joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14026dca0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rbx, rdx
mov rsi, rcx
lea edx, [rbp + 0x3a]
mov qword [rsp + 0x40], rbp
mov edi, ebp
call sub.MSVCR90.dll_strrchr
test rax, rax
je 0x14026dcde
lea rcx, [rax + 1]
mov byte [rax], dil
call sub.MSVCR90.dll_atoi
mov edi, eax
lea r9, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x14026dd60
mov ecx, dword [rdx + 4]
cmp ecx, 2
je 0x14026dd3b
cmp ecx, 0x17
jne 0x14026dd2a
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
mov rcx, rbx
call sub.MSVCR90.dll_memcpy
movzx ecx, di
call qword [sym.imp.WS2_32.dll_htons]
mov rdx, qword [rsp + 0x40]
mov word [rbx + 2], ax
mov rcx, rdx
mov byte [rbx + 0x24], 1
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov al, 1
jmp 0x14026dd83
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
mov rcx, rbx
call sub.MSVCR90.dll_memcpy
movzx ecx, di
call qword [sym.imp.WS2_32.dll_htons]
mov byte [rbx + 0x24], 1
mov word [rbx + 2], ax
mov al, 1
jmp 0x14026dd83
mov eax, 2
mov ecx, 0x10b
mov dword [rbx + 4], 0xffffffff
mov word [rbx], ax
mov word [rbx + 2], bp
call fcn.14026c090
mov byte [rbx + 0x24], bpl
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14026e020
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov eax, dword [rdx]
mov r12d, dword [r8]
mov r13, r8
mov r14, rdx
mov rdi, rcx
mov rsi, rcx
mov ebp, recvfrom
nop word [rax + rax]
xor eax, dword [rsi]
mov rcx, rdi
mov edx, eax
mov ebx, eax
call fcn.14026dfc0
add rsi, 4
xor eax, r12d
sub rbp, 1
mov r12d, ebx
jne 0x14026e060
mov ecx, dword [rdi + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
xor ecx, eax
mov eax, dword [rdi + 0x44]
mov rdi, qword [rsp + 0x58]
xor eax, ebx
mov rbx, qword [rsp + 0x40]
mov dword [r14], eax
mov dword [r13], ecx
add rsp, 0x20
pop r14
pop r13
pop r12
ret

Function at 0x14026e0b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov eax, dword [rdx]
mov r12d, dword [r8]
mov r13, r8
mov r14, rdx
mov rdi, rcx
lea rsi, [rcx + 0x44]
mov ebp, recvfrom
nop word [rax + rax]
xor eax, dword [rsi]
mov rcx, rdi
mov edx, eax
mov ebx, eax
call fcn.14026dfc0
sub rsi, 4
xor eax, r12d
sub rbp, 1
mov r12d, ebx
jne 0x14026e0f0
mov ecx, dword [rdi + 4]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
xor ecx, eax
mov eax, dword [rdi]
mov rdi, qword [rsp + 0x58]
xor eax, ebx
mov rbx, qword [rsp + 0x40]
mov dword [r14], eax
mov dword [r13], ecx
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x14026e140
Capabilities:
Encrypt data using blowfish

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
lea rbx, [rcx + 0x4c]
mov rsi, rcx
mov r13, rdx
lea r9, [0x140315bb4]
lea rcx, [0x140316bb4]
mov r10, rbx
nop word [rax + rax]
mov r11d, 0x80
nop word [rax + rax]
mov eax, dword [r9 - 4]
add r10, 8
add r9, 8
sub r11, 1
mov dword [r10 - 0xc], eax
mov eax, dword [r9 - 8]
mov dword [r10 - 8], eax
jne 0x14026e190
cmp r9, rcx
jl 0x14026e180
xor edi, edi
lea r12, [0x140315b60]
movsxd r11, r8d
mov r8, rsi
mov ebp, 4
sub r12, rsi
mov rcx, rdi
lea r10d, [rdi + 0x12]
nop word [rax + rax]
mov edx, edi
mov r9, rbp
nop word [rax + rax]
movzx eax, byte [rcx + r13]
shl edx, 8
inc rcx
or edx, eax
cmp rcx, r11
cmovge rcx, rdi
sub r9, 1
jne 0x14026e1f0
mov eax, dword [r12 + r8]
xor eax, edx
mov dword [r8], eax
add r8, rbp
sub r10, 1
jne 0x14026e1e0
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x20], edi
nop word [rax + rax]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x68]
mov rcx, rsi
call fcn.14026e020
mov eax, dword [rsp + 0x68]
add rdi, 2
cmp rdi, 0x12
mov dword [rsi + rdi*4 - 8], eax
mov eax, dword [rsp + 0x20]
mov dword [rsi + rdi*4 - 4], eax
jl 0x14026e230
nop dword [rax]
mov edi, 0x80
nop word [rax + rax]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x68]
mov rcx, rsi
call fcn.14026e020
mov r11d, dword [rsp + 0x68]
mov eax, dword [rsp + 0x20]
mov dword [rbx - 4], r11d
mov dword [rbx], eax
add rbx, 8
sub rdi, 1
jne 0x14026e270
sub rbp, 1
jne 0x14026e260
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x140277c40
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x70
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140277c77
lea rdx, str.Version
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140277c82
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
add rsp, 0x70
pop rbx
ret
mov qword [rsp + 0x88], rdi
call rax
mov edi, eax
cmp eax, 3
je 0x140277cb4
cmp eax, 4
je 0x140277cb4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x88]
mov eax, 1
add rsp, 0x70
pop rbx
ret
lea rdx, str.Startup
mov rcx, rbx
mov qword [rsp + 0x80], rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x140277d9e
lea rdx, str.Shutdown
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140277d9e
lea rdx, str.Update
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Reset
mov rcx, rbx
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetNumControllers
mov rcx, rbx
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140277d9e
lea rdx, str.GetControllerInfo
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140277d9e
lea rdx, str.GetControllerData
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140277d9e
cmp edi, 4
jne 0x140277d8f
lea rdx, str.SetControllerRumble
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x60], rax
jmp 0x140277d98
mov qword [rsp + 0x60], 0
call rsi
test eax, eax
je 0x140277dae
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x140277e1e
movsxd rdx, dword [0x14037f2c4]
lea r8, [rsp + 0x20]
lea r9, [0x1403867d0]
mov rax, qword [r8]
lea rcx, [rdx + rdx*8]
inc edx
mov qword [r9 + rcx*8], rax
mov rax, qword [r8 + 8]
mov dword [0x14037f2c4], edx
mov qword [r9 + rcx*8 + 8], rax
mov rax, qword [r8 + 0x10]
mov qword [r9 + rcx*8 + 0x10], rax
mov rax, qword [r8 + 0x18]
mov qword [r9 + rcx*8 + 0x18], rax
mov rax, qword [r8 + 0x20]
mov qword [r9 + rcx*8 + 0x20], rax
mov rax, qword [r8 + 0x28]
mov qword [r9 + rcx*8 + 0x28], rax
mov rax, qword [r8 + 0x30]
mov qword [r9 + rcx*8 + 0x30], rax
mov rax, qword [r8 + 0x38]
mov qword [r9 + rcx*8 + 0x38], rax
mov rax, qword [r8 + 0x40]
mov qword [r9 + rcx*8 + 0x40], rax
xor eax, eax
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
add rsp, 0x70
pop rbx
ret
Function at 0x140278190
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rcx, [0x140564cc0]
xor edx, edx
mov r8d, 0xc00
call sub.MSVCR90.dll_memset
xor ebx, ebx
lea rdi, [0x140564cc4]
nop word [rax + rax]
mov rcx, qword [0x1405658e0]
xor eax, eax
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x20], reloc.WS2_32.dll_sendto
mov dword [rsp + 0x24], socket
mov dword [rsp + 0x2c], 1
mov dword [rsp + 0x28], ebx
mov rax, qword [rcx]
mov edx, reloc.WS2_32.dll_socket
call qword [rax + 0x28]
cmp ebx, 2
mov ecx, dword [rsp + 0x30]
mov dword [rdi - 4], ecx
jl 0x140278214
cmp ebx, 0xd
jle 0x140278237
cmp ebx, 0x10
jl 0x14027821e
cmp ebx, 0x1b
jle 0x140278237
cmp ebx, 0x1e
jl 0x140278228
cmp ebx, 0x29
jle 0x140278237
cmp ebx, 0x2b
jl 0x140278232
cmp ebx, 0x35
jle 0x140278237
cmp ebx, 0x56
jne 0x140278267
mov edx, 1
cmp ecx, 0xff
jbe 0x140278247
shr ecx, 8
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edx, 2
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
test eax, eax
je 0x140278267
mov dword [rdi], 1
mov byte [rdi + 4], al
inc ebx
add rdi, 0xc
cmp ebx, 0x100
jl 0x1402781c0
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14027d1b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x3a0
mov rax, qword [0x140377790]
xor rax, rsp
mov qword [rsp + 0x390], rax
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareFreetrackFreetrackClient
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x60], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edi, edi
test eax, eax
jne 0x14027d259
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
lea rdx, str.Path
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11, rdi
movzx eax, byte [rsp + r11 + 0x170]
inc r11
mov byte [rsp + r11 + 0x5f], al
test al, al
jne 0x14027d244
lea r8, [rsp + 0x60]
lea rdx, str._sFreeTrackClient64.dll
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x3b0], rbx
call sub.MSVCR90.dll_sprintf
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140565a88], rax
test rax, rax
je 0x14027d33d
mov rcx, qword [str.inputlib]
lea rdx, [rsp + 0x48]
mov qword [rdx], rcx
movzx ecx, byte [0x1403174c0]
mov byte [rdx + 8], cl
lea rdx, str.FTGetData
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140565a80], rax
test rax, rax
jne 0x14027d2e8
mov rcx, qword [0x140565a88]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x140565a88], rdi
mov eax, 1
jmp 0x14027d33f
mov rcx, qword [0x140565a88]
lea rdx, str.FTGetDllVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14027d2cd
mov rcx, qword [0x140565a88]
lea rdx, str.FTReportName
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14027d2cd
mov rcx, qword [0x140565a88]
lea rdx, str.FTProvider
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14027d2cd
lea rcx, [rsp + 0x48]
call rbx
xor eax, eax
mov rbx, qword [rsp + 0x3b0]
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.140291ec0
add rsp, 0x3a0
pop rdi
ret
Function at 0x140285490
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov eax, dword [0x140e262e8]
movsxd rbx, edx
mov rsi, rcx
test eax, eax
jne 0x1402854ba
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
cmp eax, 2
jne 0x1402854ea
mov r9, qword [0x140e268f0]
lea edx, [rax - 1]
mov r8, rbx
call sub.MSVCR90.dll_fwrite
mov rcx, qword [0x140e268f0]
call sub.MSVCR90.dll_fflush
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
cmp dword [0x140e26314], 2
jl 0x1402854aa
mov ecx, dword [0x140e26348]
mov edx, dword [0x140e2634c]
lea eax, [rcx + rbx + 4]
cmp eax, edx
jle 0x14028555f
mov r8, qword [0x140e26350]
mov qword [rsp + 0x30], rdi
nop word [rax + rax]
add edx, 0x3e8
mov rcx, r8
call fcn.14014a8b0
mov edx, dword [0x140e2634c]
mov ecx, dword [0x140e26348]
add edx, 0x3e8
mov r8, rax
mov qword [0x140e26350], rax
lea eax, [rbx + rcx + 4]
mov dword [0x140e2634c], edx
cmp eax, edx
jg 0x140285520
mov rdi, qword [rsp + 0x30]
jmp 0x140285566
mov r8, qword [0x140e26350]
movsxd rax, ecx
mov rdx, rsi
mov dword [rax + r8], ebx
mov eax, dword [0x140e26348]
mov r8, rbx
add eax, 4
movsxd rcx, eax
mov dword [0x140e26348], eax
add rcx, qword [0x140e26350]
call sub.MSVCR90.dll_memcpy
add dword [0x140e26348], ebx
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x1402855b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov eax, dword [0x140e262e8]
movsxd rbx, edx
mov rsi, rcx
test eax, eax
jne 0x1402855da
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
cmp eax, 2
jne 0x14028560a
mov r9, qword [0x140e268f0]
lea edx, [rax - 1]
mov r8, rbx
call sub.MSVCR90.dll_fwrite
mov rcx, qword [0x140e268f0]
call sub.MSVCR90.dll_fflush
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
cmp dword [0x140e26314], 2
jl 0x1402855ca
mov ecx, dword [0x140e268dc]
mov edx, dword [0x140e268e0]
lea eax, [rcx + rbx + 4]
cmp eax, edx
jle 0x14028567f
mov r8, qword [0x140e268e8]
mov qword [rsp + 0x30], rdi
nop word [rax + rax]
add edx, 0x3e8
mov rcx, r8
call fcn.14014a8b0
mov edx, dword [0x140e268e0]
mov ecx, dword [0x140e268dc]
add edx, 0x3e8
mov r8, rax
mov qword [0x140e268e8], rax
lea eax, [rbx + rcx + 4]
mov dword [0x140e268e0], edx
cmp eax, edx
jg 0x140285640
mov rdi, qword [rsp + 0x30]
jmp 0x140285686
mov r8, qword [0x140e268e8]
movsxd rax, ecx
mov rdx, rsi
mov dword [rax + r8], ebx
mov eax, dword [0x140e268dc]
mov r8, rbx
add eax, 4
movsxd rcx, eax
mov dword [0x140e268dc], eax
add rcx, qword [0x140e268e8]
call sub.MSVCR90.dll_memcpy
add dword [0x140e268dc], ebx
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x140292567
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140377790]
jne 0x140291eda
rol rcx, 0x10
test cx, 0xffff
jne 0x140291ed6
repz ret
ror rcx, 0x10
jmp 0x1402924c0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1403bc6e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1403bc7d8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140292545
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1403bc6e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140292567
mov rax, qword [rsp + 0x88]
mov qword [0x1403bc7d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1403bc778], rax
mov rax, qword [0x1403bc7d8]
mov qword [0x1403bc650], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1403bc760], rax
mov dword [0x1403bc640], 0xc0000409
mov dword [0x1403bc644], 1
mov rax, qword [0x140377790]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140377798]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1403bc6d8], eax
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140318128]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1403bc6d8], 0
jne 0x1402925ee
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1402b53f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
movaps xmmword [rsp + 0x40], xmm6
mov rcx, rdx
movaps xmmword [rsp + 0x30], xmm7
mov rdi, r8
mov rbx, rdx
movaps xmmword [rsp + 0x20], xmm8
call fcn.140294f60
lea rdx, [rsi + 0x30]
mov r9d, dword [rax]
movss xmm0, dword [rax + 4]
movss xmm1, dword [rax + 8]
mov dword [rsi], r9d
movss dword [rsi + 4], xmm0
movss dword [rsi + 8], xmm1
mov ecx, dword [rax + 0x10]
movss xmm0, dword [rax + 0x14]
movss xmm1, dword [rax + 0x18]
mov dword [rsi + 0x10], ecx
mov rcx, rbx
movss dword [rsi + 0x14], xmm0
movss dword [rsi + 0x18], xmm1
movss xmm0, dword [rax + 0x24]
movss xmm1, dword [rax + 0x28]
mov eax, dword [rax + 0x20]
movss dword [rsi + 0x24], xmm0
movss dword [rsi + 0x28], xmm1
mov dword [rsi + 0x20], eax
call fcn.140294f90
mov rcx, rbx
call fcn.140294f30
lea r8, [rsi + 0x74]
lea rdx, [rsi + 0x70]
mov rcx, rbx
movss xmm0, dword [rax + 4]
movss xmm1, dword [rax + 8]
mov eax, dword [rax]
mov dword [rsi + 0x50], eax
movss dword [rsi + 0x54], xmm0
movss dword [rsi + 0x58], xmm1
mov eax, dword [rsi + 8]
movss xmm0, dword [rsi + 0x18]
movss xmm1, dword [rsi + 0x28]
mov dword [rsi + 0x60], eax
movss dword [rsi + 0x64], xmm0
movss dword [rsi + 0x68], xmm1
call fcn.1402c0650
mov rcx, rdi
call fcn.140294f60
lea rdx, [rsi + 0xf8]
mov ecx, dword [rax]
movss xmm0, dword [rax + 4]
movss xmm1, dword [rax + 8]
mov dword [rsi + 0x118], ecx
movss dword [rsi + 0x11c], xmm0
movss dword [rsi + 0x120], xmm1
mov ecx, dword [rax + 0x10]
movss xmm0, dword [rax + 0x14]
movss xmm1, dword [rax + 0x18]
mov dword [rsi + 0x128], ecx
mov rcx, rdi
movss dword [rsi + 0x12c], xmm0
movss dword [rsi + 0x130], xmm1
movss xmm0, dword [rax + 0x24]
movss xmm1, dword [rax + 0x28]
mov eax, dword [rax + 0x20]
movss dword [rsi + 0x13c], xmm0
movss dword [rsi + 0x140], xmm1
mov dword [rsi + 0x138], eax
call fcn.140294f90
mov rcx, rdi
call fcn.140294f30
lea rbx, [rsi + 0x7c]
mov edi, 8
movss xmm6, dword [0x140318e9c]
movss xmm0, dword [rax + 4]
movss xmm1, dword [rax + 8]
mov eax, dword [rax]
mov dword [rsi + 0x148], eax
movss dword [rsi + 0x14c], xmm0
movss dword [rsi + 0x150], xmm1
movss xmm7, dword [0x1403392e0]
movss xmm8, dword [0x140318ea0]
xor ebp, ebp
movaps xmm0, xmm6
call sub.MSVCR90.dll_cosf
xorps xmm0, xmm7
movss dword [rbx - 4], xmm0
movaps xmm0, xmm6
call sub.MSVCR90.dll_sinf
mov dword [rbx + 4], ebp
add rbx, 0x10
addss xmm6, xmm8
sub rdi, 1
xorps xmm0, xmm7
movss dword [rbx - 0x10], xmm0
jne 0x1402b5597
lea rax, [rsi + 0x158]
lea rcx, [rax + 0x10]
cmp rax, rcx
je 0x1402b55eb
nop dword [rax]
mov dword [rax], ebp
add rax, 4
cmp rax, rcx
jne 0x1402b55e0
mov rbx, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
mov dword [rsi + 0x16c], ebp
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
movaps xmm8, xmmword [rsp + 0x20]
add rsp, 0x50
pop rdi
ret
Function at 0x414a20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414bc6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430b40
xorps xmm15, xmm15
mov r14, qword [0x0059b460]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414a8b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414aa0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x414ac5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414ad9
cmp rbx, 0x1000
jae 0x414a95
nop dword [rax]
jmp 0x414b49
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x414aed
xor edx, edx
jmp 0x414b40
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430b40
xorps xmm15, xmm15
mov r14, qword [0x0059b460]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x414acf
jmp 0x414ab4
call fcn.0045fb60
xorps xmm15, xmm15
mov r14, qword [0x0059b460]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00435080
lea rax, [0x004ae73c]
mov ebx, 0x18
call fcn.00435980
mov rax, qword [rsp + 0x38]
call fcn.00435680
lea rax, [0x004ae7fc]
mov ebx, 0x19
call fcn.00435980
mov rax, qword [rsp + 0x30]
nop
call fcn.00435680
call fcn.004352e0
call fcn.00435100
lea rax, [0x004b09b3]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00433740
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045bfc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00414a20
Function at 0x414c00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414e2a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00430bc0
xorps xmm15, xmm15
mov r14, qword [0x0059b460]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x414c79
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x414c8c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x414cb0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x414cc4
cmp rbx, 0x1000
jae 0x414c83
jmp 0x414d45
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414cd6
xor esi, esi
jmp 0x414d36
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00430bc0
xorps xmm15, xmm15
mov r14, qword [0x0059b460]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x414cba
nop
jmp 0x414ca2
call fcn.0045fb60
xorps xmm15, xmm15
mov r14, qword [0x0059b460]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x414dc5
call fcn.00435080
lea rax, [0x004aebcb]
mov ebx, 0x19
call fcn.00435980
mov rax, qword [rsp + 0x68]
call fcn.00435680
lea rax, [0x004ae7fc]
mov ebx, 0x19
call fcn.00435980
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00435680
call fcn.004352e0
call fcn.00435100
lea rax, [0x004ab823]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00433740
cmp eax, 0x5af
je 0x414d68
call fcn.00435080
lea rax, [0x004aebcb]
mov ebx, 0x19
nop dword [rax]
call fcn.00435980
mov rax, qword [rsp + 0x38]
call fcn.00435680
lea rax, [0x004ae7fc]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00435980
mov eax, dword [rsp + 0x34]
call fcn.00435680
call fcn.004352e0
call fcn.00435100
lea rax, [0x004b02c7]
mov ebx, 0x1f
call fcn.00433740
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045bfc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00414c00