joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180149060
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x1801f5f20]
xor rax, rsp
mov qword [rbp + 0xe0], rax
movups xmm2, xmmword [rdx]
mov rbx, rcx
lea rcx, [rsp + 0x20]
movups xmm0, xmmword [rdx + 0x10]
mov rdx, r8
movd eax, xmm2
movups xmmword [rbp + 0xd0], xmm0
and al, 0xf8
psrldq xmm0, 0xf
movups xmmword [rbp + 0xc0], xmm2
mov byte [rbp + 0xc0], al
movd eax, xmm0
and al, 0x3f
or al, 0x40
mov byte [rbp + 0xdf], al
call fcn.180149640
lea r9, [rsp + 0x20]
lea r8, [rbp + 0xc0]
lea rcx, [rsp + 0x70]
lea rdx, [rbp + 0x60]
call fcn.180147610
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.180147900
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x40]
call fcn.18014a240
imul rax, qword [rbp + 0x48], 0x13
imul r8, qword [rbp + 0x50], 0x13
add qword [rbp - 8], rax
mov r9d, 5
imul rax, qword [rbp + 0x40], 0x13
add qword [rbp], r8
add qword [rbp - 0x10], rax
imul rax, qword [rbp + 0x38], 0x13
add qword [rbp - 0x18], rax
imul rax, qword [rbp + 0x30], 0x13
add qword [rbp - 0x20], rax
imul rax, qword [rbp + 0x28], 0x13
add qword [rbp - 0x28], rax
imul rax, qword [rbp + 0x20], 0x13
add qword [rbp - 0x30], rax
imul rax, qword [rbp + 0x18], 0x13
add qword [rbp - 0x38], rax
imul rax, qword [rbp + 0x10], 0x13
mov qword [rbp + 0x10], 0
add qword [rbp - 0x40], rax
lea rax, [rbp - 0x30]
nop dword [rax + rax]
mov r8, qword [rax - 0x10]
lea rax, [rax + 0x10]
mov rdx, r8
shr rdx, 0x20
sar edx, 0x1f
shr rdx, 6
add rdx, r8
sar rdx, 0x1a
mov rcx, rdx
shl rcx, 0x1a
sub r8, rcx
mov qword [rax - 0x20], r8
mov r8, qword [rax - 0x18]
add r8, rdx
mov rdx, r8
shr rdx, 0x20
sar edx, 0x1f
shr rdx, 7
add rdx, r8
sar rdx, 0x19
add qword [rax - 0x10], rdx
mov rcx, rdx
shl rcx, 0x19
sub r8, rcx
mov qword [rax - 0x18], r8
sub r9, 1
jne 0x180149170
imul rcx, qword [rbp + 0x10], 0x13
movaps xmm1, xmmword [rbp - 0x30]
movaps xmmword [rbp + 0x70], xmm1
movaps xmm1, xmmword [rbp - 0x10]
movaps xmmword [rbp + 0x90], xmm1
add rcx, qword [rbp - 0x40]
mov rdx, rcx
shr rdx, 0x20
sar edx, 0x1f
shr rdx, 6
add rdx, rcx
sar rdx, 0x1a
add qword [rbp - 0x38], rdx
mov rax, rdx
shl rax, 0x1a
lea rdx, [rbp + 0x60]
sub rcx, rax
mov qword [rbp - 0x40], rcx
mov rcx, rbx
movaps xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp + 0x60], xmm0
movaps xmm0, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0x80], xmm0
movaps xmm0, xmmword [rbp]
movaps xmmword [rbp + 0xa0], xmm0
call fcn.180149260
xor eax, eax
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.180131f30
mov rbx, qword [rsp + 0x208]
add rsp, 0x1f0
pop rbp
ret
Function at 0x18014c790
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1801f5f20]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [rsp + 0xa0]
mov rbp, rdx
mov edx, r8d
mov r14d, r8d
mov rdi, r9
mov r13, rcx
call fcn.18014c6e0
mov ecx, r14d
call fcn.180131b8c
mov ecx, dword [r13 + 4]
mov rsi, rax
inc ecx
shl ecx, 4
call fcn.180131b8c
mov r8, rax
mov rdx, rdi
mov rcx, r13
mov r15, rax
call fcn.18014ccb0
movups xmm0, xmmword [rbx]
xor edi, edi
movups xmmword [rsp + 0x30], xmm0
test r14d, r14d
je 0x18014c8be
mov rbx, rbp
sub rbx, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, r15
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.18014c8f0
mov edx, edi
lea r8, [rsp + 0x20]
neg rdx
mov r11d, edi
mov rcx, rdx
lea rax, [rsi + 1]
sub rcx, rsi
lea r9, [rsp + 0x21]
add r8, rcx
lea r10, [rsp + 0x22]
mov rcx, rdx
add rax, r11
sub rcx, rsi
sub rdx, rsi
add r9, rcx
add r10, rdx
mov edx, 4
movzx ecx, byte [rbx + rax - 1]
xor cl, byte [r8 + rax - 1]
mov byte [rax - 1], cl
movzx ecx, byte [rbx + rax]
xor cl, byte [r8 + rax]
mov byte [rax], cl
movzx ecx, byte [rbx + rax + 1]
xor cl, byte [r9 + rax]
mov byte [rax + 1], cl
movzx ecx, byte [rbx + rax + 2]
xor cl, byte [r10 + rax]
mov byte [rax + 2], cl
lea rax, [rax + 4]
sub rdx, 1
jne 0x18014c870
movups xmm0, xmmword [rdi + rbp]
add edi, 0x10
movups xmmword [rsp + 0x30], xmm0
cmp edi, r14d
jb 0x18014c820
mov rcx, r15
call fcn.180131a88
mov rax, rsi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180131f30
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x18014ccb0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub rsp, 0x18
mov eax, dword [rcx]
mov r10, r8
shl eax, 2
xor r8d, r8d
mov r11, rcx
test eax, eax
je 0x18014cce6
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [r8 + r10], al
inc r8d
mov eax, dword [rcx]
shl eax, 2
cmp r8d, eax
jb 0x18014ccd0
mov eax, dword [rcx + 4]
mov r9d, dword [rcx]
inc eax
shl eax, 4
shl r9d, 2
cmp r9d, eax
jae 0x18014cefc
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x30], rsi
lea esi, [r9 + 2]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x10], r12
lea r12, str.cw
mov qword [rsp + 8], r14
mov qword [rsp], r15
nop dword [rax + rax]
mov edi, dword [r11]
lea eax, [r9 - 4]
movzx ebx, byte [rax + r10]
xor edx, edx
lea eax, [r9 - 3]
movzx ebp, byte [rax + r10]
lea eax, [r9 - 2]
movzx r14d, byte [rax + r10]
lea eax, [r9 - 1]
movzx r15d, byte [rax + r10]
mov eax, r9d
shr eax, 2
div edi
test edx, edx
jne 0x18014cdfa
movzx eax, bpl
lea r8d, [rdi*4]
mov ecx, eax
movzx edx, bl
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
movzx eax, r14b
movzx ebx, byte [rcx + r12]
mov ecx, eax
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
movzx eax, r15b
movzx ebp, byte [rcx + r12]
mov ecx, eax
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
mov eax, edx
and eax, 0xf
movzx r14d, byte [rcx + r12]
mov ecx, edx
and rcx, 0xfffffffffffffff0
xor edx, edx
add rcx, rax
mov eax, r9d
div r8d
movzx r15d, byte [rcx + r12]
mov cl, 1
sub eax, 1
je 0x18014cdf6
mov r8d, eax
nop dword [rax + rax]
movzx eax, cl
add cl, cl
shr al, 7
movzx eax, al
imul edx, eax, 0x1b
xor cl, dl
sub r8, 1
jne 0x18014cde0
xor bl, cl
jmp 0x18014ce57
cmp edi, 6
jbe 0x18014ce57
cmp edx, 4
jne 0x18014ce57
movzx eax, bl
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
movzx eax, bpl
movzx ebx, byte [rcx + r12]
mov ecx, eax
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
movzx eax, r14b
movzx ebp, byte [rcx + r12]
mov ecx, eax
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
movzx eax, r15b
movzx r14d, byte [rcx + r12]
mov ecx, eax
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
movzx r15d, byte [rcx + r12]
mov ecx, r9d
lea eax, [rdi*4]
sub ecx, eax
movzx ecx, byte [rcx + r10]
xor cl, bl
mov byte [r9 + r10], cl
mov ecx, r9d
mov eax, dword [r11]
shl eax, 2
sub ecx, eax
lea eax, [rsi - 1]
inc ecx
movzx edx, byte [rcx + r10]
mov ecx, r9d
xor dl, bpl
mov byte [rax + r10], dl
mov eax, dword [r11]
shl eax, 2
sub ecx, eax
add ecx, 2
movzx ecx, byte [rcx + r10]
xor cl, r14b
mov byte [rsi + r10], cl
mov ecx, r9d
mov eax, dword [r11]
add r9d, 4
shl eax, 2
sub ecx, eax
lea eax, [rsi + 1]
add ecx, 3
add esi, 4
movzx edx, byte [rcx + r10]
xor dl, r15b
mov byte [rax + r10], dl
mov eax, dword [r11 + 4]
inc eax
shl eax, 4
cmp r9d, eax
jb 0x18014cd30
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r12, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
add rsp, 0x18
ret
Function at 0x18014db20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov rax, qword [rdx]
xor ebx, ebx
mov r9, qword [rdx + 8]
mov r14, rcx
mov edi, ebx
mov rsi, rcx
movabs r15, 0xe100000000000000
lea ebp, [rbx + 0x10]
nop word [rax + rax]
movzx r10d, byte [rsi]
mov r11d, 8
nop word [rax + rax]
mov r8, r9
movzx edx, r10b
shr rdx, 7
and r8d, 1
not rdx
not r8
inc rdx
inc r8
mov rcx, rdx
and r8, r15
and rdx, r9
and rcx, rax
xor rdi, rdx
xor rbx, rcx
mov rdx, rax
mov rcx, r9
shl rdx, 0x3f
add r10b, r10b
shr rcx, 1
mov r9, rdx
shr rax, 1
or r9, rcx
xor rax, r8
sub r11, 1
jne 0x18014db70
inc rsi
sub rbp, 1
jne 0x18014db60
mov rbp, qword [rsp + 0x20]
mov rcx, rbx
mov rsi, qword [rsp + 0x28]
and ecx, 0xff00
mov rdx, rbx
mov rax, rbx
shr rax, 0x10
movabs r11, 0xff000000000000
and rdx, r11
movabs r10, 0xff0000000000
or rdx, rax
movabs r9, 0xff00000000
shr rdx, 0x10
mov rax, rbx
and rax, r10
mov r8d, 0xff000000
or rdx, rax
mov rax, rbx
and rax, r9
shr rdx, 0x10
or rdx, rax
mov rax, rbx
shl rax, 0x10
or rcx, rax
shr rdx, 8
shl rcx, 0x10
mov rax, rbx
and eax, 0xff0000
and rbx, r8
or rcx, rax
mov rax, rdi
shl rcx, 0x10
or rcx, rbx
shr rax, 0x10
mov rbx, qword [rsp + 0x18]
shl rcx, 8
or rdx, rcx
mov rcx, rdi
mov qword [r14], rdx
and ecx, 0xff00
mov rdx, rdi
and rdx, r11
or rdx, rax
mov rax, rdi
and rax, r10
shr rdx, 0x10
or rdx, rax
mov rax, rdi
and rax, r9
shr rdx, 0x10
or rdx, rax
mov rax, rdi
shl rax, 0x10
or rcx, rax
shr rdx, 8
shl rcx, 0x10
mov rax, rdi
and rdi, r8
and eax, 0xff0000
or rcx, rax
shl rcx, 0x10
or rcx, rdi
mov rdi, qword [rsp + 0x30]
shl rcx, 8
or rdx, rcx
mov qword [r14 + 8], rdx
pop r15
pop r14
ret
Function at 0x18014de50
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x18014e0a4
push r12
push r14
push r15
sub rsp, 0x10
mov qword [rsp + 0x30], rbx
mov r15, r8
mov qword [rsp + 0x38], rbp
mov r12, rdx
mov qword [rsp + 0x40], rsi
mov r14, rcx
mov qword [rsp + 8], rdi
mov qword [rsp], r13
nop dword [rax]
nop dword [rax + rax]
mov eax, reloc.WS2_32.dll_recv
sub al, byte [r14 + 0x20]
movzx ecx, al
cmp rcx, r15
movzx r9d, al
movzx eax, r15b
lea rcx, [r14 + 0x10]
cmova r9d, eax
movzx eax, byte [r14 + 0x20]
add rcx, rax
test r9b, r9b
je 0x18014dee1
mov r8, r12
movzx edx, r9b
sub r8, rcx
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x18014ded0
add byte [r14 + 0x20], r9b
movzx eax, r9b
sub r15, rax
add r12, rax
cmp byte [r14 + 0x20], 0x10
jne 0x18014e079
mov rax, qword [r14]
lea rsi, [r14 + 0x10]
mov r9, qword [r14 + 8]
xor ebx, ebx
xor edi, edi
movabs r13, 0xe100000000000000
lea ebp, [rbx + 0x10]
nop word [rax + rax]
movzx r10d, byte [rsi]
mov r11d, 8
nop word [rax + rax]
mov r8, r9
movzx edx, r10b
shr rdx, 7
and r8d, 1
not rdx
not r8
inc rdx
inc r8
mov rcx, rdx
and r8, r13
and rdx, r9
and rcx, rax
xor rdi, rdx
xor rbx, rcx
mov rdx, rax
mov rcx, r9
shl rdx, 0x3f
add r10b, r10b
shr rcx, 1
mov r9, rdx
shr rax, 1
or r9, rcx
xor rax, r8
sub r11, 1
jne 0x18014df30
inc rsi
sub rbp, 1
jne 0x18014df20
mov rcx, rbx
mov rdx, rbx
and ecx, 0xff00
movabs r8, 0xff000000000000
and rdx, r8
mov rax, rbx
shr rax, 0x10
movabs r10, 0xff0000000000
or rdx, rax
movabs r11, 0xff00000000
shr rdx, 0x10
mov rax, rbx
and rax, r10
mov esi, 0xff000000
or rdx, rax
mov rax, rbx
and rax, r11
shr rdx, 0x10
or rdx, rax
mov rax, rbx
shl rax, 0x10
or rcx, rax
shr rdx, 8
shl rcx, 0x10
mov rax, rbx
and eax, 0xff0000
and rbx, rsi
or rcx, rax
mov rax, rdi
shl rcx, 0x10
or rcx, rbx
shr rax, 0x10
shl rcx, 8
or rdx, rcx
mov rcx, rdi
mov qword [r14 + 0x10], rdx
and ecx, 0xff00
mov rdx, rdi
and rdx, r8
or rdx, rax
mov rax, rdi
and rax, r10
shr rdx, 0x10
or rdx, rax
mov rax, rdi
and rax, r11
shr rdx, 0x10
or rdx, rax
mov rax, rdi
shl rax, 0x10
or rcx, rax
shr rdx, 8
shl rcx, 0x10
mov rax, rdi
and eax, 0xff0000
and rdi, rsi
or rcx, rax
shl rcx, 0x10
or rcx, rdi
shl rcx, 8
or rdx, rcx
mov qword [r14 + 0x18], rdx
mov byte [r14 + 0x20], bpl
test r15, r15
jne 0x18014de90
mov r13, qword [rsp]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x10
pop r15
pop r14
pop r12
ret

Function at 0x180166f40
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x180166cf0
Function at 0x1400112bc
Capabilities:
Terminate process

Disassembly:
jmp 0x140014e50
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011370
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x140013270
push rbp
push rdi
sub rsp, 0x3e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x92
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140020288]
xor rax, rbp
mov qword [rbp + 0x3b8], rax
lea rcx, [0x1400260f5]
call fcn.1400114f1
lea r8, [0x140020200]
lea rdx, [rbp + 0x10]
lea rcx, section..data
call fcn.1400114ba
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1ff
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x228], rax
mov r8d, 0x1ff
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x228]
call fcn.140011271
call qword [rbp + 0x228]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001cda0]
call fcn.140011438
mov eax, edi
mov rcx, qword [rbp + 0x3b8]
xor rcx, rbp
call fcn.14001126c
lea rsp, [rbp + 0x3c8]
pop rdi
pop rbp
ret

Function at 0x140011384
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400161a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400161c0
xor al, al
jmp 0x140016241
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400161d3
xor al, al
jmp 0x140016241
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400161fd
xor al, al
jmp 0x140016241
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140016211
xor al, al
jmp 0x140016241
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140016223
xor al, al
jmp 0x140016241
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001623f
xor al, al
jmp 0x140016241
mov al, 1
add rsp, 0x38
ret
Function at 0x1400114ba
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140012e90
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x1400260f5]
call fcn.1400114f1
mov dword [rbp + 4], 0
jmp 0x140012eca
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
movsxd rax, dword [rbp + 4]
cmp rax, 0x1fe
jae 0x140012f5e
mov ecx, 1
call fcn.140011055
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x28], rax
movsxd rax, dword [rbp + 4]
lea rcx, section..data
mov rdx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
mov byte [rdx], al
mov dword [rbp + 0x44], 7
jmp 0x140012f1c
mov eax, dword [rbp + 0x44]
dec eax
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0xffffffff
jle 0x140012f44
movsxd rax, dword [rbp + 0x44]
mov rcx, qword [rbp + 0x170]
movzx eax, byte [rcx + rax]
mov rcx, qword [rbp + 0x28]
movzx ecx, byte [rcx]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rbp + 0x28]
mov byte [rcx], al
jmp 0x140012f14
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x168]
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
mov byte [rcx + rax], dl
jmp 0x140012ec2
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x140a337c1
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x28]
call fcn.140c42952
Function at 0x140002d54
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002d9e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002d9e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002d9e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002d9e
cmp dword [rcx + 0x84], 0xe
jbe 0x140002d9e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002da0
xor al, al
add rsp, 0x28
ret
Function at 0x1400039d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140003a2d
lea rbx, [0x1400c24e0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003a14
cmp r10, 2
jb 0x140003a14
cmp byte [r9], r8b
jne 0x140003a14
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400039f0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140003a6f
lea rbx, [0x1400c24e0]
cmp r8b, 0x23
jne 0x140003a53
cmp byte [r9], r8b
jne 0x140003a53
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003a40
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003c30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x140003c5f
mov r8d, 0x78f
lea rdx, str.D:_attloaderloaderBlue_loaderimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x140003c6b
mov qword [rdi], 0
lea rdx, [0x1400c1d28]
mov rcx, rbx
call fcn.140003a80
mov rbx, rax
test rax, rax
jne 0x140003c8d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140003d66
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003d66
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140003d66
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003d66
cmp rsi, 0xffffffffffffffff
je 0x140003d66
mov rax, qword [0x14042aed0]
test rax, rax
je 0x140003d03
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140003d66
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140003d53
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14042aed0]
test rax, rax
je 0x140003d48
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140003d6f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140003d61
mov qword [rdi], rsi
mov rax, rbp
jmp 0x140003d71
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140007410
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xe8], 0
mov rbx, rcx
movsxd rdi, edx
jg 0x140007447
mov r8d, 0x704
lea rdx, str.D:_attloaderloaderBlue_loaderimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0xf0]
lea rdx, [0x1400c24e0]
movsxd r8, dword [rbx + 0xe8]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [0x14042aed0]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x1400074c6
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.14001d2c0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140016250
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x14042aed0]
mov edi, ecx
cmp byte [rbx + 0x4a5d], 0
jne 0x1400162a2
cmp byte [rbx + 0x4a5e], 0
jne 0x1400162a2
movsx r9d, word [rbx + 0x5b5a]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140003890
test dil, 1
je 0x1400163c8
jmp 0x14001632d
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400c9c9c]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400c9c8c]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x47c0], rax
mov dword [rbx + 0x47ac], 1
movss dword [rbx + 0x47b8], xmm0
movss dword [rbx + 0x47bc], xmm1
movss xmm0, dword [rbx + 0x3900]
mulss xmm0, dword [0x1400c9c00]
or dword [rbx + 0x47a8], 0x41
movss dword [rbx + 0x4808], xmm0
movsx r9d, word [rbx + 0x5b5a]
call fcn.140003890
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140016380
lea r11, [0x1400c24e0]
nop dword [rax]
cmp r9b, 0x23
jne 0x140016363
cmp byte [r8], r9b
jne 0x140016363
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140016350
not ecx
call fcn.14000b7c0
test rax, rax
je 0x1400163c8
cmp byte [rax + 0xae], 0
je 0x1400163c8
mov byte [rax + 0xb5], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b5a]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x5b5a]
call fcn.140003890
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000e270
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret