78], rcx
setbe r14b
mov byte [rsp + 0x38], 0xa0
neg cl
and r15, r15
test r13b, r13b
not qword [rsp + 0x40]
jge 0x1408875f5

Function at 0x140fa959f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dword [rsp + 0x58], 0x5ef27afb
not dword [rsp + 0x58]
jno 0x1408927aa
js 0x140fa95d2
push rsi
jl 0x140fa95c2
invalid
mov esi, 0xca56a76c
test al, 0x89
invalid
xchg dword [rbp - 0x7b9de7f9], eax
mov bl, 0xe5
invalid

Function at 0x140fb21fc
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
and dword [rsp + 0x28], 0x306418ec
neg dx
mov rdx, qword [rsp + 0x18]
add qword [rsp + 0x10], 0xffffffffbf791d6c
xor qword [rsp + 0x28], r15
lea r15, [r15*2 + 0x2f68066a]
xor dword [rsp + 0x28], 0x684a47e3
call fcn.140f96d16
invalid
jno 0x140f95d1c
Function at 0x140003a90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x70
cmp qword [rcx + 0xe30], 0
mov rbx, rcx
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
movaps xmmword [rsp + 0x50], xmm7
movaps xmm7, xmm2
jne 0x140003ad1
mov r8d, 0x614
lea rdx, str.C:Users_adminDesktopYeagerSpoofer___v2.0YeagerSpoofer___v2.0imgui.cpp
lea rcx, str.Ctx___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp byte [rbx + 0x38c9], 0
mov rbp, qword [rbx + 0xe30]
je 0x140003ca0
movss xmm1, dword [0x14014fab4]
xorps xmm2, xmm2
comiss xmm7, xmm1
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x90], r14
jbe 0x140003b25
comiss xmm7, xmm2
cvttss2si eax, xmm7
jae 0x140003b1e
movd xmm0, eax
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm7
jp 0x140003b1c
je 0x140003b1e
dec eax
movd xmm7, eax
cvtdq2ps xmm7, xmm7
comiss xmm6, xmm1
jbe 0x140003b4a
comiss xmm6, xmm2
cvttss2si eax, xmm6
jae 0x140003b43
movd xmm0, eax
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm6
jp 0x140003b41
je 0x140003b43
dec eax
movd xmm6, eax
cvtdq2ps xmm6, xmm6
lea r14, [rbp + 0x3f78]
mov qword [rsp + 0x88], rdi
mov ebx, dword [r14]
sub ebx, 1
movsxd rsi, ebx
js 0x140003ba1
imul rdi, rsi, 0x1c
cmp ebx, dword [r14]
jl 0x140003b87
mov r8d, 0x793
lea rdx, str.C:Users_adminDesktopYeagerSpoofer___v2.0YeagerSpoofer___v2.0imgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [r14 + 8]
cmp dword [rdi + rax], 1
je 0x140003c37
dec ebx
sub rdi, 0x1c
sub rsi, 1
jns 0x140003b68
movsd xmm0, qword [rbp + 0xe40]
lea rax, [rsp + 0x28]
movsd qword [rsp + 0x28], xmm0
movss xmm0, dword [rax]
ucomiss xmm0, xmm6
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
movss xmm1, dword [rax + 4]
jp 0x140003bdf
jne 0x140003bdf
ucomiss xmm1, xmm7
jp 0x140003bdf
je 0x140003c98
mov eax, dword [rbp + 0x3f9c]
mov dword [rsp + 0x38], eax
inc eax
mov dword [rbp + 0x3f9c], eax
mov ecx, dword [r14]
mov r8d, dword [r14 + 4]
mov eax, dword [rbp + 0x3f98]
movss dword [rsp + 0x3c], xmm6
movss dword [rsp + 0x40], xmm7
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x44], eax
cmp ecx, r8d
jne 0x140003c6d
inc ecx
test r8d, r8d
je 0x140003c59
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140003c5e
movss xmm0, dword [rdi + rax + 0xc]
movss xmm1, dword [rdi + rax + 0x10]
lea rax, [rsp + 0x20]
movss dword [rsp + 0x20], xmm0
movss dword [rsp + 0x24], xmm1
jmp 0x140003bb4
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, r14
call fcn.140020fe0
movsxd rax, dword [r14]
movups xmm0, xmmword [rsp + 0x30]
movsd xmm1, qword [rsp + 0x40]
imul rcx, rax, 0x1c
mov rax, qword [r14 + 8]
movups xmmword [rcx + rax], xmm0
movsd qword [rcx + rax + 0x10], xmm1
mov dword [rcx + rax + 0x18], 0
inc dword [r14]
mov r14, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x50]
add rsp, 0x70
pop rbp
ret
Function at 0x1400041b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000420d
lea rbx, [0x1400e7170]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400041f4
cmp r10, 2
jb 0x1400041f4
cmp byte [r9], r8b
jne 0x1400041f4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400041d0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000424f
lea rbx, [0x1400e7170]
cmp r8b, 0x23
jne 0x140004233
cmp byte [r9], r8b
jne 0x140004233
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140004220
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x1400043f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov rbx, rcx
test rcx, rcx
jne 0x140004425
mov r8d, 0x837
lea rdx, str.C:Users_adminDesktopYeagerSpoofer___v2.0YeagerSpoofer___v2.0imgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor r14d, r14d
test rsi, rsi
je 0x140004430
mov qword [rsi], r14
lea rdx, [0x1400e6938]
mov rcx, rbx
call fcn.140004260
mov rbx, rax
test rax, rax
jne 0x140004458
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140004582
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004582
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140004582
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004582
cmp rdi, 0xffffffffffffffff
je 0x140004582
mov rcx, rdi
call fcn.1400087e0
mov rbp, rax
test rax, rax
je 0x140004582
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000456f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x14016a730]
test r8, r8
je 0x140004564
movsx rdx, word [r8 + 0x60f0]
lea rcx, [r8 + 0x60f4]
mov r9d, dword [r8 + 0x3f58]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x140004559
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rcx, [r8 + 0x60f4]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x60ec]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000458b
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x14000457d
mov qword [rsi], rdi
mov rax, rbp
jmp 0x14000458d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140013330
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x100], 0
mov rsi, rcx
movsxd rdi, edx
jg 0x14001336c
mov r8d, 0x79c
lea rdx, str.C:Users_adminDesktopYeagerSpoofer___v2.0YeagerSpoofer___v2.0imgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rsi + 0x108]
lea rdx, [0x1400e7170]
movsxd r8, dword [rsi + 0x100]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [rsi]
not ebx
cmp dword [rcx + 0x404c], ebx
jne 0x1400133e7
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.14001f880
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140018560
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x14016a730]
mov edi, ecx
cmp byte [rbx + 0x4d4d], 0
jne 0x1400185b2
cmp byte [rbx + 0x4d4e], 0
jne 0x1400185b2
movsx r9d, word [rbx + 0x5eb8]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140003f90
test dil, 2
je 0x1400186df
jmp 0x14001863b
movss xmm1, dword [rbx + 0x39bc]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x14014fa24]
xor eax, eax
mulss xmm1, dword [0x14014fa14]
addss xmm0, dword [rbx + 0xe40]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0xe44]
mov qword [rbx + 0x4a18], rax
mov dword [rbx + 0x4a04], 1
movss dword [rbx + 0x4a10], xmm0
movss dword [rbx + 0x4a14], xmm1
movss xmm0, dword [rbx + 0x3a18]
mulss xmm0, dword [0x14014f960]
or dword [rbx + 0x4a00], 0x41
movss dword [rbx + 0x4a60], xmm0
movsx r9d, word [rbx + 0x5eb8]
call fcn.140003f90
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140018690
lea r11, [0x1400e7170]
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x140018673
cmp byte [r8], r9b
jne 0x140018673
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140018660
not ecx
call fcn.14000c5a0
test rax, rax
je 0x1400186df
cmp byte [rax + 0xbe], 0
je 0x1400186df
mov byte [rax + 0xc3], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xc5], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xe4], 1
mov edx, reloc.WS2_32.dll_recv
inc word [rbx + 0x5eb8]
movsx r9d, word [rbx + 0x5eb8]
call fcn.140003f90
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.14000f630
mov rbx, qword [rsp + 0x40]
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x14001e080
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x6010], 0
lea rbx, [rcx + 0x6018]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001e127
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001e0da
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140020bb0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140004ba0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x6010]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x6020]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14016a728]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001e12f
mov rcx, rbx
call fcn.140004ba0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14001e470
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x20
mov rbx, qword [0x14016a730]
xor ebp, ebp
cmp byte [rbx + 0x5f68], bpl
jne 0x14001e56c
cmp dword [rbx + 0x5f90], ebp
je 0x14001e4b7
mov r8d, 0x349d
lea rdx, str.C:Users_adminDesktopYeagerSpoofer___v2.0YeagerSpoofer___v2.0imgui.cpp
lea rcx, str.g.SettingsWindows.empty__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14001e565
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.1400043f0
mov rdi, rax
test rax, rax
je 0x14001e565
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x14001e4f1
mov rcx, rax
call fcn.14001e6c0
mov r8, qword [0x14016a730]
test r8, r8
je 0x14001e55c
movsx rdx, word [r8 + 0x60f0]
lea rcx, [r8 + 0x60f4]
mov r9d, dword [r8 + 0x3f58]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x14001e551
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rcx, [r8 + 0x60f4]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x60ec]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x5f68], 1
movss xmm0, dword [rbx + 0x5f6c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14001e609
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5f6c], xmm0
jb 0x14001e609
mov rdi, qword [rbx + 0x20]
mov qword [rsp + 0x38], rsi
test rdi, rdi
je 0x14001e5f7
mov rax, qword [0x14016a730]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5f6c], ebp
call fcn.14001e940
lea rdx, [0x1400e693c]
mov rcx, rdi
mov rsi, rax
call fcn.140004260
mov rdi, rax
test rax, rax
je 0x14001e5fe
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14001e5fe
mov byte [rbx + 0xce], 1
mov rsi, qword [rsp + 0x38]
mov dword [rbx + 0x5f6c], ebp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001e620
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14016a730]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001e683
mov qword [rsp], rbx
lea rbx, [0x1400e7170]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001e663
cmp byte [r8], r9b
jne 0x14001e663
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001e650
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f80]
not eax
mov r8, qword [r10 + 0x5f88]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x14001e6af
cmp dword [r8 + 8], eax
je 0x14001e6b6
add r8, 0x48
cmp r8, rcx
jne 0x14001e6a0
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x140043f30
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x140
mov rbx, rcx
xor eax, eax
mov dword [rsp + 0x30], eax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
lea ecx, [rax + 0x20]
call fcn.1400cd26c
mov qword [rbx], rax
mov qword [rbx + 0x10], reloc.WS2_32.dll_recvfrom
mov qword [rbx + 0x18], Ordinal_35
movups xmm0, xmmword [str.Unknown_Processor]
movups xmmword [rax], xmm0
movzx ecx, byte [0x14014d0d0]
mov byte [rax + 0x10], cl
mov byte [rax + 0x11], 0
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140044035
mov dword [rsp + 0x158], 0x100
lea rax, [rsp + 0x158]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProcessorNameString
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140044027
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140044010
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14005f2c0
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
add rsp, 0x140
pop rbx
ret

Function at 0x140044050
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x140
mov rbx, rcx
xor eax, eax
mov dword [rsp + 0x30], eax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
lea ecx, [rax + 0x20]
call fcn.1400cd26c
mov qword [rbx], rax
mov qword [rbx + 0x10], reloc.WS2_32.dll_send
mov qword [rbx + 0x18], Ordinal_35
movups xmm0, xmmword [str.Unknown_Motherboard]
movups xmmword [rax], xmm0
movzx ecx, word [0x14014d130]
mov word [rax + 0x10], cx
movzx ecx, byte [0x14014d132]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14004415a
mov dword [rsp + 0x158], 0x100
lea rax, [rsp + 0x158]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BaseBoardProduct
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14004414c
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140044135
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14005f2c0
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
add rsp, 0x140
pop rbx
ret