joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004db90
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
cmp qword [rcx + 0x18], 8
jb 0x14004dbc6
mov rcx, qword [rcx]
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r14 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14004dcd9
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14004dcd9
mov r9, qword [rsi + 8]
mov r8, qword [rsi]
mov rdx, r9
sub rdx, r8
mov rcx, qword [rsp + 0x48]
cmp rcx, rdx
jae 0x14004dc38
lea rax, [r8 + rcx]
mov qword [rsi + 8], rax
jmp 0x14004dc70
jbe 0x14004dc70
mov rax, qword [rsi + 0x10]
sub rax, r8
cmp rcx, rax
jbe 0x14004dc53
mov rdx, rcx
mov rcx, rsi
call fcn.1400643b0
jmp 0x14004dc6b
sub rcx, rdx
lea rbx, [rcx + r9]
mov r8, rcx
xor edx, edx
mov rcx, r9
call sub.VCRUNTIME140.dll_memset
mov qword [rsi + 8], rbx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x50]
mov r8d, ecx
mov rdx, qword [rsi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
setne bl
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14004dcd4
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14004dccf
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004dd48
mov rcx, r8
call fcn.1400653cc
movzx eax, bl
jmp 0x14004dd16
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14004dd14
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14004dd0f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004dd48
mov rcx, r8
call fcn.1400653cc
xor al, al
mov qword [rdi + 0x10], r14
mov word [rdi], r14w
mov qword [rdi + 0x18], 7
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140065230
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14004dd50
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
movaps xmmword [rax - 0x28], xmm6
lea r14, [0x14007ad70]
movsd xmm6, qword [0x14006ff30]
lea rbx, [0x140079ff4]
movaps xmmword [rax - 0x38], xmm7
xor ebp, ebp
movaps xmmword [rax - 0x48], xmm8
mov esi, ebp
movss xmm8, dword [0x14006fea4]
movabs r15, 0x346dc5d63886594b
movaps xmmword [rax - 0x58], xmm9
xorps xmm7, xmm7
movss xmm9, dword [0x14006fe58]
movzx edi, byte [r14]
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
mov byte [r14], al
mov byte [rbx - 4], al
test dil, dil
jne 0x14004df37
test al, al
je 0x14004df37
mov byte [rbx - 3], 1
xor r8b, r8b
mov byte [rbx - 2], bpl
test al, al
je 0x14004de40
mov eax, dword [0x7ffe0008]
xorps xmm0, xmm0
mov ecx, dword [0x7ffe000c]
shl rcx, 0x20
or rcx, rax
mov rax, r15
imul rcx
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cvtsi2sd xmm0, rdx
divsd xmm0, xmm6
cvtpd2ps xmm1, xmm0
movaps xmm0, xmm1
subss xmm0, dword [rbx + 4]
comiss xmm0, xmm9
jbe 0x14004de40
subss xmm1, dword [rbx]
comiss xmm1, xmm8
jbe 0x14004de40
mov byte [rbx - 3], 1
cmp byte [rbx - 3], bpl
je 0x14004deed
movss xmm0, dword [rbx]
ucomiss xmm0, xmm7
jp 0x14004de9f
jne 0x14004de9f
mov eax, dword [0x7ffe000c]
mov ecx, dword [0x7ffe0010]
cmp eax, ecx
jne 0x14004de63
mov ecx, eax
xorps xmm0, xmm0
mov eax, dword [0x7ffe0008]
shl rcx, 0x20
or rcx, rax
mov rax, r15
imul rcx
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cvtsi2sd xmm0, rdx
divsd xmm0, xmm6
cvtpd2ps xmm0, xmm0
movss dword [rbx], xmm0
mov eax, dword [0x7ffe000c]
mov ecx, dword [0x7ffe0010]
nop dword [rax]
cmp eax, ecx
jne 0x14004deb0
mov ecx, eax
xorps xmm0, xmm0
mov eax, dword [0x7ffe0008]
shl rcx, 0x20
or rcx, rax
mov rax, r15
imul rcx
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cvtsi2sd xmm0, rdx
divsd xmm0, xmm6
cvtpd2ps xmm0, xmm0
movss dword [rbx + 4], xmm0
test r8b, r8b
je 0x14004def4
mov dword [rbx], ebp
inc esi
inc r14
add rbx, 0xc
cmp esi, 0xff
jl 0x14004ddb3
movaps xmm6, xmmword [rsp + 0x50]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm7, xmmword [rsp + 0x40]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov byte [rbx - 3], bpl
test dil, dil
je 0x14004dde0
test al, al
jne 0x14004dde0
mov r8b, 1
mov byte [rbx - 2], r8b
jmp 0x14004de40
Function at 0x14005f410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x58]
xor r15d, r15d
mov r11, qword [rsp + 0x70]
mov r13, rdx
mov rax, qword [rsp + 0x60]
mov qword [r14], r8
mov qword [r11], rax
mov rdi, qword [r14]
cmp rdi, r9
je 0x14005f5a3
mov r12, qword [rsp + 0x68]
lea r8d, [r15 + 1]
mov rsi, qword [r11]
mov r9d, 0x3ff
mov r10d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x14005f5a3
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rdi]
cmp r8w, dx
jae 0x14005f4a9
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x14005f5c7
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x14005f4bf
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x14005f4bf
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x14005f4d2
movzx r9d, al
mov r10d, r15d
mov ebx, r15d
jmp 0x14005f51d
mov r9d, eax
cmp eax, 0x800
jae 0x14005f4ec
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x14005f51d
cmp eax, 0x10000
jae 0x14005f506
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov ebx, r10d
jmp 0x14005f51d
shr r9d, 0x12
mov r10d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdx, r12
sub rdx, rsi
mov ecx, r8d
cmp rdx, rcx
jl 0x14005f5a3
lea rcx, [rdi + 2]
mov qword [r14], rcx
test bpl, bpl
jne 0x14005f541
cmp r10d, 3
jae 0x14005f54d
mov rcx, qword [r11]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jle 0x14005f57e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax + rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jg 0x14005f560
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rdi, qword [r14]
cmp rdi, qword [rsp + 0x50]
jne 0x14005f45e
mov rax, qword [rsp + 0x48]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, 2
jmp 0x14005f5b2

Function at 0x140065c74
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140065cbe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140065cbe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140065cbe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140065cbe
cmp dword [rcx + 0x84], 0xe
jbe 0x140065cbe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140065cc0
xor al, al
add rsp, 0x28
ret
Function at 0x140003b60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140003bbd
lea rbx, [0x1400cfd80]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003ba4
cmp r10, 2
jb 0x140003ba4
cmp byte [r9], r8b
jne 0x140003ba4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003b80
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140003bff
lea rbx, [0x1400cfd80]
cmp r8b, 0x23
jne 0x140003be3
cmp byte [r9], r8b
jne 0x140003be3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003bd0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003dc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x140003def
mov r8d, 0x78f
lea rdx, str.C:Userszro97DesktopFactoryXiters_PremiumFactoryXiters_PremiumFactoryXiters_PremiumFactoryXiters_Premiumimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x140003dfb
mov qword [rdi], 0
lea rdx, [0x1400cf5b8]
mov rcx, rbx
call fcn.140003c10
mov rbx, rax
test rax, rax
jne 0x140003e1d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140003ef6
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003ef6
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140003ef6
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003ef6
cmp rsi, 0xffffffffffffffff
je 0x140003ef6
mov rax, qword [0x140134ef0]
test rax, rax
je 0x140003e93
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140003ef6
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140003ee3
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140134ef0]
test rax, rax
je 0x140003ed8
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140003eff
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140003ef1
mov qword [rdi], rsi
mov rax, rbp
jmp 0x140003f01
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400075a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xe8], 0
mov rbx, rcx
movsxd rdi, edx
jg 0x1400075d7
mov r8d, 0x709
lea rdx, str.C:Userszro97DesktopFactoryXiters_PremiumFactoryXiters_PremiumFactoryXiters_PremiumFactoryXiters_Premiumimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0xf0]
lea rdx, [0x1400cfd80]
movsxd r8, dword [rbx + 0xe8]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [0x140134ef0]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x140007656
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.14001d4f0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007670
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xe8], 0
mov rdi, rdx
mov rbx, rcx
jg 0x1400076a3
mov r8d, 0x709
lea rdx, str.C:Userszro97DesktopFactoryXiters_PremiumFactoryXiters_PremiumFactoryXiters_PremiumFactoryXiters_Premiumimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movss xmm0, dword [rbx + 0x108]
lea r10, [0x1400cfd80]
movsxd rcx, dword [rbx + 0xe8]
mov rax, qword [rbx + 0xf0]
movss xmm2, dword [rdi]
movss xmm1, dword [rbx + 0x10c]
subss xmm2, xmm0
movss xmm3, dword [rdi + 4]
mov r9d, dword [rax + rcx*4 - 4]
subss xmm3, xmm1
movss xmm4, dword [rdi + 8]
not r9d
movzx ecx, r9b
subss xmm4, xmm0
movss xmm0, dword [rdi + 0xc]
shr r9d, 8
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp + 0x20], xmm2
movzx eax, byte [rsp + 0x20]
xor rcx, rax
movss dword [rsp + 0x24], xmm3
mov eax, r8d
movss dword [rsp + 0x28], xmm4
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 0x2c], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x24]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x28]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
mov rbx, qword [rsp + 0x40]
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x2c]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x30
pop rdi
ret
Function at 0x1400164f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x140134ef0]
mov edi, ecx
cmp byte [rbx + 0x4a5d], 0
jne 0x140016542
cmp byte [rbx + 0x4a5e], 0
jne 0x140016542
movsx r9d, word [rbx + 0x5b5a]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140003a20
test dil, 1
je 0x140016668
jmp 0x1400165cd
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400d8f28]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400d8f0c]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x47c0], rax
mov dword [rbx + 0x47ac], 1
movss dword [rbx + 0x47b8], xmm0
movss dword [rbx + 0x47bc], xmm1
movss xmm0, dword [rbx + 0x3900]
mulss xmm0, dword [0x1400d8e90]
or dword [rbx + 0x47a8], 0x41
movss dword [rbx + 0x4808], xmm0
movsx r9d, word [rbx + 0x5b5a]
call fcn.140003a20
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140016620
lea r11, [0x1400cfd80]
nop dword [rax]
cmp r9b, 0x23
jne 0x140016603
cmp byte [r8], r9b
jne 0x140016603
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400165f0
not ecx
call fcn.14000bdf0
test rax, rax
je 0x140016668
cmp byte [rax + 0xae], 0
je 0x140016668
mov byte [rax + 0xb5], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b5a]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x5b5a]
call fcn.140003a20
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000e8a0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14001bb50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c40], 0
lea rbx, [rcx + 0x5c48]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001bbf7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001bbaa
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001e3d0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140004350
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c40]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c50]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140134ee8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001bbff
mov rcx, rbx
call fcn.140004350
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001c2a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x140134ef0]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x14001c304
lea r10, [0x1400cfd80]
cmp r8b, 0x23
jne 0x14001c2e7
cmp byte [rdx], r8b
jne 0x14001c2e7
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14001c2d4
mov eax, dword [r14 + 0x5bb8]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x14001c365
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x14001c32a
cmp edi, eax
jl 0x14001c344
mov r8d, 0x700
lea rdx, str.C:Userszro97DesktopFactoryXiters_PremiumFactoryXiters_PremiumFactoryXiters_PremiumFactoryXiters_Premiumimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [r14 + 0x5bc0]
cmp dword [rax + rbp + 8], ebx
je 0x14001c382
mov eax, dword [r14 + 0x5bb8]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x14001c321
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x14001c38f
cmp edi, dword [r14 + 0x5bb8]
jl 0x14001c3a9
mov r8d, 0x700
lea rdx, str.C:Userszro97DesktopFactoryXiters_PremiumFactoryXiters_PremiumFactoryXiters_PremiumFactoryXiters_Premiumimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5bc0]
lea rax, [rax + rcx*8]
jmp 0x14001c367
Function at 0x140043560
Capabilities:
Check for debugger via api

Disassembly:
sub rsp, 0x28
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov eax, dword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x140046630
Capabilities:
Enumerate processes

Disassembly:
push rsi
sub rsp, 0x150
mov rsi, rdx
test rdx, rdx
jne 0x14004664c
xor eax, eax
add rsp, 0x150
pop rsi
ret
mov qword [rsp + 0x160], rbx
xor edx, edx
mov qword [rsp + 0x168], rbp
mov ecx, 2
mov qword [rsp + 0x170], rdi
xor edi, edi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400466d2
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x1400466c0
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x1400466c0
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400466a0
mov rbp, qword [rsp + 0x168]
mov eax, edi
mov rdi, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rsi
ret
Function at 0x140047000
Capabilities:
Allocate or change rwx memory
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r15, rcx
xor r13d, r13d
mov r12, qword [rsp + 0xe0]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov r14, rax
test eax, eax
jg 0x14004704d
xor al, al
jmp 0x1400471ed
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, rdi
mov rdx, rsi
mov rcx, r15
call fcn.140047210
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
cmp rbx, rdi
jne 0x14004708d
xor dil, dil
jmp 0x1400471a8
lea r10, [rsp + 0x4d]
sub rdi, rbx
sar rdi, 3
mov r8, rdi
movabs r9, 0xcccccccccccccccd
nop word [rax + rax]
dec r10
mov rax, r9
mul r8
shr rdx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8, rdx
test rdx, rdx
jne 0x1400470b0
lea r9, [rsp + 0xe8]
lea r8, [rsp + 0x4d]
mov rdx, r10
lea rcx, [rsp + 0x68]
call fcn.14003eee0
lea rcx, [rsp + 0x68]
cmp qword [rsp + 0x80], 0xf
cmova rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x140047151
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004714c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004714c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6c8c
mov ebp, r13d
test rdi, rdi
je 0x1400471a5
movsxd r14, r14d
mov rsi, rbx
nop
mov edx, dword [rsi]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, r14
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], r13
mov r9, r14
mov r8, r12
mov rdx, qword [rsi]
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc ebp
lea rsi, [rsi + 8]
movsxd rax, ebp
cmp rax, rdi
jb 0x140047160
mov dil, 1
test rbx, rbx
je 0x1400471e9
mov rdx, qword [rsp + 0x60]
sub rdx, rbx
and rdx, 0xfffffffffffffff8
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400471e1
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400471e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400b6c8c
movzx eax, dil
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14004b8b0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
xor edx, edx
mov ecx, 2
xor edi, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14004b91e
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14004b91e
nop
lea rdx, str.HD_Player.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14004b91a
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14004b8f0
jmp 0x14004b91e
mov edi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x160]
mov eax, edi
add rsp, 0x150
pop rdi
ret