joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140041dd0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret

Function at 0x140041e90
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x860
mov rax, qword [0x14020b948]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rbp, rdx
mov qword [rsp + 0x28], rdx
xor r14d, r14d
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_GetWindowTextW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0x50]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x140041ef4
movabs rsi, 0x7ffffffffffffffe
cmp rbx, rsi
ja 0x140042012
mov qword [rsp + 0x48], 7
cmp rbx, 8
jae 0x140041f42
mov qword [rsp + 0x40], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.1400fe780
mov word [rsp + rbx + 0x30], r14w
jmp 0x140041f95
mov rax, rbx
or rax, 7
cmp rax, rsi
ja 0x140041f5d
mov rsi, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rsi, rcx
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x30]
call fcn.14002e340
mov rdi, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400fe780
mov word [rbx + rdi], r14w
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.14003a160
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140041fe1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041fdc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004200c
call fcn.1400fc768
mov rax, rbp
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1400fc880
lea r11, [rsp + 0x860]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1401033e4
int3
call fcn.140008eb0
int3
Function at 0x140044bc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r9
mov r15, r8
mov r14, rdx
mov rdi, rcx
mov r9, qword [rcx]
sub r14, r9
mov rax, qword [rcx + 8]
sub rax, r9
sar rax, 6
movabs rbx, 0x3ffffffffffffff
cmp rax, rbx
je 0x140044d44
lea r8, [rax + 1]
mov qword [rsp + 0x30], r8
mov rcx, qword [rcx + 0x10]
sub rcx, r9
sar rcx, 6
mov rdx, rcx
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp rcx, rax
ja 0x140044c41
lea rbx, [rdx + rcx]
cmp rbx, r8
cmovb rbx, r8
mov qword [rsp + 0x28], rbx
mov rdx, rbx
mov rcx, rdi
call fcn.140047180
mov rsi, rax
mov qword [rsp + 0x40], rax
and r14, 0xffffffffffffffc0
add r14, rax
lea r12, [r14 + 0x40]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x48], r14
xor ecx, ecx
mov qword [r14], rcx
mov qword [r14 + 8], rcx
mov rax, qword [r15]
mov qword [r14], rax
mov rax, qword [r15 + 8]
mov qword [r14 + 8], rax
mov qword [r15], rcx
mov qword [r15 + 8], rcx
mov rdx, r13
lea rcx, [r14 + 0x10]
call fcn.140005f90
mov eax, dword [r13 + 0x20]
mov dword [r14 + 0x30], eax
mov eax, dword [r13 + 0x24]
mov dword [r14 + 0x34], eax
mov eax, dword [r13 + 0x28]
mov dword [r14 + 0x38], eax
movzx eax, byte [r13 + 0x2c]
mov byte [r14 + 0x3c], al
movzx eax, byte [r13 + 0x2d]
mov byte [r14 + 0x3d], al
movzx eax, byte [r13 + 0x2e]
mov byte [r14 + 0x3e], al
mov qword [rsp + 0x20], r14
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi]
mov r15, qword [rsp + 0x88]
cmp r15, rdx
jne 0x140044cee
mov r12, rsi
jmp 0x140044d08
mov r9, rdi
mov r8, rsi
mov rdx, r15
call fcn.140045ed0
mov qword [rsp + 0x20], rsi
mov rcx, r15
mov rdx, qword [rdi + 8]
mov r9, rdi
mov r8, r12
call fcn.140045ed0
nop
mov r9, rbx
mov r8, qword [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
call fcn.140046da0
mov rax, r14
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14001b430
int3
Function at 0x14009f670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x14009f6a4
cmp ecx, r10d
jge 0x14009f692
mov rcx, rbx
call fcn.140098fb0
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x14009f6de
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x14009f6c0
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x14009f70d
mov edx, dword [0x140215138]
mov rax, qword gs:[0x58]
mov ecx, 0x20
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x14009f73f
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
nop dword [rax]
cmp rax, r8
jb 0x14009f729
xor dl, dl
jmp 0x14009f732
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x14009f720
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x14009f6e2
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x14009f7b4
mov edx, dword [0x140215138]
mov rax, qword gs:[0x58]
mov ecx, 0x20
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x14009f7ce
mov rcx, rbx
call fcn.1400a49a0
test eax, eax
je 0x14009f7a7
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.1400fe780
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1400ad810
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, qword [0x140214710]
movzx esi, r9b
mov r12d, dword [rsp + 0x90]
mov r14d, edx
movaps xmmword [rsp + 0x30], xmm6
mov rbx, qword [rdi + 0x4018]
mov eax, dword [rbx + 0x14]
and eax, 4
or eax, 0x1200103
or r12d, eax
cmp qword [rbx + 0x1e0], 0
jne 0x1400ad86f
cmp qword [rdi + 0x4d10], 0
mov eax, 0x288
je 0x1400ad874
mov eax, 0x258
movss xmm4, dword [rax + rbx]
xorps xmm3, xmm3
movss xmm5, dword [rax + rbx + 4]
cvttss2si eax, dword [r8]
subss xmm4, dword [rbx + 0x138]
subss xmm5, dword [rbx + 0x13c]
movd xmm1, eax
cvttss2si eax, dword [r8 + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm3
cvtdq2ps xmm0, xmm0
jp 0x1400ad8b9
jne 0x1400ad8b9
mov eax, 1
jmp 0x1400ad8bb
xor eax, eax
ucomiss xmm0, xmm3
jp 0x1400ad8ca
jne 0x1400ad8ca
mov r15d, 2
jmp 0x1400ad8cd
xor r15d, r15d
movss xmm2, dword [0x1401c130c]
or r15d, eax
comiss xmm3, xmm1
jb 0x1400ad8e9
addss xmm1, xmm4
comiss xmm1, xmm2
jae 0x1400ad8e9
movaps xmm1, xmm2
comiss xmm3, xmm0
jb 0x1400ad8fa
addss xmm0, xmm5
comiss xmm0, xmm2
jae 0x1400ad8fa
movaps xmm0, xmm2
or dword [rdi + 0x48f8], 2
xor edx, edx
movss dword [rdi + 0x491c], xmm1
movss dword [rdi + 0x4920], xmm0
mov dword [rdi + 0x4900], 1
mov r9, qword [rbx + 8]
test rcx, rcx
je 0x1400ad943
mov dword [rsp + 0x28], r14d
lea r8, str._s__s__08X
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x70]
call fcn.1400bd910
jmp 0x1400ad959
lea r8, str._s__08X
mov dword [rsp + 0x20], r14d
lea rcx, [rsp + 0x70]
call fcn.1400bd910
movss xmm6, dword [rdi + 0x3908]
test sil, sil
jne 0x1400ad970
mov dword [rdi + 0x3908], 0
mov rcx, qword [rsp + 0x70]
mov r8d, r12d
xor edx, edx
call fcn.1400aaaa0
mov rsi, qword [rdi + 0x4018]
movzx ebp, al
movss dword [rdi + 0x3908], xmm6
cmp word [rsi + 0xf8], 1
mov dword [rsi + 0xb4], r14d
mov byte [rsi + 0x10a], r15b
jne 0x1400ad9b6
movsd xmm0, qword [rsi + 0x50]
movsd qword [rbx + 0x138], xmm0
mov r9d, r14d
lea rdx, [0x1401c2b21]
not r9d
lea r10, [0x1401c16a0]
mov ebx, r9d
mov r8b, 0x23
cmp r8b, 0x23
jne 0x1400ad9e3
cmp byte [rdx], r8b
jne 0x1400ad9e3
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x1400ad9d0
not ebx
cmp dword [rdi + 0x4078], ebx
jne 0x1400ada13
xor edx, edx
xor ecx, ecx
call fcn.1400ca8f0
cmp dword [rdi + 0x4aa8], r14d
jne 0x1400ada60
bt r12d, 0x17
jb 0x1400ada60
cmp word [rsi + 0x194], 0
jne 0x1400ada36
cmp byte [rsi + 0x19a], 0
je 0x1400ada60
xor edx, edx
mov rcx, rsi
call fcn.1400bc0e0
xor edx, edx
mov rcx, rsi
call fcn.1400c0380
mov rdx, rsi
mov ecx, ebx
call fcn.1400ca8f0
mov eax, dword [rdi + 0x4acc]
mov dword [rdi + 0x40a0], eax
mov rbx, qword [rsp + 0x78]
movzx eax, bpl
mov rbp, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400ae5a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, qword [0x140214710]
xor r15d, r15d
mov ebp, ecx
mov r14d, r15d
mov rbx, qword [rsi + 0x4018]
test cl, 0x10
jne 0x1400ae718
mov edi, dword [rsi + 0x48b8]
test edi, edi
je 0x1400ae617
cmp dword [rsi + 0x4078], edi
jne 0x1400ae711
mov eax, dword [rsi + 0x40a4]
cmp eax, 0xffffffff
cmove eax, r15d
movsxd r15, eax
cmp byte [r15 + rsi + 0xe10], r14b
je 0x1400ae711
cmp byte [rbx + 0xf0], r14b
jmp 0x1400ae6d9
cmp byte [rsi + 0xe10], r14b
je 0x1400ae711
cmp byte [rbx + 0xf0], r14b
jne 0x1400ae711
test byte [rsi + 0x48c0], 1
jne 0x1400ae654
cmp dword [rsi + 0x4078], r14d
je 0x1400ae711
cmp qword [rsi + 0x4098], rbx
jne 0x1400ae711
test bpl, 8
je 0x1400ae711
lea rdx, [rsi + 0x48c4]
mov rcx, rbx
call fcn.1400bc980
mov edi, eax
mov dword [rsi + 0x48b8], eax
mov rax, qword [0x140214710]
cmp dword [rax + 0x4078], edi
jne 0x1400ae68a
mov dword [rax + 0x407c], edi
cmp dword [rax + 0x40a8], edi
jne 0x1400ae699
mov byte [rax + 0x40ac], 1
mov r8d, dword [rsi + 0x48bc]
lea rcx, [rsi + 0x48c4]
mov edx, edi
call fcn.1400bf6c0
movzx r14d, al
test al, al
je 0x1400ae6d3
cmp byte [rsi + 0x3750], r15b
je 0x1400ae6d3
mov rdx, rbx
mov ecx, edi
call fcn.1400ca8f0
xor edx, edx
mov rcx, rbx
call fcn.1400bc0e0
cmp dword [rsi + 0x4078], edi
jne 0x1400ae711
mov byte [rsi + 0x4085], r14b
movsxd rcx, dword [rbx + 0x128]
mov rax, qword [rbx + 0x130]
movss xmm1, dword [0x140141f34]
mov r14d, dword [rax + rcx*4 - 4]
mov ecx, r15d
call fcn.1400bf080
movzx ebx, al
call fcn.1400caa50
test bl, bl
jne 0x1400ae765
xor al, al
jmp 0x1400ae805
mov r9d, 0xffffffff
lea rdx, [0x1401c3129]
mov edi, r9d
lea r10, [0x1401c16a0]
mov r8b, 0x23
cmp r8b, 0x23
jne 0x1400ae745
cmp byte [rdx], r8b
jne 0x1400ae745
cmp byte [rdx + 1], r8b
cmove edi, r9d
movzx ecx, dil
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr edi, 8
inc rdx
xor edi, dword [r10 + rcx*4]
test r8b, r8b
jne 0x1400ae732
not edi
cmp byte [rsi + 0x4c58], 0
jne 0x1400ae7a3
call fcn.1400afd90
mov dword [rsi + 0x4c74], edi
mov dword [rsi + 0x4c78], r14d
mov byte [rsi + 0x4c58], 1
mov dword [rsi + 0x4c5c], ebp
mov dword [rsi + 0x4c64], r15d
cmp edi, dword [rsi + 0x4078]
jne 0x1400ae7a3
mov byte [rsi + 0x4086], 1
mov eax, dword [rsi + 0x3f70]
mov dword [rsi + 0x4c60], eax
mov byte [rsi + 0x4c59], 1
test bpl, 1
jne 0x1400ae7f6
xor edx, edx
xor ecx, ecx
call fcn.1400aea20
cmp dword [rsi + 0x4cc8], 0
je 0x1400ae7f6
test dword [rsi + 0x4cbc], 0x1000
je 0x1400ae7f6
mov rax, qword [rsi + 0x4018]
mov byte [rax + 0xf0], 1
mov byte [rax + 0xf2], 1
mov byte [rax + 0x110], 1
test bpl, 0x12
jne 0x1400ae803
and dword [rsi + 0x48c0], 0xfffffffe
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400aea20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14020b948]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140214710]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x4c59], 0
jne 0x1400aea88
cmp byte [rbx + 0x4c5a], 0
jne 0x1400aea88
movsx r9d, word [rbx + 0x5d8c]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.1400bd890
test sil, 2
je 0x1400aebc7
jmp 0x1400aeb28
movss xmm1, dword [rbx + 0x39a8]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1401bfa64]
xor eax, eax
mov edx, 0x10
mulss xmm1, dword [0x140141f10]
addss xmm0, dword [rbx + 0xe08]
addss xmm1, dword [rbx + 0xe0c]
or dword [rbx + 0x48f8], 1
mov qword [rbx + 0x4914], rax
movss dword [rbx + 0x490c], xmm0
mov dword [rbx + 0x48fc], 1
movss dword [rbx + 0x4910], xmm1
mov byte [rbx + 0x4934], 1
movss xmm0, dword [rbx + 0x3a04]
mov rax, qword [0x140214710]
mulss xmm0, dword [0x140140650]
or dword [rax + 0x48f8], 0x40
movss dword [rax + 0x4958], xmm0
movsx r9d, word [rbx + 0x5d8c]
call fcn.1400bd890
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400aeb78
lea r11, [0x1401c16a0]
cmp r9b, 0x23
jne 0x1400aeb5b
cmp byte [r8], r9b
jne 0x1400aeb5b
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400aeb48
not ecx
call fcn.1400bbca0
test rax, rax
je 0x1400aebc7
cmp byte [rax + 0xeb], 0
je 0x1400aebc7
mov byte [rax + 0xf0], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf2], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0x110], 1
mov edx, 0x10
inc word [rbx + 0x5d8c]
movsx r9d, word [rbx + 0x5d8c]
call fcn.1400bd890
or edi, 0x22c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.1400aaaa0
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400fc880
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400b1a70
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x1400b1cbe
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x14020b948]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x1401c16a0]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x1400b1c86
mov rcx, rbp
call fcn.1400b1730
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x1400b1b41
movsxd rdx, dword [rbp + 0x5dd8]
mov r8, qword [rbp + 0x5de0]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x1400b1b31
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x1400b1b29
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x1400b1b2c
mov rdx, rcx
test rdx, rdx
jne 0x1400b1b00
cmp r8, r10
je 0x1400b1b41
cmp dword [r8], r9d
jne 0x1400b1b41
mov rcx, qword [r8 + 8]
jmp 0x1400b1b43
xor ecx, ecx
mov qword [rbx + 0x18], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x50], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xc8]
and eax, 0xfffffe49
movss dword [rbx + 0x58], xmm1
or eax, 0x49
mov dword [rbx + 0xc8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x5c], xmm0
test rcx, rcx
je 0x1400b1bd7
cmp qword [rcx + 0x20], 0
jne 0x1400b1bcc
mov qword [rcx + 0x20], rbx
jmp 0x1400b1bd7
cmp qword [rcx + 0x28], 0
jne 0x1400b1bd7
mov qword [rcx + 0x28], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xbc], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x60], eax
mov ecx, dword [rdi - 6]
mov eax, dword [rbx + 0xc]
and ecx, 0xc1fc20
or eax, dword [rbx + 4]
or eax, ecx
mov dword [rbx + 8], ecx
mov dword [rbx + 0x10], eax
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x1400b1c1c
nop word [rax + rax]
mov r9, rax
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x1400b1c10
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.1400bd890
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x1400b1c78
cmp r9b, 0x23
jne 0x1400b1c5b
cmp byte [r8], r9b
jne 0x1400b1c5b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x1400b1c48
not ecx
call fcn.1400bbca0
mov qword [rbx + 0x88], rax
add rdi, 0x24
sub rsi, 1
jne 0x1400b1ac0
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400fc880
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x1400b8cc0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [0x140214710]
mov rbp, rdx
movss xmm1, dword [rcx + 0x48]
mov rsi, rcx
mov eax, 1
xorps xmm2, xmm2
cmp dword [rdi + 0x3900], 0
movss xmm0, dword [rdi + 0x3918]
addss xmm0, xmm0
addss xmm0, dword [rdi + 0x3d50]
addss xmm0, dword [rcx + 0x4c]
jne 0x1400b8d10
xorps xmm3, xmm3
jmp 0x1400b8d1d
addss xmm1, dword [rcx + 0x50]
movss xmm3, dword [0x14014065c]
or dword [rdi + 0x48f8], 1
movss dword [rdi + 0x490c], xmm1
movss dword [rdi + 0x4910], xmm0
movss dword [rdi + 0x4914], xmm3
movss dword [rdi + 0x4918], xmm2
mov dword [rdi + 0x48fc], eax
mov byte [rdi + 0x4934], 1
mov rcx, qword [0x140214710]
mov eax, dword [rcx + 0x49f8]
cmp dword [rcx + 0x49e8], eax
jg 0x1400b8d80
mov dword [rcx + 0x48f8], 0
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rcx + 0x4018]
lea rdx, [0x1401c36a9]
mov qword [rsp + 0x30], rbx
lea r11, [0x1401c16a0]
mov r8b, 0x23
movsxd rcx, dword [r10 + 0x128]
mov rax, qword [r10 + 0x130]
mov r9d, dword [rax + rcx*4 - 4]
not r9d
mov ebx, r9d
cmp r8b, 0x23
jne 0x1400b8dc9
cmp byte [rdx], r8b
jne 0x1400b8dc9
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r11 + rcx*4]
test r8b, r8b
jne 0x1400b8db6
mov rax, qword [r10]
not ebx
cmp dword [rax + 0x4060], ebx
jne 0x1400b8e08
xor r9d, r9d
lea r8, str.WindowMenu
mov ecx, ebx
lea edx, [r9 + 0xb]
call fcn.1400b08c0
mov edx, 0x141
mov ecx, ebx
call fcn.1400ae950
mov rbx, qword [rsp + 0x30]
test al, al
je 0x1400b8e38
or byte [rsi + 0xcc], 2
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call qword [rdi + 0x5e10]
call fcn.1400bad70
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b8f70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov edi, r8d
mov rbx, rdx
mov rbp, rcx
xor r14d, r14d
nop word [rax + rax]
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
mov rax, qword [rbx + 0x18]
mov word [rsp + 0x32], r14w
test rax, rax
je 0x1400b8fbd
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
jmp 0x1400b8fc2
mov dword [rsp + 0x24], r14d
mov eax, dword [rbx + 0x10]
shr eax, 0xa
test al, 1
je 0x1400b8fed
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x1400b8fed
mov rax, qword [rax + 0x3a8]
test rax, rax
je 0x1400b8fed
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x28], eax
jmp 0x1400b8ff2
mov dword [rsp + 0x28], r14d
mov eax, dword [rbx + 0xbc]
mov dword [rsp + 0x2c], eax
cmp qword [rbx + 0x20], r14
je 0x1400b900c
movzx eax, byte [rbx + 0x60]
mov byte [rsp + 0x30], al
jmp 0x1400b9011
mov byte [rsp + 0x30], 0xff
cvttss2si ecx, dword [rbx + 0x48]
mov eax, dword [rbx + 8]
mov r8d, dword [rbp + 0x24]
and eax, 0xc1fc20
mov dword [rsp + 0x34], eax
mov byte [rsp + 0x31], dil
cvttss2si eax, dword [rbx + 0x4c]
mov word [rsp + 0x38], cx
cvttss2si ecx, dword [rbx + 0x50]
mov word [rsp + 0x3a], ax
cvttss2si eax, dword [rbx + 0x54]
mov word [rsp + 0x3c], cx
cvttss2si ecx, dword [rbx + 0x58]
mov word [rsp + 0x3e], ax
cvttss2si eax, dword [rbx + 0x5c]
mov word [rsp + 0x40], cx
mov ecx, dword [rbp + 0x20]
mov word [rsp + 0x42], ax
cmp ecx, r8d
jne 0x1400b9093
inc ecx
test r8d, r8d
je 0x1400b907e
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x1400b9083
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
lea rcx, [rbp + 0x20]
call fcn.1400d28e0
movsxd rax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rdx, [rax + rax*8]
mov eax, dword [rsp + 0x40]
movups xmmword [rcx + rdx*4], xmm0
movups xmmword [rcx + rdx*4 + 0x10], xmm1
mov dword [rcx + rdx*4 + 0x20], eax
inc dword [rbp + 0x20]
mov rdx, qword [rbx + 0x20]
inc edi
test rdx, rdx
je 0x1400b90d3
mov r8d, edi
mov rcx, rbp
call fcn.1400b8f70
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1400b8fa0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x1400bbb50
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140214710]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x1400bbbb3
mov qword [rsp], rbx
lea rbx, [0x1401c16a0]
nop dword [rax]
cmp r9b, 0x23
jne 0x1400bbb93
cmp byte [r8], r9b
jne 0x1400bbb93
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1400bbb80
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5e30]
not eax
mov r8, qword [r10 + 0x5e38]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x1400bbbdf
cmp dword [r8 + 8], eax
je 0x1400bbbe6
add r8, 0x48
cmp r8, rcx
jne 0x1400bbbd0
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret

Function at 0x1400bbd20
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x1400bbd70
lea r11, [0x1401c16a0]
cmp r9b, 0x23
jne 0x1400bbd53
cmp byte [r8], r9b
jne 0x1400bbd53
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400bbd40
not ecx
jmp fcn.1400bbca0

Function at 0x1400bc860
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x128]
lea r10, [0x1401c16a0]
mov rax, qword [rcx + 0x130]
mov r9, rcx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dl
movzx r8d, bl
shr ebx, 8
xor r8, rax
movzx eax, byte [rsp + 0x39]
xor ebx, dword [r10 + r8*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [r10 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [r10 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r10 + rcx*4]
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x4060], ebx
jne 0x1400bc8ed
xor r9d, r9d
movsxd r8, edx
mov ecx, ebx
lea edx, [r9 + 4]
call fcn.1400b08c0
mov eax, ebx
add rsp, 0x20
pop rbx
ret