joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800026a0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002747
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002747
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xe5b92878
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002742
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002720
cmp r8d, 0xc1c955c
je 0x18000274c
test r9d, r9d
jne 0x180002700
mov rax, qword [rax]
jmp 0x1800026d0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x30]
add rax, r10
call rax
movd xmm0, dword [rsp + 0x30]
mov rax, rsi
movd xmm2, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x38]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
cvtps2pd xmm1, xmm0
cvtps2pd xmm0, xmm2
movsd qword [rsi], xmm1
movsd qword [rsi + 8], xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180002b60
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x110
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180002c37
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180002c37
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xffa6c0e9
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002c32
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002c10
cmp r8d, 0xec541e5b
je 0x180002c3c
test r9d, r9d
jne 0x180002bf0
mov rax, qword [rax]
jmp 0x180002bc0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180013cf8]
addsd xmm8, qword [0x180013cf8]
movups xmm9, xmmword [0x180013c38]
movups xmm10, xmmword [0x18001a360]
movaps xmm11, xmmword [r14]
movaps xmm6, xmmword [rsi]
call fcn.1800024e0
cmp word [rax], 0
je 0x180002cb6
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180002ca0
xor edx, edx
add ecx, 1
je 0x180002cba
mov rdx, rax
jmp 0x180002cba
xor edx, edx
mov ecx, edx
mov rax, qword [0x1800167e8]
movaps xmm0, xmmword [0x180013f50]
mov rbx, qword [0x180016868]
mov qword [rsp + 0x20], rax
mov rax, qword [0x18001a818]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x100
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm11
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x180002d68
mov rax, qword [0x180016990]
lea r8, str.Canvas.K2_DrawText
add rax, 0x1216928
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18001a818], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x268]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r14
ret
Function at 0x180002dc0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x110
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180002e97
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180002e97
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x771dc864
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002e92
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002e70
cmp r8d, 0xceccbb22
je 0x180002e9c
test r9d, r9d
jne 0x180002e50
mov rax, qword [rax]
jmp 0x180002e20
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180013cf8]
addsd xmm8, qword [0x180013cf8]
movups xmm9, xmmword [0x180013c38]
movups xmm10, xmmword [0x18001a360]
movaps xmm11, xmmword [r14]
movaps xmm6, xmmword [rsi]
call fcn.1800024e0
cmp word [rax], 0
je 0x180002f16
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180002f00
xor edx, edx
add ecx, 1
je 0x180002f1a
mov rdx, rax
jmp 0x180002f1a
xor edx, edx
mov ecx, edx
mov rax, qword [0x1800167e8]
movaps xmm0, xmmword [0x180013f50]
mov rbx, qword [0x180016868]
mov qword [rsp + 0x20], rax
mov rax, qword [0x18001a818]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x101
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm11
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x180002fc8
mov rax, qword [0x180016990]
lea r8, str.Canvas.K2_DrawText
add rax, 0x1216928
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18001a818], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x268]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r14
ret
Function at 0x140001200
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
movzx r15d, r8w
mov rsi, rdx
mov r14d, ecx
movzx edi, bx
test rdx, rdx
je 0x140001235
movzx eax, di
cmp qword [rdx + rax*8], rbx
je 0x140001235
inc di
jmp 0x140001227
cmp dword [0x14000544c], ebx
mov qword [rsp + 0x70], rbp
je 0x140001312
movzx ecx, r15w
sub ecx, 1
je 0x140001274
sub ecx, 1
je 0x14000126b
cmp ecx, 2
je 0x140001262
lea rbp, str.Message
jmp 0x14000127b
lea rbp, str.Info
jmp 0x14000127b
lea rbp, str.Warning
jmp 0x14000127b
lea rbp, str.Error
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x78]
mov rdx, qword [0x140005458]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
mov r8d, r14d
mov ecx, 0x2900
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r8d, r14d
mov rdx, rbp
test eax, eax
jne 0x1400012ef
lea rcx, str._s_0x_X___No_message_available_nMessage_inserts_were
call fcn.140001840
movzx edi, di
test rdi, rdi
jle 0x14000130b
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rsi + rbx*8]
lea rcx, str._s_
call fcn.140001840
inc rbx
cmp rbx, rdi
jl 0x1400012d0
mov eax, 1
jmp 0x140001366
mov r9, qword [rsp + 0x78]
lea rcx, str._s_0x_X____s
call fcn.140001840
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x140001366
call fcn.140001390
lea rdx, str.Python_Service
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbp, rax
test rax, rax
je 0x140001366
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov qword [rsp + 0x38], rsi
mov r9d, r14d
mov dword [rsp + 0x30], ebx
movzx edx, r15w
mov word [rsp + 0x28], di
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, ebx
mov rbp, qword [rsp + 0x70]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140001390
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub rsp, 0x268
cmp dword [0x140005448], 0
jne 0x140001558
cmp word [0x140005240], 0
mov qword [rsp + 0x260], rbx
lea rbx, [0x140005240]
jne 0x1400013d3
mov rcx, qword [0x140005458]
mov r8d, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [str.SYSTEMCurrentControlSetServicesEventLogApplication_]
lea rax, [rsp + 0x50]
movaps xmm1, xmmword [0x140003420]
sub rax, 2
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [0x140003430]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x140003450]
movaps xmmword [rsp + 0x60], xmm1
movaps xmm1, xmmword [0x140003440]
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [0x140003470]
movaps xmmword [rsp + 0x80], xmm1
movaps xmm1, xmmword [0x140003460]
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm1
nop dword [rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140001440
lea r8, str.Python_Service
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [r8 + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x140001460
xor ecx, ecx
lea rax, [rsp + 0x278]
mov qword [rsp + 0x40], rcx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140001546
or rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400014c0
mov rcx, qword [rsp + 0x278]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.EventMessageFile
mov r9d, 1
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x278]
lea rax, [rsp + 0x270]
mov dword [rsp + 0x28], 4
lea rdx, str.TypesSupported
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x270], 7
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x260]
mov dword [0x140005448], 1
add rsp, 0x268
ret

Function at 0x140001f70
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140002001
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x140002001
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002001
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140001fe5
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140001fdf
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140001fe7
add rdx, 0x28
jmp 0x140001fc4
xor edx, edx
test rdx, rdx
jne 0x140001ff0
xor al, al
jmp 0x140002007
test dword [rdx + 0x24], 0x80000000
je 0x140001ffd
xor al, al
jmp 0x140002007
mov al, 1
jmp 0x140002007
xor al, al
jmp 0x140002007
add rsp, 0x18
ret
Function at 0x140002800
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000285d
lea rbx, [0x140034740]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002844
cmp r10, 2
jb 0x140002844
cmp byte [r9], r8b
jne 0x140002844
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002820
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000289f
lea rbx, [0x140034740]
cmp r8b, 0x23
jne 0x140002883
cmp byte [r9], r8b
jne 0x140002883
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002870
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140002a60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x140002a8f
mov r8d, 0x5f7
lea rdx, str.C:UsersDxrky_Downloadsimgui_menuimgui_menuimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x140002a9b
mov qword [rdi], 0
lea rdx, [0x1400343b0]
mov rcx, rbx
call fcn.1400028b0
mov rbx, rax
test rax, rax
jne 0x140002abd
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140002b94
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002b94
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140002b94
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002b94
cmp rsi, 0xffffffffffffffff
je 0x140002b94
mov rax, qword [0x14054f830]
test rax, rax
je 0x140002b31
inc dword [rax + 0x3fc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140002b94
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140002b81
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14054f830]
test rax, rax
je 0x140002b76
dec dword [rax + 0x3fc]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002b9d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140002b8f
mov qword [rdi], rsi
mov rax, rbp
jmp 0x140002b9f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140004790
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xc8], 0
mov rbx, rcx
mov edi, edx
jg 0x1400047c6
mov r8d, 0x68e
lea rdx, str.C:UsersDxrky_Downloadsimgui_menuimgui_menuimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd r8, dword [rbx + 0xc8]
mov rax, qword [rbx + 0xd0]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x140034740]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14054f830]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1b88], edx
jne 0x140004840
mov dword [rax + 0x1b8c], edx
cmp dword [rax + 0x1bc8], edx
jne 0x14000484f
mov byte [rax + 0x1bcc], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x140004c10
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x14054f830]
test rax, rax
je 0x140004c36
inc dword [rax + 0x3fc]
mov ecx, 0x3fd8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp + 0x40], rax
lea rcx, [rbp + 0x38]
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], rax
xor r14d, r14d
test rax, rax
je 0x140004c68
xor edx, edx
mov rcx, rax
call fcn.1400012a0
mov rbx, rax
jmp 0x140004c6b
mov rbx, r14
cmp qword [0x14054f830], 0
jne 0x140004c7c
mov qword [0x14054f830], rbx
cmp byte [rbx], 0
jne 0x140004c8a
cmp byte [rbx + 0x3139], 0
je 0x140004ca4
mov r8d, 0xfae
lea rdx, str.C:UsersDxrky_Downloadsimgui_menuimgui_menuimgui.cpp
lea rcx, str._g.Initialized___g.SettingsLoaded
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov dword [rbp - 0x4c], r14d
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x18], r14
lea rax, str.Window
mov qword [rbp - 0x58], rax
mov esi, 0xffffffff
mov edx, esi
mov r9b, 0x57
lea r8, [0x140031b19]
lea r15, [0x140034740]
cmp r9b, 0x23
jne 0x140004ce5
cmp byte [r8], r9b
jne 0x140004ce5
cmp byte [r8 + 1], r9b
cmove edx, esi
movzx ecx, dl
movzx eax, r9b
xor rcx, rax
shr edx, 8
xor edx, dword [r15 + rcx*4]
movzx r9d, byte [r8]
inc r8
test r9b, r9b
jne 0x140004cd3
not edx
mov dword [rbp - 0x50], edx
lea rax, [0x140014e70]
mov qword [rbp - 0x48], rax
lea rax, [0x140014f30]
mov qword [rbp - 0x38], rax
lea rax, [0x140014fb0]
mov qword [rbp - 0x30], rax
lea rax, [0x140015080]
mov qword [rbp - 0x28], rax
lea rax, [0x140015230]
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x58]
lea rcx, [rbx + 0x3150]
call fcn.140015830
mov dword [rbp - 0x4c], r14d
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x18], r14
lea rax, str.Table
mov qword [rbp - 0x58], rax
mov eax, esi
mov r9b, 0x54
lea r8, [0x140038719]
cmp r9b, 0x23
jne 0x140004d83
cmp byte [r8], r9b
jne 0x140004d83
cmp byte [r8 + 1], r9b
cmove eax, esi
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr eax, 8
xor eax, dword [r15 + rdx*4]
movzx r9d, byte [r8]
inc r8
test r9b, r9b
jne 0x140004d71
not eax
mov dword [rbp - 0x50], eax
lea rax, [0x140028dc0]
mov qword [rbp - 0x48], rax
lea rax, [0x140028f10]
mov qword [rbp - 0x38], rax
lea rax, [0x140028fb0]
mov qword [rbp - 0x30], rax
lea rax, [0x140028e80]
mov qword [rbp - 0x28], rax
lea rax, [0x140029230]
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x58]
lea rcx, [rbx + 0x3150]
call fcn.140015830
mov byte [rbx], 1
mov rax, rbx
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000f670
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x14054f830]
mov edi, edx
cmp byte [rbx + 0x205d], 0
jne 0x14000f6c1
cmp byte [rbx + 0x205e], 0
jne 0x14000f6c1
mov r9d, dword [rbx + 0x3100]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002780
test dil, 1
je 0x14000f7e6
jmp 0x14000f749
movss xmm1, dword [rbx + 0x165c]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x14003a4b4]
xor eax, eax
mulss xmm1, dword [0x14003a498]
addss xmm0, dword [rbx + 0x170]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0x174]
mov qword [rbx + 0x1bf8], rax
mov dword [rbx + 0x1be4], 1
movss dword [rbx + 0x1bf0], xmm0
movss dword [rbx + 0x1bf4], xmm1
movss xmm0, dword [rbx + 0x16c8]
mulss xmm0, dword [0x14003a42c]
or dword [rbx + 0x1be0], 0x41
movss dword [rbx + 0x1c40], xmm0
mov r9d, dword [rbx + 0x3100]
call fcn.140002780
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14000f7a0
lea r11, [0x140034740]
nop dword [rax]
cmp r9b, 0x23
jne 0x14000f783
cmp byte [r8], r9b
jne 0x14000f783
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14000f770
not ecx
call fcn.140009050
test rax, rax
je 0x14000f7e6
cmp byte [rax + 0x8e], 0
je 0x14000f7e6
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xac], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3100]
mov edx, 0x10
mov r9d, dword [rbx + 0x3100]
call fcn.140002780
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000b210
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400142d0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x14054f830]
cmp byte [rbx + 0x3190], 0
je 0x1400143bc
cmp qword [rbx + 0x3198], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x31a0]
je 0x1400143a4
mov r9d, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test r9d, r9d
jns 0x14001434b
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140016280
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov dword [rdi], ebp
mov rcx, rdi
mov r8, rsi
call fcn.140002f30
mov eax, dword [rdi]
lea rcx, [0x14054f828]
mov r9, qword [rbx + 0x3198]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rbx + 0x31a8]
cmove edx, ebp
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.140002f30
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
Function at 0x140030214
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003025e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003025e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003025e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003025e
cmp dword [rcx + 0x84], 0xe
jbe 0x14003025e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140030260
xor al, al
add rsp, 0x28
ret