joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140163930
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0x130]
lea r9, [0x1402f4820]
movss xmm2, dword [rcx + 0x148]
movss xmm3, dword [rcx + 0x14c]
movsxd rcx, dword [rcx + 0x128]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x140167d80
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, qword [0x14037cc68]
movzx esi, r9b
mov r12d, dword [rsp + 0x90]
mov r15d, edx
movaps xmmword [rsp + 0x30], xmm6
mov rbx, qword [rdi + 0x4018]
mov eax, dword [rbx + 0x14]
and eax, 4
or eax, 0x1200103
or r12d, eax
cmp qword [rbx + 0x1e0], 0
jne 0x140167ddf
cmp qword [rdi + 0x4d10], 0
mov eax, 0x2b8
je 0x140167de4
mov eax, 0x288
movss xmm4, dword [rax + rbx]
xorps xmm3, xmm3
movss xmm5, dword [rax + rbx + 4]
cvttss2si eax, dword [r8]
subss xmm4, dword [rbx + 0x138]
subss xmm5, dword [rbx + 0x13c]
movd xmm1, eax
cvttss2si eax, dword [r8 + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm3
cvtdq2ps xmm0, xmm0
jp 0x140167e29
jne 0x140167e29
mov eax, 1
jmp 0x140167e2b
xor eax, eax
ucomiss xmm0, xmm3
jp 0x140167e3a
jne 0x140167e3a
mov r14d, 2
jmp 0x140167e3d
xor r14d, r14d
movss xmm2, dword [0x140310f00]
or r14d, eax
comiss xmm3, xmm1
jb 0x140167e59
addss xmm1, xmm4
comiss xmm1, xmm2
jae 0x140167e59
movaps xmm1, xmm2
comiss xmm3, xmm0
jb 0x140167e6a
addss xmm0, xmm5
comiss xmm0, xmm2
jae 0x140167e6a
movaps xmm0, xmm2
or dword [rdi + 0x48f8], 2
xor edx, edx
movss dword [rdi + 0x491c], xmm1
movss dword [rdi + 0x4920], xmm0
mov dword [rdi + 0x4900], 1
mov r9, qword [rbx + 8]
test rcx, rcx
je 0x140167eb3
mov dword [rsp + 0x28], r15d
lea r8, str._s__s__08X
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x70]
call fcn.14015fd60
jmp 0x140167ec9
lea r8, str._s__08X
mov dword [rsp + 0x20], r15d
lea rcx, [rsp + 0x70]
call fcn.14015fd60
movss xmm6, dword [rdi + 0x3908]
test sil, sil
jne 0x140167ee0
mov dword [rdi + 0x3908], 0
mov rcx, qword [rsp + 0x70]
mov r8d, r12d
xor edx, edx
call fcn.14016b160
mov rsi, qword [rdi + 0x4018]
movzx ebp, al
movss dword [rdi + 0x3908], xmm6
cmp word [rsi + 0xf8], 1
mov dword [rsi + 0xb4], r15d
mov byte [rsi + 0x10a], r14b
jne 0x140167f26
movsd xmm0, qword [rsi + 0x50]
movsd qword [rbx + 0x138], xmm0
mov r9d, r15d
lea rdx, [0x14030bf01]
not r9d
lea r10, [0x1402f4820]
mov ebx, r9d
mov r8b, 0x23
cmp r8b, 0x23
jne 0x140167f53
cmp byte [rdx], r8b
jne 0x140167f53
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x140167f40
not ebx
cmp dword [rdi + 0x4078], ebx
jne 0x140167f83
xor edx, edx
xor ecx, ecx
call fcn.140163af0
cmp dword [rdi + 0x4aa8], r15d
jne 0x140167fd0
bt r12d, 0x17
jb 0x140167fd0
cmp word [rsi + 0x194], 0
jne 0x140167fa6
cmp byte [rsi + 0x19a], 0
je 0x140167fd0
xor edx, edx
mov rcx, rsi
call fcn.14016e0a0
xor edx, edx
mov rcx, rsi
call fcn.140175030
mov rdx, rsi
mov ecx, ebx
call fcn.140163af0
mov eax, dword [rdi + 0x4acc]
mov dword [rdi + 0x40a0], eax
mov rbx, qword [rsp + 0x78]
movzx eax, bpl
mov rbp, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140168320
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov edx, r10d
test r9b, r9b
je 0x140168370
lea r11, [0x1402f4820]
nop dword [rax]
cmp r9b, 0x23
jne 0x140168353
cmp byte [r8], r9b
jne 0x140168353
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x140168340
mov rcx, qword [0x14037cc68]
not edx
add rcx, 0x3ff8
jmp fcn.1401604c0
Function at 0x1401729f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140353240]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14037cc68]
mov edi, ecx
cmp byte [rbx + 0x4c59], 0
jne 0x140172a51
cmp byte [rbx + 0x4c5a], 0
jne 0x140172a51
movsx r9d, word [rbx + 0x5d8a]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14015fce0
test dil, 2
je 0x140172b8e
jmp 0x140172ae1
movss xmm1, dword [rbx + 0x39ac]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5d8a]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140310f6c]
mulss xmm1, dword [0x140310f50]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe08]
addss xmm1, dword [rbx + 0xe0c]
mov qword [rbx + 0x4914], rax
mov dword [rbx + 0x48fc], 1
movss dword [rbx + 0x490c], xmm0
mov byte [rbx + 0x4934], 1
movss dword [rbx + 0x4910], xmm1
movss xmm0, dword [rbx + 0x3a08]
mulss xmm0, dword [0x140310de8]
or dword [rbx + 0x48f8], 0x41
movss dword [rbx + 0x4958], xmm0
call fcn.14015fce0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov edx, r10d
test r9b, r9b
je 0x140172b31
lea r11, [0x1402f4820]
cmp r9b, 0x23
jne 0x140172b14
cmp byte [r8], r9b
jne 0x140172b14
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x140172b01
mov rcx, qword [0x14037cc68]
not edx
add rcx, 0x3ff8
call fcn.1401604c0
test rax, rax
je 0x140172b8e
cmp byte [rax + 0xeb], 0
je 0x140172b8e
mov byte [rax + 0xf0], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf2], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0x110], 1
mov edx, 0x10
inc word [rbx + 0x5d8a]
movsx r9d, word [rbx + 0x5d8a]
call fcn.14015fce0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.14016b160
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402863b0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140178dc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5ed0], 0
lea rbx, [rcx + 0x5ed8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140178e67
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140178e1a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140186650
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140160800
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5ed0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5ee0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14037c005]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140178e6f
mov rcx, rbx
call fcn.140160800
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1401791c0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14037cc68]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140179223
mov qword [rsp], rbx
lea rbx, [0x1402f4820]
nop dword [rax]
cmp r9b, 0x23
jne 0x140179203
cmp byte [r8], r9b
jne 0x140179203
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1401791f0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5e30]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x140179257
mov r10, qword [r10 + 0x5e38]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14017925e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140179244
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14017c890
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14017ca9c
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x140353240]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x18]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x1402f4820]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x18]
test edx, edx
je 0x14017ca64
mov rcx, rbp
call fcn.14017bfe0
mov edx, dword [rdi - 0x14]
mov rbx, rax
test edx, edx
je 0x14017c90e
lea rcx, [rbp + 0x5dd8]
call fcn.1401604c0
mov r11, rax
jmp 0x14017c911
xor r11d, r11d
mov qword [rbx + 0x18], r11
movsx eax, word [rdi]
movd xmm1, eax
movsx eax, word [rdi + 2]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 4]
movd xmm1, eax
movsx eax, word [rdi + 6]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x50], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
movsx eax, word [rdi + 8]
movd xmm1, eax
movsx eax, word [rdi + 0xa]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xc8]
and eax, 0xfffffe49
movss dword [rbx + 0x58], xmm1
or eax, 0x49
mov dword [rbx + 0xc8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x5c], xmm0
test r11, r11
je 0x14017c9a5
cmp qword [r11 + 0x20], 0
jne 0x14017c99a
mov qword [r11 + 0x20], rbx
jmp 0x14017c9a5
cmp qword [r11 + 0x28], 0
jne 0x14017c9a5
mov qword [r11 + 0x28], rbx
mov eax, dword [rdi - 0xc]
mov r9, rbx
mov dword [rbx + 0xbc], eax
movsx eax, byte [rdi - 8]
mov dword [rbx + 0x60], eax
mov ecx, dword [rdi - 4]
mov eax, dword [rbx + 0xc]
and ecx, 0xc1fc20
or eax, dword [rbx + 4]
or eax, ecx
mov dword [rbx + 8], ecx
mov dword [rbx + 0x10], eax
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14017c9ec
nop dword [rax + rax]
mov r9, rax
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x14017c9e0
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.14015fce0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov edx, r14d
test r9b, r9b
je 0x14017ca48
cmp r9b, 0x23
jne 0x14017ca2b
cmp byte [r8], r9b
jne 0x14017ca2b
cmp byte [r8 + 1], r9b
cmove edx, r14d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r15 + rcx*4]
test r9b, r9b
jne 0x14017ca18
mov rcx, qword [0x14037cc68]
not edx
add rcx, 0x3ff8
call fcn.1401604c0
mov qword [rbx + 0x88], rax
add rdi, 0x24
sub rsi, 1
jne 0x14017c8e0
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402863b0
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x140184a80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
xor r14d, r14d
nop word [rax + rax]
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
mov rax, qword [rbx + 0x18]
mov word [rsp + 0x32], r14w
test rax, rax
je 0x140184acd
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
jmp 0x140184ad2
mov dword [rsp + 0x24], r14d
mov eax, dword [rbx + 0x10]
shr eax, 0xa
test al, 1
je 0x140184afd
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x140184afd
mov rax, qword [rax + 0x3d8]
test rax, rax
je 0x140184afd
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x28], eax
jmp 0x140184b02
mov dword [rsp + 0x28], r14d
mov eax, dword [rbx + 0xbc]
mov dword [rsp + 0x2c], eax
cmp qword [rbx + 0x20], r14
je 0x140184b1c
movzx eax, byte [rbx + 0x60]
mov byte [rsp + 0x30], al
jmp 0x140184b21
mov byte [rsp + 0x30], 0xff
cvttss2si ecx, dword [rbx + 0x48]
mov eax, dword [rbx + 8]
mov r8d, dword [rbp + 0x24]
and eax, 0xc1fc20
mov dword [rsp + 0x34], eax
mov byte [rsp + 0x31], sil
cvttss2si eax, dword [rbx + 0x4c]
mov word [rsp + 0x38], cx
cvttss2si ecx, dword [rbx + 0x50]
mov word [rsp + 0x3a], ax
cvttss2si eax, dword [rbx + 0x54]
mov word [rsp + 0x3c], cx
cvttss2si ecx, dword [rbx + 0x58]
mov word [rsp + 0x3e], ax
cvttss2si eax, dword [rbx + 0x5c]
mov word [rsp + 0x40], cx
mov ecx, dword [rbp + 0x20]
mov word [rsp + 0x42], ax
cmp ecx, r8d
jne 0x140184ba3
inc ecx
test r8d, r8d
je 0x140184b8e
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140184b93
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
lea rcx, [rbp + 0x20]
call fcn.140186440
movsxd rax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rdx, [rax + rax*8]
mov eax, dword [rsp + 0x40]
movups xmmword [rcx + rdx*4], xmm0
movups xmmword [rcx + rdx*4 + 0x10], xmm1
mov dword [rcx + rdx*4 + 0x20], eax
inc dword [rbp + 0x20]
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x140184be2
lea r8d, [rsi + 1]
mov rcx, rbp
call fcn.140184a80
mov rbx, qword [rbx + 0x28]
test rbx, rbx
je 0x140184bf2
inc esi
jmp 0x140184ab0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x1401beba0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov r11, qword [0x14037cc68]
movaps xmmword [rsp + 0x30], xmm6
mov rdi, r11
mov rax, qword [r11 + 0x4a28]
mov rbx, qword [rax]
test rbx, rbx
je 0x1401bebd7
mov eax, dword [r11 + 0x3f70]
mov dword [rbx + 0x6c], eax
cmp qword [r11 + 0x4a38], rbx
je 0x1401bec22
test rbx, rbx
je 0x1401bec10
mov eax, dword [rbx + 0x28]
mov dword [r11 + 0x4a30], eax
mov rax, qword [r11 + 0x3880]
mov qword [r11 + 0x4a38], rbx
test rax, rax
je 0x1401bec22
mov rcx, rbx
call rax
mov r11, qword [0x14037cc68]
jmp 0x1401bec22
mov dword [r11 + 0x4a30], 0x3f800000
mov qword [r11 + 0x4a38], rbx
movss xmm1, dword [rdi + 0x39a4]
lea r8, [0x14030ca11]
subss xmm1, dword [rdi + 0x3918]
movss xmm0, dword [rdi + 0x39a0]
lea rsi, [0x1402f4820]
movss dword [rdi + 0x4980], xmm0
xorps xmm6, xmm6
mov r10d, 0xffffffff
mov r9b, 0x23
mov edx, r10d
maxss xmm1, xmm6
movss dword [rdi + 0x4984], xmm1
movss xmm5, dword [r11 + 0x3918]
addss xmm5, xmm5
addss xmm5, dword [r11 + 0x3d50]
cmp r9b, 0x23
jne 0x1401bec94
cmp byte [r8], r9b
jne 0x1401bec94
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [rsi + rcx*4]
test r9b, r9b
jne 0x1401bec81
not edx
lea rcx, [r11 + 0x3ff8]
call fcn.1401604c0
mov rcx, rax
test rbx, rbx
jne 0x1401becd0
mov rax, qword [r11 + 0x4a28]
mov rbx, qword [rax]
xor esi, esi
test rcx, rcx
je 0x1401bece4
cmp word [rcx + 0xf8], si
jne 0x1401bed82
movss xmm1, dword [rbx + 0x130]
movaps xmm3, xmm6
movss xmm0, dword [rbx + 0x10]
movaps xmm4, xmm1
addss xmm4, dword [rbx + 8]
movss xmm2, dword [rbx + 0x134]
subss xmm0, xmm1
addss xmm2, dword [rbx + 0xc]
addss xmm0, dword [rbx + 0x138]
or dword [r11 + 0x48f8], 3
movss dword [r11 + 0x490c], xmm4
movss dword [r11 + 0x4910], xmm2
movss dword [r11 + 0x4920], xmm5
maxss xmm3, xmm0
mov qword [r11 + 0x4914], rsi
mov dword [r11 + 0x48fc], 1
mov byte [r11 + 0x4934], 1
mov dword [r11 + 0x4900], 1
addss xmm3, xmm4
subss xmm3, xmm4
movss dword [r11 + 0x491c], xmm3
addss xmm5, dword [rbx + 0x134]
movss dword [rbx + 0x134], xmm5
mov eax, dword [rbx]
movaps xmm1, xmm6
or dword [r11 + 0x48f8], 0x100
mov ecx, 3
mov dword [r11 + 0x495c], eax
call fcn.140160a00
mov rbx, qword [0x14037cc68]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 5
movss xmm1, dword [rbx + 0x38f0]
lea rcx, [rbx + 0x4998]
movss xmm0, dword [rbx + 0x38f4]
movss dword [rsp + 0x24], xmm1
movss dword [rsp + 0x28], xmm0
call fcn.140186260
xor edx, edx
mov qword [rbx + 0x38f0], rsi
mov r8d, 0x20050f
lea rcx, str.MainMenuBar
call fcn.14016b160
mov ecx, 2
movzx ebx, al
call fcn.140160b10
mov qword [rdi + 0x4980], rsi
test bl, bl
je 0x1401bee19
call fcn.1401be690
jmp 0x1401bee1e
call fcn.14016dce0
mov rsi, qword [rsp + 0x58]
movzx eax, bl
mov rbx, qword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
Function at 0x1401c6020
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r11d, 0xffffffff
mov r10, rcx
mov eax, r11d
test r9b, r9b
je 0x1401c607b
mov qword [rsp], rbx
lea rbx, [0x1402f4820]
cmp r9b, 0x23
jne 0x1401c605b
cmp byte [r8], r9b
jne 0x1401c605b
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1401c6048
mov rbx, qword [rsp]
movsxd rdx, dword [r10 + 0x90]
not eax
mov r9, qword [r10 + 0x98]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x1401c60d1
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x1401c60c9
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x1401c60cc
mov rdx, r8
test rdx, rdx
jne 0x1401c60a0
cmp r9, r10
je 0x1401c60e4
cmp dword [r9], eax
jne 0x1401c60e4
mov eax, dword [r9 + 8]
add rsp, 8
ret
mov eax, 0xffffffff
add rsp, 8
ret

Function at 0x1401e1ea0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, qword [r8 + 8]
mov r15, rdx
mov r14, qword [r8]
xor edx, edx
mov esi, 0xcbf29ce4
test rbp, rbp
je 0x1401e1ee7
nop
movsx rax, byte [r14 + rdx]
inc rdx
xor rax, rsi
imul rsi, rax, 0x1000193
cmp rdx, rbp
jb 0x1401e1ed0
mov rdi, qword [rcx + 8]
movabs rax, 0x2aaaaaaaaaaaaaab
mov rbx, qword [rcx]
mov rcx, rdi
sub rcx, rbx
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test rdx, rdx
jle 0x1401e1f50
nop dword [rax]
nop dword [rax + rax]
mov rcx, rdx
shr rcx, 1
lea rax, [rcx + rcx*2]
cmp qword [rbx + rax*8 + 0x10], rsi
lea r8, [rbx + rax*8]
jae 0x1401e1f48
mov rax, 0xffffffffffffffff
lea rbx, [r8 + 0x18]
sub rax, rcx
add rdx, rax
jmp 0x1401e1f4b
mov rdx, rcx
test rdx, rdx
jg 0x1401e1f20
cmp rbx, rdi
je 0x1401e1f7c
cmp qword [rbx + 0x10], rsi
jne 0x1401e1f7c
mov r8, qword [rbx + 8]
cmp r8, rbp
jne 0x1401e1f73
mov rcx, qword [rbx]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1401e1f9b
add rbx, 0x18
cmp rbx, rdi
jne 0x1401e1f55
mov qword [r15], rdi
mov rbx, qword [rsp + 0x40]
mov rax, r15
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov qword [r15], rbx
jmp 0x1401e1f7f
Function at 0x1401e22b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r12, qword [r8 + 0x18]
mov r15, rdx
mov rbp, qword [r8 + 0x10]
mov r14, r8
mov rbx, rcx
mov rdx, r8
cmp r12, 0xf
jbe 0x1401e22e3
mov rdx, qword [r8]
xor ecx, ecx
mov edi, 0xcbf29ce4
test rbp, rbp
je 0x1401e2307
nop
movsx rax, byte [rdx + rcx]
inc rcx
xor rax, rdi
imul rdi, rax, 0x1000193
cmp rcx, rbp
jb 0x1401e22f0
mov rsi, qword [rbx + 8]
movabs rax, 0x6666666666666667
mov rbx, qword [rbx]
mov rcx, rsi
sub rcx, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test rdx, rdx
jle 0x1401e2370
nop dword [rax]
nop dword [rax + rax]
mov rcx, rdx
shr rcx, 1
lea rax, [rcx + rcx*4]
cmp qword [rbx + rax*8 + 0x20], rdi
lea r8, [rbx + rax*8]
jae 0x1401e2368
mov rax, 0xffffffffffffffff
lea rbx, [r8 + 0x28]
sub rax, rcx
add rdx, rax
jmp 0x1401e236b
mov rdx, rcx
test rdx, rdx
jg 0x1401e2340
cmp rbx, rsi
je 0x1401e23af
cmp qword [rbx + 0x20], rdi
jne 0x1401e23af
mov rdx, r14
cmp r12, 0xf
jbe 0x1401e2387
mov rdx, qword [r14]
cmp qword [rbx + 0x18], 0xf
mov rcx, rbx
mov r8, qword [rbx + 0x10]
jbe 0x1401e2398
mov rcx, qword [rbx]
cmp r8, rbp
jne 0x1401e23a6
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1401e23cc
add rbx, 0x28
cmp rbx, rsi
jne 0x1401e2375
mov qword [r15], rsi
mov rbx, qword [rsp + 0x50]
mov rax, r15
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov qword [r15], rbx
jmp 0x1401e23b2
Function at 0x1401ea3b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov r15, rcx
call fcn.1401df6b0
mov r13, rax
mov rbp, qword [rbx + 8]
mov r14, qword [rbx]
mov esi, 0xcbf29ce4
xor ecx, ecx
test rbp, rbp
je 0x1401ea407
nop dword [rax]
movsx rax, byte [r14 + rcx]
xor rax, rsi
imul rsi, rax, 0x1000193
inc rcx
cmp rcx, rbp
jb 0x1401ea3f0
mov rdi, qword [r13 + 0x18]
mov r12, qword [r13 + 0x10]
mov rcx, rdi
sub rcx, r12
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rbx, r12
test rdx, rdx
jle 0x1401ea46f
nop dword [rax + rax]
mov rcx, rdx
shr rcx, 1
lea rax, [rcx + rcx*4]
lea r8, [rbx + rax*8]
cmp qword [r8 + 0x20], rsi
jae 0x1401ea467
lea rbx, [r8 + 0x28]
mov rax, 0xffffffffffffffff
sub rax, rcx
add rdx, rax
jmp 0x1401ea46a
mov rdx, rcx
test rdx, rdx
jg 0x1401ea440
cmp rbx, rdi
je 0x1401ea4a5
cmp qword [rbx + 0x20], rsi
jne 0x1401ea4a5
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1401ea487
mov rcx, qword [rbx]
mov r8, qword [rbx + 0x10]
cmp r8, rbp
jne 0x1401ea49c
mov rdx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1401ea4cd
add rbx, 0x28
cmp rbx, rdi
jne 0x1401ea474
call fcn.1401deac0
mov qword [r15], rax
mov rax, r15
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
sub rbx, r12
movabs rax, 0x6666666666666667
imul rbx
sar rdx, 4
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov rcx, qword [r13 + 0x28]
lea rcx, [rcx + rdx*8]
cmp rcx, qword [r13 + 0x30]
je 0x1401ea4a5
mov rdx, qword [rcx]
mov qword [r15], rdx
jmp 0x1401ea4ad
Function at 0x1401f24d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbx, rcx
test rcx, rcx
jne 0x1401f24f3
lea eax, [rcx + 0x23]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rcx + 0x88]
test rcx, rcx
je 0x1401f250e
mov rax, qword [rcx + 0x10]
call qword [rax + 0x18]
xor edx, edx
cmp eax, dword [rbx + 0x10]
cmovb edx, eax
mov r8d, edi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1401f2530