joyce8/EMBER2024-capa huggingface dataset:
Function at 0x22dc082b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [0x22ddac700]
mov rbx, qword [rsi]
test rbx, rbx
je 0x22dc08320
mov rdi, qword [0x22ddae300]
mov edx, dword [rdi]
test edx, edx
je 0x22dc082e8
cmp dword [rbx + 8], 1
je 0x22dc08300
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor edx, edx
mov ecx, 0x10001
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.22dad20f0
mov rbx, qword [rsi]
test rbx, rbx
je 0x22dc08340
cmp qword [rbx + 0x50], 0
je 0x22dc08370
or dword [rsi + 0x10], 0x400
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov r8d, 0x330
lea rdx, [0x22dd92c48]
lea rcx, [0x22dd92d64]
call qword [sym.imp.msvcrt.dll__wassert]
jmp 0x22dc082c6
mov r8d, 0x2f2
lea rdx, [0x22dd92c48]
lea rcx, [0x22dd92d64]
call qword [sym.imp.msvcrt.dll__wassert]
mov eax, dword [rdi]
test eax, eax
jne 0x22dc08308
xor edx, edx
mov ecx, 0x10001
call fcn.22dad20f0
jmp 0x22dc0830f
mov rcx, qword [rbx + 0x358]
mov edx, 3
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x22dc0830f

Function at 0x22dc08410
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [0x22ddac700]
mov rbx, qword [rsi]
test rbx, rbx
je 0x22dc084c0
mov rdi, qword [0x22ddae300]
mov edx, dword [rdi]
test edx, edx
je 0x22dc08448
cmp dword [rbx + 8], 1
je 0x22dc08460
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor edx, edx
mov ecx, 0x10001
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.22dad20f0
mov rbx, qword [rsi]
test rbx, rbx
je 0x22dc08490
mov rcx, qword [rbx + 0x358]
mov edx, 9
call qword [sym.imp.USER32.dll_ShowWindow]
and dword [rsi + 0x10], 0xfffff9ff
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov r8d, 0x2e9
lea rdx, [0x22dd92c48]
lea rcx, [0x22dd92d64]
call qword [sym.imp.msvcrt.dll__wassert]
mov eax, dword [rdi]
test eax, eax
jne 0x22dc08468
xor edx, edx
mov ecx, 0x10001
call fcn.22dad20f0
jmp 0x22dc0847a
mov r8d, 0x330
lea rdx, [0x22dd92c48]
lea rcx, [0x22dd92d64]
call qword [sym.imp.msvcrt.dll__wassert]
jmp 0x22dc0842a
Function at 0x22dc0b330
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbx, qword [0x22ddac700]
cmp byte [rbx + 0x15], 0
mov r12, qword [rbx]
jne 0x22dc0b460
test r12, r12
je 0x22dc0b530
mov rsi, qword [0x22ddae300]
mov qword [rbx + 0x1c], 0
mov edx, dword [rsi]
test edx, edx
je 0x22dc0b4f0
mov qword [rsp + 0x48], 0
mov rcx, qword [r12 + 0x358]
lea rdx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rax, qword [rsp + 0x48]
mov qword [rbx + 0x1c], rax
call fcn.22dc08c00
mov r12d, dword [rsi]
movsxd rdi, eax
test r12d, r12d
je 0x22dc0b570
mov r12d, dword [rsi + 0x410]
mov rax, qword [rsi + 0x408]
cmp edi, r12d
jge 0x22dc0b4a8
mov rdx, qword [rax + rdi*8]
test rdx, rdx
je 0x22dc0b4a8
or dword [rbx + 0x10], 2
xor r9d, r9d
xor r8d, r8d
mov byte [rbx + 0x15], 1
mov dword [rsp + 0x30], 0xffffffff
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x2c]
mov dword [rsp + 0x20], eax
mov rcx, qword [rbx]
call fcn.22dae0180
test byte [rbx + 0x10], 0x40
je 0x22dc0b49a
nop word [rax + rax]
mov rsi, qword [0x22ddae300]
xor edx, edx
mov ecx, 0x10001
mov eax, dword [rsi]
test eax, eax
je 0x22dc0b55c
cmp dword [rsi + 0x162c], 1
jne 0x22dc0b508
mov ecx, dword [rsi + 0x1630]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x22dc0b550
mov rax, qword [rax + 0x260]
mov ecx, 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
jmp rax
and dword [rbx + 0x10], 0xfffffffd
mov r9d, dword [rbx + 0x20]
xor edx, edx
mov rcx, r12
mov byte [rbx + 0x15], 0
mov r8d, dword [rbx + 0x1c]
mov dword [rsp + 0x30], 0xffffffff
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x2c]
mov dword [rsp + 0x20], eax
call fcn.22dae0180
test byte [rbx + 0x10], 0x40
jne 0x22dc0b408
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
ret
lea rdx, str.GLFW:_Failed_to_get_monitor
mov ecx, 4
call fcn.22dce6140
and dword [rbx + 0x10], 0xfffffffd
xor r9d, r9d
xor r8d, r8d
mov byte [rbx + 0x15], 0
xor edx, edx
mov dword [rsp + 0x30], 0xffffffff
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x2c]
mov dword [rsp + 0x20], eax
mov rcx, qword [rbx]
call fcn.22dae0180
jmp 0x22dc0b490
xor edx, edx
mov ecx, 0x10001
call fcn.22dad20f0
jmp 0x22dc0b394
mov r8d, 0x40
lea rdx, str.C:Users_vivio.nimblepkgs2_nimraylib_now_0.15.0_f136f0da2803a36acc6b869bbc8b621193f1849ccsources_raylib_mangledexternal_glfw_src_win32_thread.c
lea rcx, str.tls__win32.allocated__GLFW_TRUE
call qword [sym.imp.msvcrt.dll__wassert]
jmp 0x22dc0b42d
mov r8d, 0x211
lea rdx, [0x22dd92c48]
lea rcx, [0x22dd92d64]
call qword [sym.imp.msvcrt.dll__wassert]
jmp 0x22dc0b356
lea rdx, str.Cannot_set_swap_interval_without_a_current_OpenGL_or_OpenGL_ES_context
mov ecx, 0x10002
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
jmp fcn.22dad20f0
xor edx, edx
mov ecx, 0x10001
call fcn.22dad20f0
xor eax, eax
jmp 0x22dc0b3b6
Function at 0x22dc13e30
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rsi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x22ddac700]
pxor xmm6, xmm6
pxor xmm3, xmm3
cvtsd2ss xmm6, qword [rax + 0x8a0]
xor eax, eax
comiss xmm6, xmm3
jne 0x22dc13e68
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rsi
ret
mov rbx, qword [0x22ddae300]
mov r8d, dword [rbx]
test r8d, r8d
je 0x22dc13f70
mov ecx, dword [rbx + 0x1670]
test ecx, ecx
jne 0x22dc14080
call qword [rbx + 0x24a8]
mov eax, eax
sub rax, qword [rbx + 0x1668]
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
js 0x22dc13f50
mov rax, qword [rbx + 0x1678]
pxor xmm1, xmm1
cvtsi2sd xmm1, rax
test rax, rax
js 0x22dc13f28
divsd xmm0, xmm1
mov rsi, qword [0x22ddb27b0]
pxor xmm1, xmm1
cvtss2sd xmm1, dword [rsi]
subsd xmm0, xmm1
comisd xmm0, xmmword [0x22dd94fd8]
ja 0x22dc13f88
mov rax, qword [0x22ddae380]
movss xmm0, dword [rax]
movss xmm1, dword [0x22dd94f10]
movss xmm2, dword [0x22dd94ea0]
movaps xmm6, xmmword [rsp + 0x30]
divss xmm1, xmm0
movss xmm0, dword [0x22dd94fe4]
andps xmm2, xmm1
orps xmm0, xmm2
addss xmm0, xmm1
cvttss2si eax, xmm0
add rsp, 0x48
pop rbx
pop rsi
ret
mov rdx, rax
and eax, 1
pxor xmm1, xmm1
shr rdx, 1
or rdx, rax
cvtsi2sd xmm1, rdx
addsd xmm1, xmm1
jmp 0x22dc13ebc
mov rdx, rax
and eax, 1
pxor xmm0, xmm0
shr rdx, 1
or rdx, rax
cvtsi2sd xmm0, rdx
addsd xmm0, xmm0
jmp 0x22dc13ea7
xor edx, edx
mov ecx, 0x10001
call fcn.22dad20f0
pxor xmm0, xmm0
jmp 0x22dc13ec0
mov edx, dword [rbx]
test edx, edx
je 0x22dc14098
mov eax, dword [rbx + 0x1670]
test eax, eax
jne 0x22dc140b0
call qword [rbx + 0x24a8]
mov eax, eax
sub rax, qword [rbx + 0x1668]
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
jns 0x22dc13fd3
mov rdx, rax
and eax, 1
pxor xmm0, xmm0
shr rdx, 1
or rdx, rax
cvtsi2sd xmm0, rdx
addsd xmm0, xmm0
mov rax, qword [rbx + 0x1678]
pxor xmm1, xmm1
cvtsi2sd xmm1, rax
test rax, rax
jns 0x22dc14001
mov rdx, rax
and eax, 1
pxor xmm1, xmm1
shr rdx, 1
or rdx, rax
cvtsi2sd xmm1, rdx
addsd xmm1, xmm1
divsd xmm0, xmm1
cvtsd2ss xmm0, xmm0
mov rcx, qword [0x22ddb2740]
mulss xmm6, dword [0x22dd94fe0]
movss dword [rsi], xmm0
mov eax, dword [rcx]
lea edx, [rax + 1]
movsxd rax, edx
mov r8d, edx
imul rax, rax, 0xffffffff88888889
sar r8d, 0x1f
shr rax, 0x20
add eax, edx
sar eax, 4
sub eax, r8d
imul r8d, eax, 0x1e
mov eax, edx
mov rdx, qword [0x22ddae380]
movss xmm0, dword [rdx]
sub eax, r8d
mov dword [rcx], eax
mov rcx, qword [0x22ddb2730]
cdqe
addss xmm0, xmm6
movss xmm1, dword [rcx + rax*4]
movss dword [rcx + rax*4], xmm6
subss xmm0, xmm1
movss dword [rdx], xmm0
jmp 0x22dc13eec
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x28]
jmp 0x22dc13e91
xor edx, edx
mov ecx, 0x10001
call fcn.22dad20f0
pxor xmm0, xmm0
jmp 0x22dc14009
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x28]
jmp 0x22dc13fa8
Function at 0x22dc1a160
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
xor r8d, r8d
mov r13, rcx
mov r12, rdx
test rdx, rdx
je 0x22dc1a181
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, r12
mov r9, r13
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, r13
add rsp, 0x28
pop r12
pop r13
jmp sub.msvcrt.dll_fflush

Function at 0x22dc27010
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov ecx, 2
call qword [fcn.22dcfc130]
mov r8d, 0x4b
mov edx, 1
lea rcx, str._GC__cannot_register_thread_local_variable__too_many_thread_local_variables
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop word cs:[rax + rax]
nop dword [rax]
sub rsp, 0x28
mov rdx, qword [0x22ddb2ea0]
mov rax, qword [rdx]
cmp rax, 0xdab
jg 0x22dc2708d
mov r8, qword [0x22ddb2e90]
mov qword [r8 + rax*8], rcx
add rax, 1
mov qword [rdx], rax
add rsp, 0x28
ret
call fcn.22dc27010
nop
nop word cs:[rax + rax]
nop

Function at 0x22dc270a0
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov ecx, 2
call qword [fcn.22dcfc130]
mov r8d, 0x3f
mov edx, 1
lea rcx, str._GC__cannot_register_global_variable__too_many_global_variables
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop word cs:[rax + rax]
nop dword [rax]
sub rsp, 0x28
mov rdx, qword [0x22ddb26a0]
mov rax, qword [rdx]
cmp rax, 0xdab
jg 0x22dc2711d
mov r8, qword [0x22ddb2690]
mov qword [r8 + rax*8], rcx
add rax, 1
mov qword [rdx], rax
add rsp, 0x28
ret
call fcn.22dc270a0
nop
nop word cs:[rax + rax]
nop

Function at 0x22dc2a220
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x38
lea rcx, [0x22dd0de80]
call fcn.22dcfcd40
mov rcx, qword [rax]
test rcx, rcx
je 0x22dc2a24f
add rsp, 0x38
pop rbx
pop r12
pop r13
pop r14
jmp 0x22dc299e0
mov rcx, qword [0x22ddad900]
mov edx, 0x30
lea r13, str.ReraiseDefect
call fcn.22dc27b50
lea rcx, [0x22dd984c0]
mov r12, rax
mov rax, qword [0x22ddad920]
mov qword [r12 + 0x10], r13
mov rbx, qword [r12 + 0x18]
mov qword [r12], rax
call fcn.22dc28300
mov qword [r12 + 0x18], rax
test rbx, rbx
je 0x22dc2a2c3
mov rax, qword [rbx - 0x10]
lea r14, [rbx - 0x10]
sub rax, 8
mov qword [rbx - 0x10], rax
cmp rax, 7
ja 0x22dc2a2c3
mov rcx, qword [0x22ddae200]
call fcn.22dcfcd40
mov rdx, r14
lea rcx, [rax + 0x18]
call fcn.22dc1c480
mov qword [rsp + 0x20], 0x35
lea r9, str.fatal.nim
mov rdx, r13
mov rcx, r12
lea r8, str.sysFatal
call fcn.22dc29b30
nop
nop word cs:[rax + rax]
Function at 0x22dc2a2f0
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
push r12
push rsi
push rbx
sub rsp, 0x158
movaps xmmword [rbp - 0x30], xmm6
cmp qword [0x22ddfa398], 0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov byte [rbp - 0x141], 1
je 0x22dc2a3fa
lea rcx, [0x22dd0de60]
call fcn.22dcfcd40
lea rcx, [rbp - 0x130]
mov rdx, qword [rax]
mov qword [rbp - 0x140], rdx
lea rdx, [rbp - 0x140]
mov qword [rax], rdx
mov rdx, rbp
call sub.msvcrt.dll__setjmp
cdqe
mov qword [rbp - 0x138], rax
test rax, rax
jne 0x22dc2a420
xor r12d, r12d
cmp qword [rbp + 0x10], 0
je 0x22dc2a3c7
mov rcx, qword [rbp + 0x10]
mov ebx, 7
call sub.msvcrt.dll_strlen
mov rcx, qword [0x22ddae200]
cmp rax, rbx
movq xmm6, rax
mov rsi, rax
cmovge rbx, rax
movq xmm0, rbx
punpcklqdq xmm6, xmm0
call fcn.22dcfcd40
mov rcx, qword [0x22ddb2e50]
lea rdx, [rbx + 0x11]
mov r8, rax
call fcn.22dc27940
mov rdx, qword [rbp + 0x10]
lea r8, [rsi + 1]
movups xmmword [rax], xmm6
lea rcx, [rax + 0x10]
mov r12, rax
call sub.msvcrt.dll_memcpy
mov rcx, r12
call qword [0x22ddfa398]
lea rcx, [0x22dd0de60]
mov byte [rbp - 0x141], 0
call fcn.22dcfcd40
cmp qword [rbp - 0x138], 0
mov rdx, qword [rax]
mov rdx, qword [rdx]
mov qword [rax], rdx
jne 0x22dc2a4a7
movzx eax, byte [rbp - 0x141]
test al, al
jne 0x22dc2a4b8
movaps xmm6, xmmword [rbp - 0x30]
add rsp, 0x158
pop rbx
pop rsi
pop r12
pop rbp
ret
lea rcx, [0x22dd0de60]
call fcn.22dcfcd40
lea rcx, [0x22dd0de80]
mov rdx, qword [rax]
mov rdx, qword [rdx]
mov qword [rbp - 0x138], 0
mov qword [rax], rdx
call fcn.22dcfcd40
mov rdx, qword [rax]
mov rbx, rax
mov rsi, qword [rdx + 0x28]
test rsi, rsi
je 0x22dc2a468
add qword [rsi - 0x10], 8
mov rdx, qword [rax]
test rdx, rdx
je 0x22dc2a496
mov rax, qword [rdx - 0x10]
lea r12, [rdx - 0x10]
sub rax, 8
mov qword [rdx - 0x10], rax
cmp rax, 7
ja 0x22dc2a496
mov rcx, qword [0x22ddae200]
call fcn.22dcfcd40
mov rdx, r12
lea rcx, [rax + 0x18]
call fcn.22dc1c480
cmp qword [rbp - 0x138], 0
mov qword [rbx], rsi
je 0x22dc2a3fa
call fcn.22dc2a220
jmp 0x22dc2a3fa
mov ecx, 2
call qword [fcn.22dcfc130]
mov rcx, qword [rbp + 0x10]
mov r8, qword [rbp + 0x18]
mov edx, 1
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
call sub.msvcrt.dll_fflush
jmp 0x22dc2a409
Function at 0x22dc2a990
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea r13, [0x22ddfa2c0]
xor r12d, r12d
mov rsi, rcx
mov rbx, rdx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdi, qword [fcn.22dcfc130]
jmp 0x22dc2a9e1
test r12, r12
js 0x22dc2aa34
mov r14, qword [rsi + r12*8]
mov ecx, 1
call rdi
mov rcx, rax
mov rdx, r14
call fcn.22dcd4160
add r12, 1
jo 0x22dc2aa40
cmp r12, rbx
jl 0x22dc2a9c0
mov rbx, qword [fcn.22dcfc130]
mov ecx, 1
call rbx
mov r8d, 1
mov edx, 1
lea rcx, [0x22dd95269]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 1
call rbx
mov rcx, rax
call sub.msvcrt.dll_fflush
mov rcx, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rdx, [rbx - 1]
mov rcx, r12
call fcn.22dc29e70
call fcn.22dc28aa0
nop
nop word cs:[rax + rax]
sub rsp, 0x28
test rdx, rdx
je 0x22dc2aa80
sub rdx, 1
jo 0x22dc2aa95
mov rax, rdx
add rax, 0x10
jo 0x22dc2aa95
imul r9, r8
not rdx
and rdx, rax
add rcx, r9
lea rax, [rcx + rdx]
add rsp, 0x28
ret
imul r9, r8
mov edx, 0x10
add rcx, r9
lea rax, [rcx + rdx]
add rsp, 0x28
ret
call fcn.22dc28aa0
nop
nop dword [rax + rax]

Function at 0x22dc32ed0
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rbx
sub rsp, 0x28
lea r9, [rdx + 3]
test rdx, rdx
mov r10, rcx
cmovns r9, rdx
and r9, 0xfffffffffffffffc
jle 0x22dc32f40
test rdx, rdx
jle 0x22dc33068
mov eax, dword [rcx]
xor r8d, r8d
mov ecx, 4
jmp 0x22dc32f08
mov eax, dword [r10 + rcx]
add rcx, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, r8d
rol eax, 0xd
lea r8d, [rax + rax*4 - 0x19ab949c]
cmp r9, rcx
jle 0x22dc32f48
cmp rdx, rcx
jg 0x22dc32f00
sub rdx, 1
call fcn.22dc29e70
nop dword [rax + rax]
xor ecx, ecx
xor r8d, r8d
nop dword [rax]
mov r9, rdx
sar r9, 0x3f
shr r9, 0x3e
lea rax, [rdx + r9]
and eax, 3
sub rax, r9
test rax, rax
jle 0x22dc33078
lea rbx, [rax - 1]
mov r9, rcx
xor esi, esi
add r9, rbx
js 0x22dc3307c
cmp r9, rbx
jb 0x22dc3307c
mov r11, r9
test rsi, rsi
jne 0x22dc33060
cmp rdx, r9
jle 0x22dc33050
test r9, r9
js 0x22dc33050
movzx r9d, byte [r10 + r9]
test rbx, rbx
je 0x22dc33005
sub rax, 2
mov rbx, rcx
xor esi, esi
add rbx, rax
js 0x22dc33086
cmp rbx, rax
jb 0x22dc33086
mov r11, rbx
test rsi, rsi
jne 0x22dc33060
test rbx, rbx
js 0x22dc33050
cmp rdx, rbx
jle 0x22dc33050
movzx r11d, byte [r10 + rbx]
shl r9d, 8
or r9d, r11d
test rax, rax
je 0x22dc33005
test rcx, rcx
js 0x22dc33049
cmp rdx, rcx
jle 0x22dc33049
mov eax, r9d
movzx ecx, byte [r10 + rcx]
shl eax, 8
or ecx, eax
mov r9d, ecx
imul eax, r9d, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor r8d, edx
xor eax, r8d
mov r8d, eax
shr r8d, 0x10
xor r8d, eax
imul r8d, r8d, 0x85ebca6b
mov edx, r8d
shr edx, 0xd
xor edx, r8d
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
add rsp, 0x28
pop rbx
pop rsi
ret
mov r11, rcx
nop dword [rax]
sub rdx, 1
mov rcx, r11
call fcn.22dc29e70
nop dword [rax]
call fcn.22dc28aa0
nop dword [rax]
xor ecx, ecx
sub rdx, 1
call fcn.22dc29e70
nop dword [rax + rax]
xor eax, eax
jmp 0x22dc33015
mov esi, 1
jmp 0x22dc32f81
mov esi, 1
jmp 0x22dc32fc4
Function at 0x22dc36510
Capabilities:
Link many functions at runtime

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
lea rcx, [0x22dd98c30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x22ddfaa88], rax
mov r12, rax
test rax, rax
je 0x22dc36628
lea r13, str.GetCurrentProcess
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rdx, r13
call rbx
test rax, rax
je 0x22dc36638
mov r12, qword [0x22ddfaa88]
lea r13, str.FormatMessageW
mov qword [0x22ddfa8e8], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc36650
mov r12, qword [0x22ddfaa88]
lea r13, str.LocalFree
mov qword [0x22ddfa8e0], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc36660
mov r12, qword [0x22ddfaa88]
lea r13, str.GetLastError
mov qword [0x22ddfa8d8], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc36670
mov r12, qword [0x22ddfaa88]
lea r13, str.GetFileAttributesW
mov qword [0x22ddfa8d0], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc36680
mov r12, qword [0x22ddfaa88]
lea r13, str.Sleep
mov qword [0x22ddfa8c8], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc36690
mov qword [0x22ddfa8c0], rax
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
lea rcx, [0x22dd98c00]
call fcn.22dc26640
nop dword [rax]
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc36558
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc3657e
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc365a4
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc365ca
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc365f0
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc36612
Function at 0x22dc4d680
Capabilities:
Link many functions at runtime

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
lea rcx, [0x22dd9bad0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x22ddfdc40], rax
mov r12, rax
test rax, rax
je 0x22dc4d830
lea r13, str.IsWow64Process
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rdx, r13
call rbx
test rax, rax
je 0x22dc4d840
mov r12, qword [0x22ddfdc40]
lea r13, str.CloseHandle
mov qword [0x22ddfd3e0], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc4d850
mov r12, qword [0x22ddfdc40]
lea r13, str.GetExitCodeProcess
mov qword [0x22ddfd3d8], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc4d860
mov r12, qword [0x22ddfdc40]
lea r13, str.OpenProcess
mov qword [0x22ddfd3d0], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc4d870
mov r12, qword [0x22ddfdc40]
lea r13, str.VirtualQueryEx
mov qword [0x22ddfd3c8], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc4d880
mov r12, qword [0x22ddfdc40]
lea r13, str.ReadProcessMemory
mov qword [0x22ddfd3c0], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc4d890
mov r12, qword [0x22ddfdc40]
lea r13, str.VirtualProtectEx
mov qword [0x22ddfd3b8], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc4d8a0
mov r12, qword [0x22ddfdc40]
lea r13, str.VirtualAllocEx
mov qword [0x22ddfd3b0], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc4d8b0
mov r12, qword [0x22ddfdc40]
lea r13, str.VirtualFreeEx
mov qword [0x22ddfd3a8], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc4d8c0
mov r12, qword [0x22ddfdc40]
lea r13, str.WriteProcessMemory
mov qword [0x22ddfd3a0], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc4d8d0
mov qword [0x22ddfd398], rax
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
lea rcx, [0x22dd9baa0]
call fcn.22dc26640
nop dword [rax]
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc4d6c8
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc4d6ee
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc4d714
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc4d73a
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc4d760
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc4d786
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc4d7ac
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc4d7d2
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc4d7f8
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc4d81e
Function at 0x22dc4d8e0
Capabilities:
Link many functions at runtime

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
lea rcx, [0x22dd9ba90]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x22ddfdc38], rax
mov r12, rax
test rax, rax
je 0x22dc4da20
lea r13, str.CreateCompatibleDC
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rdx, r13
call rbx
test rax, rax
je 0x22dc4da30
mov r12, qword [0x22ddfdc38]
lea r13, str.CreateCompatibleBitmap
mov qword [0x22ddfd390], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc4da40
mov r12, qword [0x22ddfdc38]
lea r13, str.SelectObject
mov qword [0x22ddfd388], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc4da50
mov r12, qword [0x22ddfdc38]
lea r13, str.BitBlt
mov qword [0x22ddfd380], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc4da60
mov r12, qword [0x22ddfdc38]
lea r13, str.GetBitmapBits
mov qword [0x22ddfd378], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc4da70
mov r12, qword [0x22ddfdc38]
lea r13, str.DeleteObject
mov qword [0x22ddfd370], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc4da80
mov r12, qword [0x22ddfdc38]
lea r13, str.DeleteDC
mov qword [0x22ddfd368], rax
mov rdx, r13
mov rcx, r12
call rbx
test rax, rax
je 0x22dc4da90
mov qword [0x22ddfd360], rax
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
lea rcx, [0x22dd9ba60]
call fcn.22dc26640
nop dword [rax]
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc4d928
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc4d94e
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc4d974
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc4d99a
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc4d9c0
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc4d9e6
mov rdx, r13
mov rcx, r12
call fcn.22dc27130
jmp 0x22dc4da0c