joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003acdc
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, edi
mov rcx, rbp
mov ebx, eax
call fcn.14003bc2c
test al, al
je 0x14003ad43
lea esi, [rdi + 0x3a98]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, edi
jb 0x14003ad2d
mov ecx, eax
sub ecx, ebx
cmp esi, ecx
ja 0x14003ad5a
sub ebx, eax
cmp ebx, 0x3e8
jb 0x14003ad5a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, edi
mov rcx, rbp
mov ebx, eax
call fcn.14003bc2c
test al, al
jne 0x14003ad11
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov al, 1
jmp 0x14003ad45

Function at 0x14003b430
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rdi, rcx
mov eax, dword [0x140075464]
xor esi, esi
test eax, eax
je 0x14003b45b
cmp eax, 1
setne al
mov byte [rcx], al
jmp 0x14003b5dd
mov qword [rbp + 0x28], rsi
lea rdx, str.IsWow64Process2
lea rcx, [rbp + 0x28]
call fcn.14003b340
cmp eax, 0x8007007f
jne 0x14003b47b
mov rbx, rsi
jmp 0x14003b487
test eax, eax
js 0x14003b5df
mov rbx, qword [rbp + 0x28]
test rbx, rbx
je 0x14003b507
mov word [rbp + 0x28], si
mov word [rbp + 0x30], si
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movabs r10, 0xbd24a77672d3d270
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x28]
mov rax, rbx
call qword [0x14004a4e8]
test eax, eax
jne 0x14003b4fb
call fcn.140038cd4
mov ebx, eax
lea rdx, str.___a_
mov rcx, qword [str.___a_]
cmp rcx, rdx
je 0x14003b4f4
test byte [rcx + 0x1c], 1
je 0x14003b4f4
mov edx, 0x1c
mov r9d, ebx
lea r8, [0x140065220]
mov rcx, qword [rcx + 0x10]
call fcn.140002534
mov eax, ebx
jmp 0x14003b5df
movzx eax, word [rbp + 0x28]
neg ax
jmp 0x14003b5ba
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rbp - 0x30], 0xc
je 0x14003b5d0
mov qword [rbp + 0x30], rsi
lea rdx, str.IsWow64Process
lea rcx, [rbp + 0x30]
call fcn.14003b340
cmp eax, 0x8007007f
jne 0x14003b54b
mov rbx, rsi
jmp 0x14003b557
test eax, eax
js 0x14003b5df
mov rbx, qword [rbp + 0x30]
test rbx, rbx
je 0x14003b5d0
mov dword [rbp + 0x28], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movabs r10, 0x9c44073830d36370
lea rdx, [rbp + 0x28]
mov rax, rbx
call qword [0x14004a4e8]
test eax, eax
jne 0x14003b5b5
call fcn.140038cd4
mov ebx, eax
lea rdx, str.___a_
mov rcx, qword [str.___a_]
cmp rcx, rdx
je 0x14003b4f4
test byte [rcx + 0x1c], 1
je 0x14003b4f4
mov edx, 0x1d
jmp 0x14003b4e1
mov eax, dword [rbp + 0x28]
neg eax
sbb ecx, ecx
neg ecx
inc ecx
mov dword [0x140075464], ecx
cmp ecx, 1
setne al
mov byte [rdi], al
jmp 0x14003b5dd
mov dword [0x140075464], 1
mov byte [rdi], sil
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003bd6c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, edx
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp rax, rdx
je 0x14003bd95
mov eax, 0x80070057
jmp 0x14003be1b
mov r8d, edx
jmp 0x14003bdb5
mov eax, dword [rsp + 0x48]
cmp eax, ebx
je 0x14003be19
test eax, eax
je 0x14003be12
cmp eax, ebx
ja 0x14003be12
sub ebx, eax
mov rcx, rsi
add rdi, rax
mov r8d, ebx
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
and dword [rsp + 0x48], 0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14003bd9a
call fcn.140038cd4
mov ebx, eax
test eax, eax
jns 0x14003be19
mov rcx, qword [str.___a_]
lea rax, str.___a_
cmp rcx, rax
je 0x14003be0e
test byte [rcx + 0x1c], 1
je 0x14003be0e
mov rcx, qword [rcx + 0x10]
lea r8, [0x140065250]
mov edx, 0x13
mov r9d, ebx
call fcn.140002534
mov eax, ebx
jmp 0x14003be1b
mov ebx, 0x8000ffff
jmp 0x14003bddd
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14003be2c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rax, rdx
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x14003be8c
call fcn.140038cd4
mov ebx, eax
mov rcx, qword [str.___a_]
lea rax, str.___a_
cmp rcx, rax
je 0x14003be88
test byte [rcx + 0x1c], 1
je 0x14003be88
mov rcx, qword [rcx + 0x10]
lea r8, [0x140065250]
mov edx, 0x15
mov r9d, ebx
call fcn.140002534
mov eax, ebx
jmp 0x14003be96
mov rax, qword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14003be9c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, dword [rdx]
mov r10, r8
mov rbx, rdx
cmp rdi, qword [rdx]
je 0x14003bebd
mov eax, 0x80070057
jmp 0x14003bf40
and qword [rdx], 0
lea r9, [rsp + 0x48]
and dword [rsp + 0x48], 0
mov rdx, r10
and qword [rsp + 0x20], 0
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14003bf2a
call fcn.140038cd4
mov edi, eax
cmp eax, 0x80070026
jne 0x14003bef5
and qword [rbx], 0
jmp 0x14003bf3e
mov rcx, qword [str.___a_]
lea rax, str.___a_
cmp rcx, rax
je 0x14003bf26
test byte [rcx + 0x1c], 1
je 0x14003bf26
mov rcx, qword [rcx + 0x10]
lea r8, [0x140065250]
mov edx, 0x16
mov r9d, edi
call fcn.140002534
mov eax, edi
jmp 0x14003bf40
cmp dword [rsp + 0x48], edi
jbe 0x14003bf37
mov eax, 0x8000ffff
jmp 0x14003bf40
mov eax, dword [rsp + 0x48]
mov qword [rbx], rax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14003c11c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14003c185
call fcn.140038cd4
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x14003c181
mov rcx, qword [str.___a_]
lea rax, str.___a_
cmp rcx, rax
je 0x14003c181
test byte [rcx + 0x1c], 1
je 0x14003c181
mov rcx, qword [rcx + 0x10]
lea r8, [0x140065250]
mov edx, 0x1e
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.140002410
mov eax, ebx
jmp 0x14003c189
mov dword [rbx], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14003c264
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14003c281
xor eax, eax
jmp 0x14003c2e0
call fcn.140038cd4
mov ebx, eax
cmp eax, 0x800700b7
je 0x14003c2cc
mov rcx, qword [str.___a_]
lea rax, str.___a_
cmp rcx, rax
je 0x14003c2c8
mov edx, 1
test byte [rcx + 0x1c], dl
je 0x14003c2c8
mov rcx, qword [rcx + 0x10]
lea r8, [0x140065250]
mov edx, 0x21
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.140002410
mov eax, ebx
jmp 0x14003c2e0
mov rcx, rdi
call fcn.14003c194
test eax, eax
mov edx, 1
cmovs edx, eax
mov eax, edx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14003c2ec
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14003c307
xor eax, eax
jmp 0x14003c350
call fcn.140038cd4
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x14003c34e
mov rcx, qword [str.___a_]
lea rax, str.___a_
cmp rcx, rax
je 0x14003c34e
test byte [rcx + 0x1c], 1
je 0x14003c34e
mov rcx, qword [rcx + 0x10]
lea r8, [0x140065250]
mov edx, 0x25
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.140002410
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call 0x14003c2ec
lea edx, [rax + 0x7ff8fffe]
cmp edx, 1
jbe 0x14003c395
cmp eax, 0x80070005
jne 0x14003c39a
mov rcx, rbx
call fcn.14003c3a0
test eax, eax
js 0x14003c39a
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x14003c2ec
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x14003c35c
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14003c307
xor eax, eax
jmp 0x14003c350
call fcn.140038cd4
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x14003c34e
mov rcx, qword [str.___a_]
lea rax, str.___a_
cmp rcx, rax
je 0x14003c34e
test byte [rcx + 0x1c], 1
je 0x14003c34e
mov rcx, qword [rcx + 0x10]
lea r8, [0x140065250]
mov edx, 0x25
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.140002410
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call 0x14003c2ec
lea edx, [rax + 0x7ff8fffe]
cmp edx, 1
jbe 0x14003c395
cmp eax, 0x80070005
jne 0x14003c39a
mov rcx, rbx
call fcn.14003c3a0
test eax, eax
js 0x14003c39a
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x14003c2ec
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x14003c3a0
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edx, 0x80
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x14003c404
call fcn.140038cd4
mov ebx, eax
mov rcx, qword [str.___a_]
lea rax, str.___a_
cmp rcx, rax
je 0x14003c400
test byte [rcx + 0x1c], 1
je 0x14003c400
mov rcx, qword [rcx + 0x10]
lea r8, [0x140065250]
mov edx, 0x26
mov dword [rsp + 0x28], ebx
mov r9, rdi
mov dword [rsp + 0x20], 0x80
call fcn.140038d00
mov eax, ebx
jmp 0x14003c406
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14003c414
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, dword [rdx]
mov rdi, r8
mov rsi, rdx
mov r8d, ebx
mov rdx, rdi
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov r9d, eax
test eax, eax
jne 0x14003c488
call fcn.140038cd4
mov ebx, eax
mov rcx, qword [str.___a_]
lea rax, str.___a_
cmp rcx, rax
je 0x14003c484
test byte [rcx + 0x1c], 1
je 0x14003c484
mov rcx, qword [rcx + 0x10]
lea r8, [0x140065250]
mov edx, 0x27
mov dword [rsp + 0x20], ebx
mov r9, rbp
call fcn.140002410
mov eax, ebx
jmp 0x14003c4aa
cmp r9d, ebx
ja 0x14003c49e
lea eax, [r9 - 1]
cmp word [rdi + rax*2], dx
je 0x14003c4a5
mov eax, 0x8000ffff
jmp 0x14003c4aa
test ebx, ebx
je 0x14003c4a5
mov word [rdi], dx
mov qword [rsi], r9
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14003def4
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x20
and dword [rsp + 0x38], 0
mov rdx, r8
mov rbx, rcx
mov byte [rcx], 0
lea r8, [rsp + 0x38]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14003df59
call fcn.140038cd4
mov ebx, eax
mov rcx, qword [str.___a_]
lea rax, str.___a_
cmp rcx, rax
je 0x14003df55
test byte [rcx + 0x1c], 1
je 0x14003df55
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400654d0]
mov edx, 0x1a
mov r9d, ebx
call fcn.140002534
mov eax, ebx
jmp 0x14003df65
cmp dword [rsp + 0x38], 0
setne al
mov byte [rbx], al
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14003ec60
Capabilities:
Get system firmware table

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, dword [rdx]
mov rbx, rdx
mov r8, rcx
mov edx, 0x56454453
mov ecx, 0x41435049
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov ecx, eax
test eax, eax
jne 0x14003ec9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
jmp 0x14003eca9
mov eax, dword [rbx]
cmp eax, ecx
mov dword [rbx], ecx
sbb ecx, ecx
and ecx, 0x80070008
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x14003faac
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd r8, dword [0x14000003c]
lea rbx, [0x140000000]
add r8, rbx
mov rsi, rdx
mov ebp, ecx
cmp dword [r8 + 0x84], 0xd
jbe 0x14003fb2b
mov r9d, dword [r8 + 0xf0]
test r9d, r9d
je 0x14003fb2b
movzx eax, word [r8 + 0x14]
lea rcx, [r8 + 0x18]
mov r10d, dword [r9 + rbx + 0xc]
add rcx, rax
movzx r11d, word [r8 + 6]
xor r9d, r9d
test r11d, r11d
je 0x14003fb2b
mov r8d, dword [rcx + 0xc]
cmp r10d, r8d
jb 0x14003fb1f
mov edx, dword [rcx + 8]
lea eax, [rdx + r8]
cmp r10d, eax
jb 0x14003fb46
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x14003fb0a
mov dword [rsi], 4
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rdi, r8
add rdi, rbx
je 0x14003fb2b
cmp dword [0x140075480], 0
jne 0x14003fb7b
cmp dword [rcx + 0x24], 0
mov dword [0x140075480], 1
jl 0x14003fb6e
mov ecx, 0x19
int 0x29
mov rcx, rdi
mov rbx, rdx
call fcn.14003fa14
jmp 0x14003fb7e
mov rbx, rdx
mov r9, rsi
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14003fb31
lea ecx, [rax + 0x19]
int 0x29
jmp 0x14003fb31
Function at 0x14004059c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ecx, 1
call fcn.1400409e4
test al, al
je 0x1400406fd
xor sil, sil
mov byte [rsp + 0x20], sil
call fcn.1400409a8
mov bl, al
mov ecx, dword [0x140074f80]
cmp ecx, 1
je 0x140040708
test ecx, ecx
jne 0x140040629
mov dword [0x140074f80], 1
lea rdx, [0x14004a588]
lea rcx, [0x14004a558]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
test eax, eax
je 0x14004060a
mov eax, 0xff
jmp 0x1400406ed
lea rdx, [0x14004a550]
lea rcx, [0x14004a4f8]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x140074f80], 2
jmp 0x140040631
mov sil, 1
mov byte [rsp + 0x20], sil
mov cl, bl
call fcn.140040b54
call fcn.140040fc8
mov rbx, rax
cmp qword [rax], 0
je 0x14004066e
mov rcx, rax
call fcn.140040abc
test al, al
je 0x14004066e
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [rbx]
call qword [0x14004a4e8]
call fcn.140040fd0
mov rbx, rax
cmp qword [rax], 0
je 0x140040690
mov rcx, rax
call fcn.140040abc
test al, al
je 0x140040690
mov rcx, qword [rbx]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_wide_environment
mov rdi, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv
mov rbx, qword [rax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
mov r8, rdi
mov rdx, rbx
mov ecx, dword [rax]
call main
mov ebx, eax
call fcn.140041134
test al, al
je 0x140040712
test sil, sil
jne 0x1400406c7
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
xor edx, edx
mov cl, 1
call fcn.140040b78
mov eax, ebx
jmp 0x1400406ed
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 7
call fcn.140040fe0
nop
mov ecx, 7
call fcn.140040fe0
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
nop
int3
sub rsp, 0x28
call fcn.140040ed4
add rsp, 0x28
jmp 0x14004059c
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
sub eax, 0x3450a934
pushfq
test eax, 0x5516db17
pop rdx
enter 0xffffffffffffa99c, 0xffffffffffffffab
fistp dword [rcx + rbp*4 - 0x566324a6]
pop rdx
fsetpm
pop rdx
fistp dword [rcx + rbp*4 - 0x56632486]
pop rdx
invalid
Function at 0x140008b20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140160600]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140160bc8]
mov esi, edx
mov edi, ecx
cmp byte [rbx + 0x20d5], 0
jne 0x140008b87
cmp byte [rbx + 0x20d6], 0
jne 0x140008b87
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140019a30
test sil, 1
je 0x140008cbc
jmp 0x140008c26
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400ceacc]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400ceac4]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
or dword [rbx + 0x1dc0], 1
mov qword [rbx + 0x1ddc], rax
movss dword [rbx + 0x1dd4], xmm0
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd8], xmm1
mov byte [rbx + 0x1dfc], 1
movss xmm0, dword [rbx + 0x1748]
mov rax, qword [0x140160bc8]
mulss xmm0, dword [0x1400cea5c]
or dword [rax + 0x1dc0], 0x40
movss dword [rax + 0x1e20], xmm0
mov r9d, dword [rbx + 0x3178]
call fcn.140019a30
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140008c76
lea r11, [0x1400c7d70]
cmp r9b, 0x23
jne 0x140008c59
cmp byte [r8], r9b
jne 0x140008c59
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140008c46
not ecx
call fcn.140017cc0
test rax, rax
je 0x140008cbc
cmp byte [rax + 0xcf], 0
je 0x140008cbc
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x3178]
call fcn.140019a30
or edi, 0x22c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.1400047e0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400c3a20
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000bbc0
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14000bdfe
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x140160600]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x1400c7d70]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x14000bdc6
mov rcx, rbp
call fcn.14000b7e0
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x14000bc91
movsxd rdx, dword [rbp + 0x31c0]
mov r8, qword [rbp + 0x31c8]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x14000bc81
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x14000bc79
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x14000bc7c
mov rdx, rcx
test rdx, rdx
jne 0x14000bc50
cmp r8, r10
je 0x14000bc91
cmp dword [r8], r9d
jne 0x14000bc91
mov rcx, qword [r8 + 8]
jmp 0x14000bc93
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb8]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x14000bd27
cmp qword [rcx + 0x18], 0
jne 0x14000bd1c
mov qword [rcx + 0x18], rbx
jmp 0x14000bd27
cmp qword [rcx + 0x20], 0
jne 0x14000bd27
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xb0], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000bd5c
nop
mov r9, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14000bd50
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rsp + 0x20]
call fcn.140019a30
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x14000bdb8
cmp r9b, 0x23
jne 0x14000bd9b
cmp byte [r8], r9b
jne 0x14000bd9b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x14000bd88
not ecx
call fcn.140017cc0
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x14000bc10
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c3a20
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x140017880
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rbx]
lea r8, [rbx + 1]
test r9b, r9b
je 0x1400178d6
lea r11, [0x1400c7d70]
cmp r9b, 0x23
jne 0x1400178b9
cmp byte [r8], r9b
jne 0x1400178b9
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400178a6
not ecx
call fcn.140017ec0
test rax, rax
jne 0x1400178ef
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14000af70
add rsp, 0x20
pop rbx
ret

Function at 0x140017d40
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x140017d90
lea r11, [0x1400c7d70]
cmp r9b, 0x23
jne 0x140017d73
cmp byte [r8], r9b
jne 0x140017d73
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140017d60
not ecx
jmp fcn.140017cc0

Function at 0x1400186a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x108], 0
mov rbx, rcx
mov edi, edx
jg 0x1400186d6
mov r8d, 0x6d1
lea rdx, str.C:UsersmfDesktop_breeze_spooferimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd r8, dword [rbx + 0x108]
mov rax, qword [rbx + 0x110]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x1400c7d70]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140160bc8]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1d6c], edx
jne 0x140018750
mov dword [rax + 0x1d70], edx
cmp dword [rax + 0x1da8], edx
jne 0x14001875f
mov byte [rax + 0x1dac], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret