joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005180
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rbx, rdx
mov rdi, rcx
xor r14d, r14d
mov ebp, r14d
mov rdx, rcx
lea rcx, [rsp + 0x70]
call fcn.180008400
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.180004c20
cmp qword [rax + 0x18], 8
jb 0x1800051c7
mov rax, qword [rax]
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20106
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180005231
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000522c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800053f3
call fcn.18000c97c
cmp esi, 2
jne 0x1800052dc
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.180008400
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.180004c20
cmp qword [rax + 0x18], 8
jb 0x18000525e
mov rax, qword [rax]
mov qword [rsp + 0x40], r14
lea rdx, [rsp + 0xd0]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1800052dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800052d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800053f9
call fcn.18000c97c
test esi, esi
jne 0x18000533f
mov eax, dword [rbx + 0x10]
add eax, eax
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1800052f2
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x180037378]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x180005330
mov ebp, 1
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x18000537a
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x180005375
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800053e7
mov rcx, r8
call fcn.18000c97c
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1800053c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1800053c0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800053ed
mov rcx, r8
call fcn.18000c97c
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
movzx eax, bpl
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.18001448c
nop
call fcn.18001448c
nop
call fcn.18001448c
int3
call fcn.18001448c
int3
Function at 0x180005400
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x2f0
xorps xmm0, xmm0
xor eax, eax
cmp qword [rdx + 0x18], 8
mov esi, r8d
mov qword [rsp + 0xd0], rax
mov rbx, rdx
mov qword [rsp + 0x60], rax
mov rdi, rcx
mov eax, 5
mov r8, rdx
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x70], 0x68
movups xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0xac], 1
movups xmmword [rsp + 0xb0], xmm0
mov word [rsp + 0xb0], ax
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0x50], xmm0
jb 0x180005491
mov r8, qword [rdx]
mov edx, 0x104
lea rcx, [rsp + 0xe0]
call fcn.1800132c8
cmp qword [rdi + 0x18], 8
mov rcx, rdi
jb 0x1800054b0
mov rcx, qword [rdi]
xor ebp, ebp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x50]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x18000553f
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x18000553a
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800055b3
mov rcx, r8
call fcn.18000c97c
mov word [rdi], bp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x180005589
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x180005584
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800055b3
mov rcx, r8
call fcn.18000c97c
mov word [rbx], bp
lea r11, [rsp + 0x2f0]
mov qword [rbx + 0x10], rbp
mov eax, esi
mov qword [rbx + 0x18], 7
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.18001448c
int3
Function at 0x180006d50
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
lea rcx, [0x1800fa2b8]
call fcn.18000b920
lea rcx, [rbp + 0x1f]
call fcn.18000a160
movups xmm0, xmmword [rax]
movups xmmword [rbp - 9], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 7], xmm1
mov ecx, dword [rax + 0x20]
mov dword [rbp + 0x17], ecx
movzx eax, word [rax + 0x24]
mov word [rbp + 0x1b], ax
mov dword [rbp - 9], 0x58316863
xor edi, edi
mov dword [rbp - 0x39], edi
mov byte [rbp - 0x35], 4
mov eax, 0x7d0
mov word [rbp - 0x34], ax
lea esi, [rdi + 4]
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
rdtsc
shl rdx, 0x20
or rax, rdx
mov r8, rax
xor eax, eax
xor ecx, ecx
cpuid
mov dword [rbp - 0x29], eax
mov dword [rbp - 0x25], ebx
mov dword [rbp - 0x21], ecx
mov dword [rbp - 0x1d], edx
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, r8
add rdi, rax
sub rsi, 1
jne 0x180006db2
shr rdi, 2
mov dword [rbp - 0x32], edi
movsd xmm0, qword [rbp - 0x39]
movsd qword [rbp - 0x29], xmm0
movzx eax, word [rbp - 0x31]
mov word [rbp - 0x21], ax
movzx eax, byte [rbp - 0x2f]
mov byte [rbp - 0x1f], al
mov dword [rbp - 0x29], 0x58326863
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 9]
call fcn.180005da0
test al, al
je 0x180006e9c
lea rdx, [0x1800fa2b8]
lea rcx, [rbp - 0x29]
call fcn.180008400
mov rcx, rax
call fcn.180006890
mov rdi, qword [0x1800fa358]
mov rsi, qword [0x1800fa360]
cmp rdi, rsi
je 0x180006e9c
nop dword [rax]
nop word [rax + rax]
lea rax, [rbp - 0x29]
mov qword [rbp + 0x67], rax
lea rdx, [0x1800fa2b8]
lea rcx, [rbp - 0x29]
call fcn.180008400
mov rbx, rax
mov rdx, rdi
lea rcx, [rbp - 9]
call fcn.180008400
nop
mov rdx, rbx
mov rcx, rax
call fcn.180005180
add rdi, 0x20
cmp rdi, rsi
jne 0x180006e60
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000b920
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x250
mov rbx, rcx
cmp qword [rcx + 0x10], 0
je 0x18000ba2c
cmp qword [rcx + 0x18], 8
jb 0x18000b94a
mov rcx, qword [rcx]
mov r8d, 0x104
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x18000ba2c
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 7
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18000b984
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180008ed0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180008360
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x18000b9e9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b9e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ba43
call fcn.18000c97c
mov rdi, rbx
cmp qword [rbx + 0x18], 8
jb 0x18000b9f6
mov rdi, qword [rbx]
mov rdx, rbx
jb 0x18000b9fe
mov rdx, qword [rbx]
mov rax, qword [rbx + 0x10]
lea rsi, [rdx + rax*2]
jb 0x18000ba0b
mov rbx, qword [rbx]
cmp rbx, rsi
je 0x18000ba28
sub rdi, rbx
movzx ecx, word [rbx]
call fcn.180014cb4
mov word [rdi + rbx], ax
add rbx, 2
cmp rbx, rsi
jne 0x18000ba13
mov al, 1
jmp 0x18000ba2e
xor al, al
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.18001448c
int3
Function at 0x100401000
Capabilities:
Packed with generic packer

Disassembly:
sub rsp, 0x28
lea rcx, [0x100412270]
call fcn.100411cb0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.100411cd0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.100411ce0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.100411cf0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
add rsp, 0x28
jmp 0x100411d00
add byte [rcx], al
add byte [rax], al
add byte [rax], al
adc byte [rax], al
add byte [rax], al
add al, byte [rax]
add byte [rax + rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add eax, 0x200
add byte [rax], al
add byte [rax], al
adc byte [rcx], al
add byte [rax], al
add al, 0
add byte [rbp + 0x30000f1], ch
add byte [rax], al
add byte [rax], 0
and byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], dl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
adc byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], dl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
adc byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add al, dl
add byte [rax], al
mov esp, 0x10
lock add byte [rax], al
call 0x100411d73
movabs al, byte [0x3300000]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x1c0000], dl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
clc
rol dword [rax], cl
add byte [rax + 3], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rsi], ch
je 0x100411e3e
js 0x100411e4f
add byte [rax], al
add byte [rax], bl
add byte [r8], al
add byte [rax], dl
add byte [rax], al
add byte [rax + rax], al
add byte [rax + rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], ah
push rax
invalid
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x40], spl
invalid
invalid

Function at 0x100411ce0
Capabilities:
Packed with generic packer

Disassembly:
add byte [rax], al
lock add byte [rdi], ch
add byte [rbx], cl
add al, byte [rdx]
and al, byte [rax]
add byte [rax], r8b
add byte [rax + rax], bh
add byte [rax], al
add byte [rdx], al
add byte [rax], al
add byte [rax], dl
add byte [rax], al
add byte [rax], dl
add byte [rax], al
add byte [rax], al
Function at 0x100411cf0
Capabilities:
Packed with generic packer

Disassembly:
add byte [rax], al
lock add byte [rdi], ch
add byte [rbx], cl
add al, byte [rdx]
and al, byte [rax]
add byte [rax], r8b
add byte [rax + rax], bh
add byte [rax], al
add byte [rdx], al
add byte [rax], al
add byte [rax], dl
add byte [rax], al
add byte [rax], dl
add byte [rax], al
add byte [rax], al

Function at 0x100411d73
Capabilities:
Packed with generic packer

Disassembly:
sub rsp, 0x28
lea rcx, [0x100412270]
call fcn.100411cb0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.100411cd0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.100411ce0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.100411cf0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
add rsp, 0x28
jmp 0x100411d00
add byte [rcx], al
add byte [rax], al
add byte [rax], al
adc byte [rax], al
add byte [rax], al
add al, byte [rax]
add byte [rax + rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add eax, 0x200
add byte [rax], al
add byte [rax], al
adc byte [rcx], al
add byte [rax], al
add al, 0
add byte [rbp + 0x30000f1], ch
add byte [rax], al
add byte [rax], 0
and byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], dl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
adc byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], dl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
adc byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add al, dl
add byte [rax], al
mov esp, 0x10
lock add byte [rax], al
call 0x100411d73
movabs al, byte [0x3300000]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x1c0000], dl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
clc
rol dword [rax], cl
add byte [rax + 3], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rsi], ch
je 0x100411e3e
js 0x100411e4f
add byte [rax], al
add byte [rax], bl
add byte [r8], al
add byte [rax], dl
add byte [rax], al
add byte [rax + rax], al
add byte [rax + rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], ah
push rax
invalid
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x40], spl
invalid
invalid
Function at 0x140006ce0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14007fc60]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x140006d6e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x140006d12
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x140006d80
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14007fc60]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x140006e84
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x140006e7f
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x140006e54
cmp qword [rsp + 0x38], 2
jb 0x140006e54
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140006e54
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140006e54
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140006dc7
jmp 0x140006f16
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x140006f16
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x140006eec
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140006eec
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140006eec
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140006e84
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x1400213c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss dword [rsp + 0x20], xmm3
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, qword [rsp + 0x80]
call fcn.140001580
mov eax, dword [rsp + 0x88]
and eax, 1
test eax, eax
je 0x140021499
mov edx, dword [rsp + 0x90]
mov ecx, 0x14
call fcn.140021190
movss dword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 0x13
call fcn.140021190
movss xmm1, dword [rsp + 0x20]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x28], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 0x12
call fcn.140021190
movss dword [rsp + 0x24], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 0x11
call fcn.140021190
movss xmm1, dword [rsp + 0x24]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x2c], xmm0
movss xmm2, dword [rsp + 0x28]
movss xmm1, dword [rsp + 0x2c]
lea rcx, [rsp + 0x50]
call fcn.140001580
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.140002480
mov eax, dword [rsp + 0x88]
and eax, 2
test eax, eax
je 0x140021547
mov edx, dword [rsp + 0x90]
mov ecx, 7
call fcn.140021190
movss dword [rsp + 0x30], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 6
call fcn.140021190
movss xmm1, dword [rsp + 0x30]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x38], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 5
call fcn.140021190
movss dword [rsp + 0x34], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 4
call fcn.140021190
movss xmm1, dword [rsp + 0x34]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x3c], xmm0
movss xmm2, dword [rsp + 0x38]
movss xmm1, dword [rsp + 0x3c]
lea rcx, [rsp + 0x58]
call fcn.140001580
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.140002480
mov eax, dword [rsp + 0x88]
and eax, 4
test eax, eax
je 0x1400215f5
mov edx, dword [rsp + 0x90]
mov ecx, 0xb
call fcn.140021190
movss dword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 0xa
call fcn.140021190
movss xmm1, dword [rsp + 0x40]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x48], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 9
call fcn.140021190
movss dword [rsp + 0x44], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 8
call fcn.140021190
movss xmm1, dword [rsp + 0x44]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x4c], xmm0
movss xmm2, dword [rsp + 0x48]
movss xmm1, dword [rsp + 0x4c]
lea rcx, [rsp + 0x60]
call fcn.140001580
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.140002480
movss xmm0, dword [rsp + 0x98]
ucomiss xmm0, dword [0x1400c4cb8]
jp 0x140021609
je 0x140021630
mov ecx, 0xe
call fcn.140005b60
movzx eax, al
test eax, eax
je 0x140021630
movss xmm1, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x80]
call fcn.140002430
movss xmm0, dword [rsp + 0xa0]
ucomiss xmm0, dword [0x1400c4cb8]
jp 0x140021644
je 0x14002166b
mov ecx, 0xf
call fcn.140005b60
movzx eax, al
test eax, eax
je 0x14002166b
movss xmm1, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x80]
call fcn.140002430
mov rax, qword [rsp + 0x80]
add rsp, 0x78
ret
Function at 0x140034950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x78
mov rax, qword [0x1400ca918]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
movzx eax, byte [rsp + 0x88]
test eax, eax
je 0x140034a69
mov rax, qword [rsp + 0x40]
add rax, 0x2fe0
mov rcx, rax
call fcn.140037260
mov qword [rsp + 0x28], rax
jmp 0x1400349c0
mov rax, qword [rsp + 0x40]
add rax, 0x2fe0
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
call fcn.140037200
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140034a69
cmp dword [rsp + 0x80], 0
je 0x1400349f1
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x80]
cmp dword [rax + 0x14], ecx
je 0x1400349f1
mov dword [rsp + 0x38], 0
jmp 0x1400349f9
mov dword [rsp + 0x38], 1
movzx eax, byte [rsp + 0x38]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140034a4f
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x14], 0
je 0x140034a4f
mov rax, qword [rsp + 0x28]
mov edx, dword [rax + 0x14]
mov rcx, qword [rsp + 0x48]
call fcn.14002a710
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140034a4f
mov rcx, qword [rsp + 0x50]
call fcn.140005bf0
mov ecx, dword [rsp + 0x80]
cmp dword [rax], ecx
jne 0x140034a4f
mov byte [rsp + 0x20], 1
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140034a64
mov rax, qword [rsp + 0x28]
mov dword [rax + 0x14], 0
jmp 0x14003499c
mov dword [rsp + 0x24], 0
jmp 0x140034a7d
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x1b38]
cmp dword [rsp + 0x24], eax
jge 0x140034b6b
mov rax, qword [rsp + 0x40]
add rax, 0x1b38
mov qword [rsp + 0x68], rax
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x68]
call fcn.140036cc0
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
cmp dword [rsp + 0x80], 0
je 0x140034b1d
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x448], 0
je 0x140034aed
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x448]
call fcn.140005bf0
mov ecx, dword [rsp + 0x80]
cmp dword [rax], ecx
je 0x140034b1d
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x450], 0
je 0x140034b13
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x450]
mov ecx, dword [rsp + 0x80]
cmp dword [rax], ecx
je 0x140034b1d
mov dword [rsp + 0x3c], 0
jmp 0x140034b25
mov dword [rsp + 0x3c], 1
movzx eax, byte [rsp + 0x3c]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x140034b66
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x458]
mov dword [rsp + 0x58], eax
movzx r8d, byte [rsp + 0x88]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
call fcn.14002bb30
movzx eax, byte [rsp + 0x88]
jmp 0x140034a73
add rsp, 0x78
ret